patch 9.1.0121: Infinite loop or signed overflow with 'smoothscroll'
Commit:
https://github.com/vim/vim/commit/02fcae02a926e4e8379d77fb716da4202029882d
Author: Sean Dewar <[email protected]>
Date: Wed Feb 21 19:40:44 2024 +0100
patch 9.1.0121: Infinite loop or signed overflow with 'smoothscroll'
Problem: infinite loop in win_update with 'smoothscroll' set when
window width is equal to textoff, or signed integer overflow
if smaller.
Solution: don't revalidate wp->w_skipcol in that case, as no buffer text
is being shown. (Sean Dewar)
Don't instead reset w_skipcol; that would lose the scroll position
within the line, which may be undesirable if the window is made wider
later.
Also include changes from the splitmove PR #14042 that I (in my infinite
Git wisdom) forgot to commit. This includes a change to
Test_window_split_no_room to ensure it doesn't fail for some screen
sizes.
Move Test_smoothscroll_in_zero_width_window to test_scroll_opt.vim, as
that file feels more appropriate.
closes: #14068
Signed-off-by: Sean Dewar <[email protected]>
Signed-off-by: Christian Brabandt <[email protected]>
diff --git a/src/drawscreen.c b/src/drawscreen.c
index 852d33182..5fb37a984 100644
--- a/src/drawscreen.c
+++ b/src/drawscreen.c
@@ -1537,7 +1537,7 @@ win_update(win_T *wp)
// Make sure skipcol is valid, it depends on various options and the window
// width.
- if (wp->w_skipcol > 0)
+ if (wp->w_skipcol > 0 && wp->w_width > win_col_off(wp))
{
int w = 0;
int width1 = wp->w_width - win_col_off(wp);
diff --git a/src/proto/window.pro b/src/proto/window.pro
index 0ec57349b..a91a51190 100644
--- a/src/proto/window.pro
+++ b/src/proto/window.pro
@@ -28,7 +28,7 @@ void may_make_initial_scroll_size_snapshot(void);
void may_trigger_win_scrolled_resized(void);
void win_close_othertab(win_T *win, int free_buf, tabpage_T *tp);
void win_free_all(void);
-win_T *winframe_remove(win_T *win, int *dirp, tabpage_T *tp, frame_T
**to_flatten);
+win_T *winframe_remove(win_T *win, int *dirp, tabpage_T *tp, frame_T
**unflat_altfr);
void close_others(int message, int forceit);
void unuse_tabpage(tabpage_T *tp);
void use_tabpage(tabpage_T *tp);
diff --git a/src/testdir/test_scroll_opt.vim b/src/testdir/test_scroll_opt.vim
index f41f0e291..346776074 100644
--- a/src/testdir/test_scroll_opt.vim
+++ b/src/testdir/test_scroll_opt.vim
@@ -960,4 +960,42 @@ func Test_smoothscroll_insert_bottom()
call StopVimInTerminal(buf)
endfunc
+func Test_smoothscroll_in_zero_width_window()
+ set cpo+=n number smoothscroll
+ set winwidth=99999 winminwidth=0
+
+ vsplit
+ call assert_equal(0, winwidth(winnr('#')))
+ call win_execute(win_getid(winnr('#')), "norm! \<C-Y>")
+
+ only!
+ set winwidth& winminwidth&
+ set cpo-=n nonumber nosmoothscroll
+endfunc
+
+func Test_smoothscroll_textoff_small_winwidth()
+ set smoothscroll number
+ call setline(1, 'llanfairpwllgwyngyllgogerychwyrndrobwllllantysiliogogogoch')
+ vsplit
+
+ let textoff = getwininfo(win_getid())[0].textoff
+ execute 'vertical resize' textoff + 1
+ redraw
+ call assert_equal(0, winsaveview().skipcol)
+ execute "normal! 0\<C-E>"
+ redraw
+ call assert_equal(1, winsaveview().skipcol)
+ execute 'vertical resize' textoff - 1
+ " This caused a signed integer overflow.
