patch 8.0.0234: crash when using put in Visual mode

Problem:    When several lines are visually selected and one of them is short,
            using put may cause a crash. (Axel Bender)
Solution:   Check for a short line. (Christian Brabandt)

src/Makefile

@@ -2147,9 +2147,11 @@ test_arglist \
 	test_options \
 	test_packadd \
 	test_partial \
+	test_paste \
 	test_perl \
 	test_popup \
 	test_profile \
+	test_put \
 	test_quickfix \
 	test_regexp_latin \
 	test_regexp_utf8 \
@@ -2160,9 +2162,9 @@ test_arglist \
 	test_searchpos \
 	test_set \
 	test_signs \
+	test_smartindent \
 	test_sort \
 	test_source_utf8 \
-	test_smartindent \
 	test_startup \
 	test_startup_utf8 \
 	test_stat \

src/buffer.c

@@ -2153,6 +2153,7 @@ free_buf_options(
 #if defined(FEAT_CRYPT)
     clear_string_option(&buf->b_p_cm);
 #endif
+    clear_string_option(&buf->b_p_fp);
 #if defined(FEAT_EVAL)
     clear_string_option(&buf->b_p_fex);
 #endif

src/edit.c

@@ -463,7 +463,10 @@ edit(
 	else
 #endif
 	{
-	    AppendCharToRedobuff(cmdchar);
+	    if (cmdchar == K_PS)
+		AppendCharToRedobuff('a');
+	    else
+		AppendCharToRedobuff(cmdchar);
 	    if (cmdchar == 'g')		    /* "gI" command */
 		AppendCharToRedobuff('I');
 	    else if (cmdchar == 'r')	    /* "r<CR>" command */
@@ -531,6 +534,10 @@ edit(
     revins_legal = 0;
     revins_scol = -1;
 #endif
+    if (!p_ek)
+	/* Disable bracketed paste mode, we won't recognize the escape
+	 * sequences. */
+	out_str(T_BD);
 
     /*
      * Handle restarting Insert mode.
@@ -8620,6 +8627,9 @@ ins_esc(
 #ifdef CURSOR_SHAPE
     ui_cursor_shape();		/* may show different cursor shape */
 #endif
+    if (!p_ek)
+	/* Re-enable bracketed paste mode. */
+	out_str(T_BE);
 
     /*
      * When recording or for CTRL-O, need to display the new mode.
@@ -9498,8 +9508,14 @@ bracketed_paste(paste_mode_T mode, int drop, garray_T *gap)
 		case PASTE_INSERT:
 		    if (stop_arrow() == OK)
 		    {
-			ins_char_bytes(buf, idx);
-			AppendToRedobuffLit(buf, idx);
+			c = buf[0];
+			if (idx == 1 && (c == CAR || c == K_KENTER || c == NL))
+			    ins_eol(c);
+			else
+			{
+			    ins_char_bytes(buf, idx);
+			    AppendToRedobuffLit(buf, idx);
+			}
 		    }
 		    break;
 

src/ex_getln.c

@@ -1794,6 +1794,10 @@ getcmdline(
 		goto cmdline_not_changed;
 #endif
 
+	case K_PS:
+		bracketed_paste(PASTE_CMDLINE, FALSE, NULL);
+		goto cmdline_changed;
+
 	default:
 #ifdef UNIX
 		if (c == intr_char)
@@ -2366,8 +2370,7 @@ getexmodeline(
 	if (ga_grow(&line_ga, 40) == FAIL)
 	    break;
 
-	/* Get one character at a time.  Don't use inchar(), it can't handle
-	 * special characters. */
+	/* Get one character at a time. */
 	prev_char = c1;
 	c1 = vgetc();
 
