Fix split in indent_mode.

detected by afl-fuzz
sh4wnb8n · Aug 17, 2015 · e686cb4 · e686cb4
1 parent 4f26241
commit e686cb4
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/mbbsd/edit.c b/mbbsd/edit.c
@@ -993,8 +993,12 @@ split(textline_t * line, int pos)
 	    curr_buf->oldcurrline = curr_buf->currline = p;
 	    if (pos == curr_buf->currpnt)
 		curr_buf->currpnt = spcs;
-	    else
-		curr_buf->currpnt -= pos;
+	    else {
+		curr_buf->currpnt = curr_buf->currpnt - pos + spcs;
+		// In indent_mode, the length may be shorter.
+		if (curr_buf->currpnt > curr_buf->currline->len)
+		    curr_buf->currpnt = curr_buf->currline->len;
+	    }
 	    curr_buf->curr_window_line++;
 	    curr_buf->currln++;