From c249913edc35c0e666d783bfc21595cf9f7d9e0d Mon Sep 17 00:00:00 2001 From: Bram Moolenaar Date: Fri, 16 Sep 2022 22:16:59 +0100 Subject: [PATCH] patch 9.0.0483: illegal memory access when replacing in virtualedit mode Problem: Illegal memory access when replacing in virtualedit mode. Solution: Check for replacing NUL after Tab. --- src/ops.c | 12 ++++++++++-- src/testdir/test_virtualedit.vim | 14 ++++++++++++++ 2 files changed, 24 insertions(+), 2 deletions(-) diff --git a/src/ops.c b/src/ops.c index 9926c00..b4185c7 100644 --- a/src/ops.c +++ b/src/ops.c @@ -1183,6 +1183,8 @@ op_replace(oparg_T *oap, int c) while (LTOREQ_POS(curwin->w_cursor, oap->end)) { + int done = FALSE; + n = gchar_cursor(); if (n != NUL) { @@ -1193,6 +1195,7 @@ op_replace(oparg_T *oap, int c) if (curwin->w_cursor.lnum == oap->end.lnum) oap->end.col += (*mb_char2len)(c) - (*mb_char2len)(n); replace_character(c); + done = TRUE; } else { @@ -1211,10 +1214,15 @@ op_replace(oparg_T *oap, int c) if (curwin->w_cursor.lnum == oap->end.lnum) getvpos(&oap->end, end_vcol); } - PBYTE(curwin->w_cursor, c); + // with "coladd" set may move to just after a TAB + if (gchar_cursor() != NUL) + { + PBYTE(curwin->w_cursor, c); + done = TRUE; + } } } - else if (virtual_op && curwin->w_cursor.lnum == oap->end.lnum) + if (!done && virtual_op && curwin->w_cursor.lnum == oap->end.lnum) { int virtcols = oap->end.coladd; diff --git a/src/testdir/test_virtualedit.vim b/src/testdir/test_virtualedit.vim index 25ca33f..451a996 100644 --- a/src/testdir/test_virtualedit.vim +++ b/src/testdir/test_virtualedit.vim @@ -343,4 +343,18 @@ func Test_yank_paste_small_del_reg() set virtualedit= endfunc +" this was replacing the NUL at the end of the line +func Test_virtualedit_replace_after_tab() + new + s/\v/ 0 + set ve=all + let @" = '' + sil! norm vPvr0 + + call assert_equal("\t0", getline(1)) + set ve& + bwipe! +endfunc + + " vim: shiftwidth=2 sts=2 expandtab -- 2.27.0