From 93318a9933893103442f552b26bd0a41b98cb68b Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Mon, 16 Jun 2025 20:10:38 +0200 Subject: [PATCH] patch 9.1.1463: Integer overflow in getmarklist() after linewise operation Problem: Integer overflow in getmarklist() after linewise operation. Solution: Don't add 1 to MAXCOL (zeertzjq) related: neovim/neovim#34524 closes: #17552 Signed-off-by: zeertzjq Signed-off-by: Christian Brabandt --- src/mark.c | 2 +- src/testdir/test_marks.vim | 5 +++++ src/version.c | 2 ++ 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/src/mark.c b/src/mark.c index 9f6a9ccf58..2b0391981d 100644 --- a/src/mark.c +++ b/src/mark.c @@ -1464,7 +1464,7 @@ add_mark(list_T *l, char_u *mname, pos_T *pos, int bufnr, char_u *fname) list_append_number(lpos, bufnr); list_append_number(lpos, pos->lnum); - list_append_number(lpos, pos->col + 1); + list_append_number(lpos, pos->col < MAXCOL ? pos->col + 1 : MAXCOL); list_append_number(lpos, pos->coladd); if (dict_add_string(d, "mark", mname) == FAIL diff --git a/src/testdir/test_marks.vim b/src/testdir/test_marks.vim index 20fb3041f2..50f005ad18 100644 --- a/src/testdir/test_marks.vim +++ b/src/testdir/test_marks.vim @@ -302,6 +302,11 @@ func Test_getmarklist() call assert_equal({'mark' : "'r", 'pos' : [bufnr(), 2, 2, 0]}, \ bufnr()->getmarklist()[0]) call assert_equal([], {}->getmarklist()) + normal! yy + call assert_equal([ + \ {'mark': "'[", 'pos': [bufnr(), 2, 1, 0]}, + \ {'mark': "']", 'pos': [bufnr(), 2, v:maxcol, 0]}, + \ ], getmarklist(bufnr())[-2:]) close! endfunc diff --git a/src/version.c b/src/version.c index c9d63e9705..8d4cbf2553 100644 --- a/src/version.c +++ b/src/version.c @@ -709,6 +709,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 1463, /**/ 1462, /**/