patch 8.2.4108: going over the end of the w_lines array

Problem:    Going over the end of the w_lines array.
Solution:   Check not going over the end and limit to Rows. (issue #9540)

diff --git a/src/drawscreen.c b/src/drawscreen.c
index e0fb12299540ca5f693c7e561bfa5e9438e0ce41..d03c429cc71aac5eb30d857e160b43b23dcdcb34 100644 (file)
--- a/src/drawscreen.c
+++ b/src/drawscreen.c
@@ -1815,10 +1815,11 @@ win_update(win_T *wp)
            // When topline didn't change, find first entry in w_lines[] that
            // needs updating.
 
-           // try to find wp->w_topline in wp->w_lines[].wl_lnum
+           // Try to find wp->w_topline in wp->w_lines[].wl_lnum.  The check
+           // for "Rows" is in case "wl_size" is incorrect somehow.
            j = -1;
            row = 0;
-           for (i = 0; i < wp->w_lines_valid; i++)
+           for (i = 0; i < wp->w_lines_valid && i < Rows; i++)
            {
                if (wp->w_lines[i].wl_valid
                        && wp->w_lines[i].wl_lnum == wp->w_topline)
@@ -1848,6 +1849,8 @@ win_update(win_T *wp)
                // ... but don't delete new filler lines.
                row -= wp->w_topfill;
 #endif
+               if (row > Rows)  // just in case
+                   row = Rows;
                if (row > 0)
                {
                    check_for_delay(FALSE);

diff --git a/src/version.c b/src/version.c
index ec96b869a0f14b12290c1795e3f15e418a5207ea..c8983be669f5bf558a021e9e8ed6d7803f189754 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4108,
 /**/
     4107,
 /**/