[patch] Bad pointer arithmetics in getvcol(). Was: Re: Internal error on Vim 7.2

[Lech Lorens]

On 02-Mar-2010 Martti Kuparinen <martti.kupari...@iki.fi> wrote:
> Hi,
> 
> I'm the Vim maintainer in NetBSD pkgsrc and I was looking two weird problem 
> reports:
> 
> http://www.netbsd.org/cgi-bin/query-pr-single.pl?number=39375
> http://www.netbsd.org/cgi-bin/query-pr-single.pl?number=42909
> 
> Few minutes ago I tested the first myself with 7.2.367 and I have no
> problems on NetBSD/amd64 while on NetBSD/i386 I get the same
> 
> E341: Internal error: lalloc(0, )
> cannot yank; delete anyway (y/n)?
> 
> message as described in both PRs. Any ideas where to start debugging this?
> 
> Martti

The attached patch fixes the problem.

Additionally, I indented the comment in memline.c as its wrong
indentation always misleads me to think that the function ends just
before the comment.

-- 
Cheers,
Lech

-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

diff --git a/src/charset.c b/src/charset.c
index 5b0e71c..ec8b7cf 100644
--- a/src/charset.c
+++ b/src/charset.c
@@ -1252,10 +1252,17 @@ getvcol(wp, pos, start, cursor, end)
     int		head;
     int		ts = wp->w_buffer->b_p_ts;
     int		c;
+    int		len;
 
     vcol = 0;
     ptr = ml_get_buf(wp->w_buffer, pos->lnum, FALSE);
-    posptr = ptr + pos->col;
+    len = STRLEN(ptr);
+    /* NOTE: "pos->col" can be MAXCOL, which will likely make comparisons
+     * between "ptr" and "posptr" make no sense. Compare "pos->col" and "len"
+     * just in case. */
+    posptr = ptr + (pos->col < len?
+		    pos->col:
+		    len);
 
     /*
      * This function is used very often, do some speed optimizations.
diff --git a/src/memline.c b/src/memline.c
index 29a6e5c..102b61e 100644
--- a/src/memline.c
+++ b/src/memline.c
@@ -2113,12 +2113,12 @@ errorret:
     if (buf->b_ml.ml_mfp == NULL)	/* there are no lines */
 	return (char_u *)"";
 
-/*
- * See if it is the same line as requested last time.
- * Otherwise may need to flush last used line.
- * Don't use the last used line when 'swapfile' is reset, need to load all
- * blocks.
- */
+    /*
+     * See if it is the same line as requested last time.
+     * Otherwise may need to flush last used line.
+     * Don't use the last used line when 'swapfile' is reset, need to load all
+     * blocks.
+     */
     if (buf->b_ml.ml_line_lnum != lnum || mf_dont_release)
     {
 	ml_flush_line(buf);