To: vim_dev@googlegroups.com
Subject: Patch 8.2.2243
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------

Patch 8.2.2243
Problem:    Crash when popup mask contains zeroes.
Solution:   Check boundaries properly. (closes #7569)
Files:      src/popupwin.c, src/testdir/test_popupwin.vim


*** ../vim-8.2.2242/src/popupwin.c	2020-12-12 18:17:46.463804077 +0100
--- src/popupwin.c	2020-12-29 11:53:45.436459735 +0100
***************
*** 3346,3366 ****
  	cols = tv_get_number(&li->li_tv);
  	if (cols < 0)
  	    cols = width + cols + 1;
  	li = li->li_next;
  	cole = tv_get_number(&li->li_tv);
  	if (cole < 0)
  	    cole = width + cole + 1;
  	li = li->li_next;
  	lines = tv_get_number(&li->li_tv);
  	if (lines < 0)
  	    lines = height + lines + 1;
  	li = li->li_next;
  	linee = tv_get_number(&li->li_tv);
  	if (linee < 0)
  	    linee = height + linee + 1;
  
! 	for (row = lines - 1; row < linee && row < height; ++row)
! 	    for (col = cols - 1; col < cole && col < width; ++col)
  		cells[row * width + col] = 1;
      }
  }
--- 3346,3374 ----
  	cols = tv_get_number(&li->li_tv);
  	if (cols < 0)
  	    cols = width + cols + 1;
+ 	if (cols <= 0)
+ 	    cols = 1;
  	li = li->li_next;
  	cole = tv_get_number(&li->li_tv);
  	if (cole < 0)
  	    cole = width + cole + 1;
+ 	if (cole > width)
+ 	    cole = width;
  	li = li->li_next;
  	lines = tv_get_number(&li->li_tv);
  	if (lines < 0)
  	    lines = height + lines + 1;
+ 	if (lines <= 0)
+ 	    lines = 1;
  	li = li->li_next;
  	linee = tv_get_number(&li->li_tv);
  	if (linee < 0)
  	    linee = height + linee + 1;
+ 	if (linee > height)
+ 	    linee = height;
  
! 	for (row = lines - 1; row < linee; ++row)
! 	    for (col = cols - 1; col < cole; ++col)
  		cells[row * width + col] = 1;
      }
  }
*** ../vim-8.2.2242/src/testdir/test_popupwin.vim	2020-12-18 19:49:52.345571854 +0100
--- src/testdir/test_popupwin.vim	2020-12-29 11:56:28.251890497 +0100
***************
*** 821,826 ****
--- 821,830 ----
    " clean up
    call StopVimInTerminal(buf)
    call delete('XtestPopupMask')
+ 
+   " this was causing a crash
+   call popup_create('test', #{mask: [[0, 0, 0, 0]]})
+   call popup_clear()
  endfunc
  
  func Test_popup_select()
*** ../vim-8.2.2242/src/version.c	2020-12-29 11:14:58.444606193 +0100
--- src/version.c	2020-12-29 11:54:42.640259246 +0100
***************
*** 752,753 ****
--- 752,755 ----
  {   /* Add new patch number below this line */
+ /**/
+     2243,
  /**/

-- 
Portable Computer:  A device invented to force businessmen
to work at home, on vacation, and on business trips.

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\  an exciting new programming language -- http://www.Zimbu.org        ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///