@@ -2382,6 +2385,12 @@ getexmodeline(
 	    break;
 	}
 
+	if (c1 == K_PS)
+	{
+	    bracketed_paste(PASTE_EX, FALSE, &line_ga);
+	    goto redraw;
+	}
+
 	if (!escaped)
 	{
 	    /* CR typed means "enter", which is NL */

src/fileio.c

@@ -274,9 +274,9 @@ readfile(
     int		msg_save = msg_scroll;
     linenr_T	read_no_eol_lnum = 0;   /* non-zero lnum when last line of
 					 * last read was missing the eol */
-    int		try_mac = (vim_strchr(p_ffs, 'm') != NULL);
-    int		try_dos = (vim_strchr(p_ffs, 'd') != NULL);
-    int		try_unix = (vim_strchr(p_ffs, 'x') != NULL);
+    int		try_mac;
+    int		try_dos;
+    int		try_unix;
     int		file_rewind = FALSE;
 #ifdef FEAT_MBYTE
     int		can_retry;
@@ -738,6 +738,10 @@ readfile(
     curbuf->b_op_start.lnum = ((from == 0) ? 1 : from);
     curbuf->b_op_start.col = 0;
 
+    try_mac = (vim_strchr(p_ffs, 'm') != NULL);
+    try_dos = (vim_strchr(p_ffs, 'd') != NULL);
+    try_unix = (vim_strchr(p_ffs, 'x') != NULL);
+
 #ifdef FEAT_AUTOCMD
     if (!read_buffer)
     {
@@ -769,6 +773,11 @@ readfile(
 	else
 	    apply_autocmds_exarg(EVENT_FILEREADPRE, sfname, sfname,
 							    FALSE, NULL, eap);
+	/* autocommands may have changed it */
+	try_mac = (vim_strchr(p_ffs, 'm') != NULL);
+	try_dos = (vim_strchr(p_ffs, 'd') != NULL);
+	try_unix = (vim_strchr(p_ffs, 'x') != NULL);
+
 	if (msg_scrolled == n)
 	    msg_scroll = m;
 
@@ -2242,8 +2251,9 @@ rewind_retry:
 			len = (colnr_T)(ptr - line_start + 1);
 			if (fileformat == EOL_DOS)
 			{
-			    if (ptr[-1] == CAR)	/* remove CR */
+			    if (ptr > line_start && ptr[-1] == CAR)
 			    {
+				/* remove CR before NL */
 				ptr[-1] = NUL;
 				--len;
 			    }

src/ops.c

@@ -3550,7 +3550,7 @@ do_put(
      */
     if (y_type == MBLOCK)
     {
-	char	c = gchar_cursor();
+	int	c = gchar_cursor();
 	colnr_T	endcol2 = 0;
 
 	if (dir == FORWARD && c != NUL)
@@ -3774,11 +3774,25 @@ do_put(
 	 */
 	if (y_type == MCHAR && y_size == 1)
 	{
+	    linenr_T end;
+
+	    if (VIsual_active)
+	    {
+		end = curbuf->b_visual.vi_end.lnum;
+		if (end < curbuf->b_visual.vi_start.lnum)
+		    end = curbuf->b_visual.vi_start.lnum;
+	    }
+
 	    do {
 		totlen = count * yanklen;
 		if (totlen > 0)
 		{
 		    oldp = ml_get(lnum);
+		    if (VIsual_active && col > (int)STRLEN(oldp))
+		    {
+			lnum++;
+			continue;
+		    }
 		    newp = alloc_check((unsigned)(STRLEN(oldp) + totlen + 1));
 		    if (newp == NULL)
 			goto end;	/* alloc() gave an error message */
@@ -3801,7 +3815,7 @@ do_put(
 		}
 		if (VIsual_active)
 		    lnum++;
-	    } while (VIsual_active && lnum <= curbuf->b_visual.vi_end.lnum);
+	    } while (VIsual_active && lnum <= end);
 
 	    if (VIsual_active) /* reset lnum to the last visual line */
 		lnum--;

src/tag.c

@@ -1256,6 +1256,7 @@ prepare_pats(pat_T *pats, int has_re)
  * TAG_REGEXP	  use "pat" as a regexp
  * TAG_NOIC	  don't always ignore case
  * TAG_KEEP_LANG  keep language
+ * TAG_CSCOPE	  use cscope results for tags
  */
     int
 find_tags(
@@ -1423,6 +1424,14 @@ find_tags(
      */
     if (help_only)				/* want tags from help file */
 	curbuf->b_help = TRUE;			/* will be restored later */
+#ifdef FEAT_CSCOPE
+    else if (use_cscope)
+    {
+	/* Make sure we don't mix help and cscope, confuses Coverity. */
+	help_only = FALSE;
+	curbuf->b_help = FALSE;
+    }
+#endif
 
