patch 9.1.0121: Infinite loop or signed overflow with 'smoothscroll'

Problem:  infinite loop in win_update with 'smoothscroll' set when
          window width is equal to textoff, or signed integer overflow
          if smaller.
Solution: don't revalidate wp->w_skipcol in that case, as no buffer text
          is being shown. (Sean Dewar)

Don't instead reset w_skipcol; that would lose the scroll position
within the line, which may be undesirable if the window is made wider
later.

Also include changes from the splitmove PR #14042 that I (in my infinite
Git wisdom) forgot to commit. This includes a change to
Test_window_split_no_room to ensure it doesn't fail for some screen
sizes.

Move Test_smoothscroll_in_zero_width_window to test_scroll_opt.vim, as
that file feels more appropriate.

closes: #14068

Signed-off-by: Sean Dewar <6256228+seandewar@users.noreply.github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/src/drawscreen.c b/src/drawscreen.c
index 852d3318266abdfc60a56362d7f1f30fe1b5d8f6..5fb37a9849708a1f56b527d5e14312a1ca6fb7bc 100644 (file)
--- a/src/drawscreen.c
+++ b/src/drawscreen.c
@@ -1537,7 +1537,7 @@ win_update(win_T *wp)
 
     // Make sure skipcol is valid, it depends on various options and the window
     // width.
-    if (wp->w_skipcol > 0)
+    if (wp->w_skipcol > 0 && wp->w_width > win_col_off(wp))
     {
        int w = 0;
        int width1 = wp->w_width - win_col_off(wp);

diff --git a/src/proto/window.pro b/src/proto/window.pro
index 0ec57349b21eb4d15ed4f6d4889a7f7540634367..a91a51190bbd7f87d0cf6d428ce91bfdfb9456f8 100644 (file)
--- a/src/proto/window.pro
+++ b/src/proto/window.pro
@@ -28,7 +28,7 @@ void may_make_initial_scroll_size_snapshot(void);
 void may_trigger_win_scrolled_resized(void);
 void win_close_othertab(win_T *win, int free_buf, tabpage_T *tp);
 void win_free_all(void);
-win_T *winframe_remove(win_T *win, int *dirp, tabpage_T *tp, frame_T **to_flatten);
+win_T *winframe_remove(win_T *win, int *dirp, tabpage_T *tp, frame_T **unflat_altfr);
 void close_others(int message, int forceit);
 void unuse_tabpage(tabpage_T *tp);
 void use_tabpage(tabpage_T *tp);

diff --git a/src/testdir/test_scroll_opt.vim b/src/testdir/test_scroll_opt.vim
index f41f0e2910aef5f36181a4a4aa2b28555e5b6a86..3467760740e1e05688a9eff17d802b6ae1237ef0 100644 (file)
--- a/src/testdir/test_scroll_opt.vim
+++ b/src/testdir/test_scroll_opt.vim
@@ -960,4 +960,42 @@ func Test_smoothscroll_insert_bottom()
   call StopVimInTerminal(buf)
 endfunc
 
+func Test_smoothscroll_in_zero_width_window()
+  set cpo+=n number smoothscroll
+  set winwidth=99999 winminwidth=0
+
+  vsplit
+  call assert_equal(0, winwidth(winnr('#')))
+  call win_execute(win_getid(winnr('#')), "norm! \<C-Y>")
+
+  only!
+  set winwidth& winminwidth&
+  set cpo-=n nonumber nosmoothscroll
+endfunc
+
+func Test_smoothscroll_textoff_small_winwidth()
+  set smoothscroll number
+  call setline(1, 'llanfairpwllgwyngyllgogerychwyrndrobwllllantysiliogogogoch')
+  vsplit
+
+  let textoff = getwininfo(win_getid())[0].textoff
+  execute 'vertical resize' textoff + 1
+  redraw
+  call assert_equal(0, winsaveview().skipcol)
+  execute "normal! 0\<C-E>"
+  redraw
+  call assert_equal(1, winsaveview().skipcol)
+  execute 'vertical resize' textoff - 1
+  " This caused a signed integer overflow.
+  redraw
+  call assert_equal(1, winsaveview().skipcol)
+  execute 'vertical resize' textoff
+  " This caused an infinite loop.
+  redraw
+  call assert_equal(1, winsaveview().skipcol)
+
+  %bw!
+  set smoothscroll& number&
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

