From: simon <simon@cda61777-01e9-0310-a592-d414129be87e>
Date: Mon, 17 Dec 2012 08:40:33 +0000 (+0000)
Subject: Add a bounds check in the word-by-word selection code to prevent
X-Git-Url: https://git.distorted.org.uk/~mdw/sgt/putty/commitdiff_plain/1d2a5e0b5bf87a0a0c8a02a3f06b7c9a1f426d9f

Add a bounds check in the word-by-word selection code to prevent
attempting to call lineptr() with a y-coordinate off the bottom of the
screen and triggering the dreaded 'line==NULL' message box.

This crash can only occur if the bottommost line of the screen has the
LATTR_WRAPPED flag set, which as far as I can see you can only
contrive by constructing a LATTR_WRAPPED line further up the screen
and then moving it down using an insert-line escape sequence. That's
probably why this bug has been around forever without anyone coming
across it.


git-svn-id: svn://svn.tartarus.org/sgt/putty@9726 cda61777-01e9-0310-a592-d414129be87e
---

diff --git a/terminal.c b/terminal.c
index febd897f..a29645a0 100644
--- a/terminal.c
+++ b/terminal.c
@@ -5626,7 +5626,8 @@ static pos sel_spread_half(Terminal *term, pos p, int dir)
 		    else
 			break;
 		} else {
-		    if (ldata->lattr & LATTR_WRAPPED) {
+		    if (p.y+1 < term->rows && 
+                        (ldata->lattr & LATTR_WRAPPED)) {
 			termline *ldata2;
 			ldata2 = lineptr(p.y+1);
 			if (wordtype(term, UCSGET(ldata2->chars, 0))