File _service:tar_scm:backport-CVE-2023-0288.patch of Package vim

File _service:tar_scm:backport-CVE-2023-0288.patch of Package vim (Revision ebfc221ed2190f733afad301eb8d99a4)

Currently displaying revision ebfc221ed2190f733afad301eb8d99a4 , Show latest

From 232bdaaca98c34a99ffadf27bf6ee08be6cc8f6a Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Fri, 13 Jan 2023 14:17:58 +0000
Subject: [PATCH] patch 9.0.1189: invalid memory access with folding and using
 "L"

Problem:    Invalid memory access with folding and using "L".
Solution:   Prevent the cursor from moving to line zero.
---
 src/normal.c              | 3 ++-
 src/testdir/test_fold.vim | 8 ++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/normal.c b/src/normal.c
index c319be599ad7..3d9f74dec558 100644
--- a/src/normal.c
+++ b/src/normal.c
@@ -3757,7 +3757,8 @@ nv_scroll(cmdarg_T *cap)
 		{
 		    (void)hasFolding(curwin->w_cursor.lnum,
 						&curwin->w_cursor.lnum, NULL);
-		    --curwin->w_cursor.lnum;
+		    if (curwin->w_cursor.lnum > curwin->w_topline)
+			--curwin->w_cursor.lnum;
 		}
 	    }
 	    else
diff --git a/src/testdir/test_fold.vim b/src/testdir/test_fold.vim
index adf9e5207838..f915a661336b 100644
--- a/src/testdir/test_fold.vim
+++ b/src/testdir/test_fold.vim
@@ -1547,4 +1547,12 @@ func Test_sort_closed_fold()
   bw!
 endfunc
 
+func Test_indent_with_L_command()
+  " The "L" command moved the cursor to line zero, causing the text saved for
+  " undo to use line number -1, which caused trouble for undo later.
+  new
+  sil! norm 8RV{zf8=Lu
+  bwipe!
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab