patch 8.2.4106: going over the end of the w_lines array

Problem:    Going over the end of the w_lines array.
Solution:   Break out of the loop when "idx" is too big. (issue #9540)

diff --git a/src/drawscreen.c b/src/drawscreen.c
index 453ca91c33adb8715bcfb52a6e591db2dbb04a3c..e0fb12299540ca5f693c7e561bfa5e9438e0ce41 100644 (file)
--- a/src/drawscreen.c
+++ b/src/drawscreen.c
@@ -2539,6 +2539,11 @@ win_update(win_T *wp)
            eof = TRUE;
            break;
        }
+
+       // Safety check: if any of the wl_size values is wrong we might go over
+       // the end of w_lines[].
+       if (idx >= Rows)
+           break;
     }
 
     // End of loop over all window lines.

diff --git a/src/version.c b/src/version.c
index 8ddd419db1587cc713f7bd8680bd78708f37c44f..2e8e9f3cc1f2e8cef87051cc43292e5989b06c2b 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4106,
 /**/
     4105,
 /**/