patch 9.0.1527: crash when using negative value for term_cols

Problem:    Crash when using negative value for term_cols.
Solution:   Check for invalid term_cols value. (Kenta Sato, closes #12362)

diff --git a/src/job.c b/src/job.c
index 4e64ca3c789c92f19b480be461a9d711088f4adc..2a2e531017287d2370a84f9ca543ab43131b74cc 100644 (file)
--- a/src/job.c
+++ b/src/job.c
@@ -272,7 +272,8 @@ get_job_options(typval_T *tv, jobopt_T *opt, int supported, int supported2)
                *lp = tv_get_number(item);
                if (*lp < 0)
                {
-                   semsg(_(e_invalid_value_for_argument_str_str), hi->hi_key, tv_get_string(item));
+                   semsg(_(e_invalid_value_for_argument_str_str),
+                                             hi->hi_key, tv_get_string(item));
                    return FAIL;
                }
            }
@@ -444,10 +445,19 @@ get_job_options(typval_T *tv, jobopt_T *opt, int supported, int supported2)
            }
            else if (STRCMP(hi->hi_key, "term_cols") == 0)
            {
+               int error = FALSE;
+
                if (!(supported2 & JO2_TERM_COLS))
                    break;
                opt->jo_set2 |= JO2_TERM_COLS;
-               opt->jo_term_cols = tv_get_number(item);
+               opt->jo_term_cols = tv_get_number_chk(item, &error);
+               if (error)
+                   return FAIL;
+               if (opt->jo_term_cols < 0 || opt->jo_term_cols > 1000)
+               {
+                   semsg(_(e_invalid_value_for_argument_str), "term_cols");
+                   return FAIL;
+               }
            }
            else if (STRCMP(hi->hi_key, "vertical") == 0)
            {

diff --git a/src/testdir/test_terminal.vim b/src/testdir/test_terminal.vim
index 596ae5d32f76b1e24dc5b9d165e02bedba7b1118..da263f455876e2b14e43958bd01a21b2677a8fa0 100644 (file)
--- a/src/testdir/test_terminal.vim
+++ b/src/testdir/test_terminal.vim
@@ -617,6 +617,10 @@ func Test_terminal_size()
   call assert_fails("call term_start(cmd, {'term_rows': 1001})", 'E475:')
   call assert_fails("call term_start(cmd, {'term_rows': 10.0})", 'E805:')
 
+  call assert_fails("call term_start(cmd, {'term_cols': -1})", 'E475:')
+  call assert_fails("call term_start(cmd, {'term_cols': 1001})", 'E475:')
+  call assert_fails("call term_start(cmd, {'term_cols': 10.0})", 'E805:')
+
   call delete('Xtext')
 endfunc
 

diff --git a/src/version.c b/src/version.c
index ce64da4a5b8f5d70c68f72d4f1a94b76532fade5..e6d27132d449d6fe5e024686eba97ff233d3ad98 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -695,6 +695,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1527,
 /**/
     1526,
 /**/