[patch] Crash with EOL visual-block over a fold

[James Vega]

Bram,

If one uses <C-v>$ to start visual-block mode, and then moves the cursor
over a fold, Vim will crash.  As a simple test, you can follow the
commands below with this email.

" :set fdm=marker
" zM
" <C-v>$jG
{{{
 screen.c:
 2534    if (wp->w_old_cursor_lcol + txtcol < (colnr_T)W_WIDTH(wp))¶
 2535        len = wp->w_old_cursor_lcol;¶
 2536    else¶
 2537        len = W_WIDTH(wp) - txtcol;¶
 2538    RL_MEMSET(wp->w_old_cursor_fcol + txtcol, hl_attr(HLF_V),¶
 2539                            len - (int)wp->w_old_cursor_fcol);¶
}}}

This is due to wp->w_old_cursor_lcol being set to MAXCOL, so the sum in
the above comparison overflows and incorrectly causes the comparison to
succeed.  So, RL_MEMSET walks off the end of ScreenAttrs.

Attached patch fixes the problem.

Thanks,
-- 
James
GPG Key: 1024D/61326D40 2003-09-02 James Vega <james...@jamessan.com>

diff --git a/src/screen.c b/src/screen.c
--- a/src/screen.c
+++ b/src/screen.c
@@ -2531,7 +2531,8 @@
 		/* Visual block mode: highlight the chars part of the block */
 		if (wp->w_old_cursor_fcol + txtcol < (colnr_T)W_WIDTH(wp))
 		{
-		    if (wp->w_old_cursor_lcol + txtcol < (colnr_T)W_WIDTH(wp))
+		    if (wp->w_old_cursor_lcol != MAXCOL
+			    && wp->w_old_cursor_lcol + txtcol < (colnr_T)W_WIDTH(wp))
 			len = wp->w_old_cursor_lcol;
 		    else
 			len = W_WIDTH(wp) - txtcol;

signature.asc
Description: Digital signature