Add a bounds check in the word-by-word selection code to prevent

attempting to call lineptr() with a y-coordinate off the bottom of the
screen and triggering the dreaded 'line==NULL' message box.

This crash can only occur if the bottommost line of the screen has the
LATTR_WRAPPED flag set, which as far as I can see you can only
contrive by constructing a LATTR_WRAPPED line further up the screen
and then moving it down using an insert-line escape sequence. That's
probably why this bug has been around forever without anyone coming
across it.

git-svn-id: svn://svn.tartarus.org/sgt/putty@9726 cda61777-01e9-0310-a592-d414129be87e

diff --git a/terminal.c b/terminal.c
index febd897..a29645a 100644 (file)
--- a/terminal.c
+++ b/terminal.c
@@ -5626,7 +5626,8 @@ static pos sel_spread_half(Terminal *term, pos p, int dir)
                    else
                        break;
                } else {
-                   if (ldata->lattr & LATTR_WRAPPED) {
+                   if (p.y+1 < term->rows && 
+                        (ldata->lattr & LATTR_WRAPPED)) {
                        termline *ldata2;
                        ldata2 = lineptr(p.y+1);
                        if (wordtype(term, UCSGET(ldata2->chars, 0))