+ redraw
+ call assert_equal(1, winsaveview().skipcol)
+ execute 'vertical resize' textoff
+ " This caused an infinite loop.
+ redraw
+ call assert_equal(1, winsaveview().skipcol)
+
+ %bw!
+ set smoothscroll& number&
+endfunc
+
" vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/testdir/test_window_cmd.vim b/src/testdir/test_window_cmd.vim
index ff4ab845e..a68ed74cb 100644
--- a/src/testdir/test_window_cmd.vim
+++ b/src/testdir/test_window_cmd.vim
@@ -322,14 +322,18 @@ func Test_window_split_no_room()
call assert_equal(restcmd, winrestcmd())
" Check that the last statusline isn't lost.
- set laststatus=0
- let restcmd = winrestcmd()
+ " Set its window's width to 2 for the test.
wincmd j
+ set laststatus=0 winminwidth=0
+ vertical resize 2
+ set winminwidth&
call setwinvar(winnr('k'), '&statusline', '@#')
let last_stl_row = win_screenpos(0)[0] - 1
redraw
call assert_equal('@#|', GetScreenStr(last_stl_row))
call assert_equal('~ |', GetScreenStr(&lines - &cmdheight))
+
+ let restcmd = winrestcmd()
call assert_fails('wincmd H', 'E36:')
call assert_fails('wincmd L', 'E36:')
call assert_equal(layout, winlayout())
@@ -2153,19 +2157,6 @@ func Test_new_help_window_on_error()
call assert_equal(expand("<cword>"), "'mod'")
endfunc
-func Test_smoothscroll_in_zero_width_window()
- set cpo+=n number smoothscroll
- set winwidth=99999 winminwidth=0
-
- vsplit
- call assert_equal(0, winwidth(winnr('#')))
- call win_execute(win_getid(winnr('#')), "norm! \<C-Y>")
-
- only!
- set winwidth& winminwidth&
- set cpo-=n nonumber nosmoothscroll
-endfunc
-
func Test_splitmove_flatten_frame()
split
vsplit
@@ -2179,7 +2170,7 @@ func Test_splitmove_flatten_frame()
only!
endfunc
-func Test_splitmove_autocmd_window_no_room()
+func Test_autocmd_window_force_room()
" Open as many windows as possible
while v:true
try
@@ -2206,7 +2197,7 @@ func Test_splitmove_autocmd_window_no_room()
edit unload me
enew
bunload! unload\ me
- augroup SplitMoveAucmdWin
+ augroup AucmdWinForceRoom
au!
au BufEnter * ++once let s:triggered = v:true
\| call assert_equal('autocmd', win_gettype())
@@ -2220,8 +2211,8 @@ func Test_splitmove_autocmd_window_no_room()
call assert_equal(winrestcmd(), restcmd)
unlet! s:triggered
- au! SplitMoveAucmdWin
- augroup! SplitMoveAucmdWin
+ au! AucmdWinForceRoom
+ augroup! AucmdWinForceRoom
%bw!
endfunc
diff --git a/src/version.c b/src/version.c
index d49516551..471ecd83c 100644
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 121,
/**/
120,
/**/
diff --git a/src/window.c b/src/window.c
index a6223eeff..66a1d7de4 100644
--- a/src/window.c
+++ b/src/window.c
@@ -54,7 +54,7 @@ static void win_goto_hor(int left, long count);
static void frame_add_height(frame_T *frp, int n);
static void last_status_rec(frame_T *fr, int statusline);
static void frame_flatten(frame_T *frp);
-static void winframe_restore(win_T *wp, int dir, frame_T *to_flatten);
+static void winframe_restore(win_T *wp, int dir, frame_T *unflat_altfr);
static int make_snapshot_rec(frame_T *fr, frame_T **frp);
static void clear_snapshot(tabpage_T *tp, int idx);
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/vim_dev/E1rcrad-00Axj3-Dy%40256bit.org.
