patch 8.2.2779: memory access error in remove() for blob

Problem:    Memory access error in remove() for blob.
Solution:   Adjust length for memmove().

diff --git a/src/blob.c b/src/blob.c
index 9f59777073226e120d68d3a73f46bdf2d5399a1a..4685dc97c190e615f6a8535296473247a6c731b1 100644 (file)
--- a/src/blob.c
+++ b/src/blob.c
@@ -444,7 +444,7 @@ blob_remove(typval_T *argvars, typval_T *rettv)
        {
            blob_T  *blob;
 
-           // Remove range of items, return list with values.
+           // Remove range of items, return blob with values.
            end = (long)tv_get_number_chk(&argvars[2], &error);
            if (error)
                return;
@@ -472,7 +472,8 @@ blob_remove(typval_T *argvars, typval_T *rettv)
            rettv->v_type = VAR_BLOB;
            rettv->vval.v_blob = blob;
 
-           mch_memmove(p + idx, p + end + 1, (size_t)(len - end));
+           if (len - end - 1 > 0)
+               mch_memmove(p + idx, p + end + 1, (size_t)(len - end - 1));
            b->bv_ga.ga_len -= end - idx + 1;
        }
     }

diff --git a/src/version.c b/src/version.c
index 83d7e572563904a1eda8ad0c582e02646896a4de..12a51c9128d259a6322de817abcedd7bd100f3e3 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2779,
 /**/
     2778,
 /**/