To: vim-dev@vim.org
Subject: patch 7.1.032
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
------------

Patch 7.1.032
Problem:    Potential crash when editing a command line. (Chris Monson)
Solution:   Check the position to avoid access before the start of an array.
Files:	    src/ex_getln.c


*** ../vim-7.1.031/src/ex_getln.c	Thu May 10 20:22:29 2007
--- src/ex_getln.c	Tue Jul 17 18:05:49 2007
***************
*** 484,490 ****
  	if (xpc.xp_context == EXPAND_MENUNAMES && p_wmnu)
  	{
  	    /* Hitting <Down> after "emenu Name.": complete submenu */
! 	    if (ccline.cmdbuff[ccline.cmdpos - 1] == '.' && c == K_DOWN)
  		c = p_wc;
  	    else if (c == K_UP)
  	    {
--- 486,493 ----
  	if (xpc.xp_context == EXPAND_MENUNAMES && p_wmnu)
  	{
  	    /* Hitting <Down> after "emenu Name.": complete submenu */
! 	    if (c == K_DOWN && ccline.cmdpos > 0
! 				  && ccline.cmdbuff[ccline.cmdpos - 1] == '.')
  		c = p_wc;
  	    else if (c == K_UP)
  	    {
***************
*** 533,541 ****
  	    upseg[3] = PATHSEP;
  	    upseg[4] = NUL;
  
! 	    if (ccline.cmdbuff[ccline.cmdpos - 1] == PATHSEP
! 		    && c == K_DOWN
! 		    && (ccline.cmdbuff[ccline.cmdpos - 2] != '.'
  			|| ccline.cmdbuff[ccline.cmdpos - 3] != '.'))
  	    {
  		/* go down a directory */
--- 536,546 ----
  	    upseg[3] = PATHSEP;
  	    upseg[4] = NUL;
  
! 	    if (c == K_DOWN
! 		    && ccline.cmdpos > 0
! 		    && ccline.cmdbuff[ccline.cmdpos - 1] == PATHSEP
! 		    && (ccline.cmdpos < 3
! 			|| ccline.cmdbuff[ccline.cmdpos - 2] != '.'
  			|| ccline.cmdbuff[ccline.cmdpos - 3] != '.'))
  	    {
  		/* go down a directory */
***************
*** 730,737 ****
  	    /* In Ex mode a backslash escapes a newline. */
  	    if (exmode_active
  		    && c != ESC
- 		    && ccline.cmdpos > 0
  		    && ccline.cmdpos == ccline.cmdlen
  		    && ccline.cmdbuff[ccline.cmdpos - 1] == '\\')
  	    {
  		if (c == K_KENTER)
--- 735,742 ----
  	    /* In Ex mode a backslash escapes a newline. */
  	    if (exmode_active
  		    && c != ESC
  		    && ccline.cmdpos == ccline.cmdlen
+ 		    && ccline.cmdpos > 0
  		    && ccline.cmdbuff[ccline.cmdpos - 1] == '\\')
  	    {
  		if (c == K_KENTER)
*** ../vim-7.1.031/src/version.c	Tue Jul 17 16:31:15 2007
--- src/version.c	Tue Jul 17 18:10:37 2007
***************
*** 668,669 ****
--- 668,671 ----
  {   /* Add new patch number below this line */
+ /**/
+     32,
  /**/

-- 
ALL:   A witch!  A witch!
WITCH: It's a fair cop.
ALL:   Burn her!  Burn her!  Let's make her into a ladder.
                 "Monty Python and the Holy Grail" PYTHON (MONTY) PICTURES LTD

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\        download, build and distribute -- http://www.A-A-P.org        ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///