diff --git a/src/testdir/test_window_cmd.vim b/src/testdir/test_window_cmd.vim
index ff4ab845ef1773f2505a272cbde635b8fa337e4b..a68ed74cb6ce35a70b011f0720d470d9c6d15de4 100644 (file)
--- a/src/testdir/test_window_cmd.vim
+++ b/src/testdir/test_window_cmd.vim
@@ -322,14 +322,18 @@ func Test_window_split_no_room()
   call assert_equal(restcmd, winrestcmd())
 
   " Check that the last statusline isn't lost.
-  set laststatus=0
-  let restcmd = winrestcmd()
+  " Set its window's width to 2 for the test.
   wincmd j
+  set laststatus=0 winminwidth=0
+  vertical resize 2
+  set winminwidth&
   call setwinvar(winnr('k'), '&statusline', '@#')
   let last_stl_row = win_screenpos(0)[0] - 1
   redraw
   call assert_equal('@#|', GetScreenStr(last_stl_row))
   call assert_equal('~ |', GetScreenStr(&lines - &cmdheight))
+
+  let restcmd = winrestcmd()
   call assert_fails('wincmd H', 'E36:')
   call assert_fails('wincmd L', 'E36:')
   call assert_equal(layout, winlayout())
@@ -2153,19 +2157,6 @@ func Test_new_help_window_on_error()
   call assert_equal(expand("<cword>"), "'mod'")
 endfunc
 
-func Test_smoothscroll_in_zero_width_window()
-  set cpo+=n number smoothscroll
-  set winwidth=99999 winminwidth=0
-
-  vsplit
-  call assert_equal(0, winwidth(winnr('#')))
-  call win_execute(win_getid(winnr('#')), "norm! \<C-Y>")
-
-  only!
-  set winwidth& winminwidth&
-  set cpo-=n nonumber nosmoothscroll
-endfunc
-
 func Test_splitmove_flatten_frame()
   split
   vsplit
@@ -2179,7 +2170,7 @@ func Test_splitmove_flatten_frame()
   only!
 endfunc
 
-func Test_splitmove_autocmd_window_no_room()
+func Test_autocmd_window_force_room()
   " Open as many windows as possible
   while v:true
     try
@@ -2206,7 +2197,7 @@ func Test_splitmove_autocmd_window_no_room()
   edit unload me
   enew
   bunload! unload\ me
-  augroup SplitMoveAucmdWin
+  augroup AucmdWinForceRoom
     au!
     au BufEnter * ++once let s:triggered = v:true
                       \| call assert_equal('autocmd', win_gettype())
@@ -2220,8 +2211,8 @@ func Test_splitmove_autocmd_window_no_room()
   call assert_equal(winrestcmd(), restcmd)
 
   unlet! s:triggered
-  au! SplitMoveAucmdWin
-  augroup! SplitMoveAucmdWin
+  au! AucmdWinForceRoom
+  augroup! AucmdWinForceRoom
   %bw!
 endfunc
 

diff --git a/src/version.c b/src/version.c
index d4951655165bdea5c4d7271c063e85ddec79fead..471ecd83cd09d00e90949f58bd34147edea91b04 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    121,
 /**/
     120,
 /**/

diff --git a/src/window.c b/src/window.c
index a6223eeffdd64b9e3c4f8deed89740021efd7154..66a1d7de41dd01c96a94c2ab6180a2e7152c7f21 100644 (file)
--- a/src/window.c
+++ b/src/window.c
@@ -54,7 +54,7 @@ static void win_goto_hor(int left, long count);
 static void frame_add_height(frame_T *frp, int n);
 static void last_status_rec(frame_T *fr, int statusline);
 static void frame_flatten(frame_T *frp);
-static void winframe_restore(win_T *wp, int dir, frame_T *to_flatten);
+static void winframe_restore(win_T *wp, int dir, frame_T *unflat_altfr);
 
 static int make_snapshot_rec(frame_T *fr, frame_T **frp);
 static void clear_snapshot(tabpage_T *tp, int idx);