     orgpat.len = (int)STRLEN(pat);
 #ifdef FEAT_MULTI_LANG
@@ -2281,7 +2290,8 @@ parse_line:
 		     */
 		    *tagp.tagname_end = NUL;
 		    len = (int)(tagp.tagname_end - tagp.tagname);
-		    mfp = (char_u *)alloc((int)sizeof(char_u) + len + 10 + ML_EXTRA + 1);
+		    mfp = (char_u *)alloc((int)sizeof(char_u)
+						    + len + 10 + ML_EXTRA + 1);
 		    if (mfp != NULL)
 		    {
 			int heuristic;

src/term.c

@@ -3148,7 +3148,7 @@ starttermcap(void)
     {
 	out_str(T_TI);			/* start termcap mode */
 	out_str(T_KS);			/* start "keypad transmit" mode */
-	out_str(T_BE);			/* enable bracketed paste moe */
+	out_str(T_BE);			/* enable bracketed paste mode */
 	out_flush();
 	termcap_active = TRUE;
 	screen_start();			/* don't know where cursor is now */
@@ -3198,7 +3198,7 @@ stoptermcap(void)
 	    check_for_codes_from_term();
 	}
 #endif
-	out_str(T_BD);			/* disable bracketed paste moe */
+	out_str(T_BD);			/* disable bracketed paste mode */
 	out_str(T_KE);			/* stop "keypad transmit" mode */
 	out_flush();
 	termcap_active = FALSE;

src/testdir/Make_all.mak

@@ -173,6 +173,7 @@ NEW_TESTS = test_arglist.res \
 	    test_nested_function.res \
 	    test_netbeans.res \
 	    test_normal.res \
+	    test_paste.res \
 	    test_packadd.res \
 	    test_perl.res \
 	    test_profile.res \

src/testdir/test_alot.vim

@@ -31,6 +31,7 @@ source test_mapping.vim
 source test_messages.vim
 source test_partial.vim
 source test_popup.vim
+source test_put.vim
 source test_reltime.vim
 source test_searchpos.vim
 source test_set.vim

src/testdir/test_fileformat.vim

@@ -15,3 +15,19 @@ func Test_fileformat_after_bw()
   call assert_equal(test_fileformats, &fileformat)
   set fileformats&
 endfunc
+
+func Test_fileformat_autocommand()
+  let filecnt = ["", "foobar\<CR>", "eins\<CR>", "\<CR>", "zwei\<CR>", "drei", "vier", "fünf", ""]
+  let ffs = &ffs
+  call writefile(filecnt, 'Xfile', 'b')
+  au BufReadPre Xfile set ffs=dos ff=dos
+  new Xfile
+  call assert_equal('dos', &l:ff)
+  call assert_equal('dos', &ffs)
+
+  " cleanup
+  call delete('Xfile')
+  let &ffs = ffs
+  au! BufReadPre Xfile
+  bw!
+endfunc

src/testdir/test_paste.vim

@@ -0,0 +1,44 @@
+" Tests for bracketed paste.
+
+" Bracketed paste only works with "xterm".  Not in GUI.
+if has('gui_running')
+  finish
+endif
+set term=xterm
+
+func Test_paste_normal_mode()
+  new
+  call setline(1, ['a', 'b', 'c'])
+  2
+  call feedkeys("\<Esc>[200~foo\<CR>bar\<Esc>[201~", 'xt')
+  call assert_equal('bfoo', getline(2))
+  call assert_equal('bar', getline(3))
+  call assert_equal('c', getline(4))
+
+  normal .
+  call assert_equal('barfoo', getline(3))
+  call assert_equal('bar', getline(4))
+  call assert_equal('c', getline(5))
+  bwipe!
+endfunc
+
+func Test_paste_insert_mode()
+  new
+  call setline(1, ['a', 'b', 'c'])
+  2
+  call feedkeys("i\<Esc>[200~foo\<CR>bar\<Esc>[201~ done\<Esc>", 'xt')
+  call assert_equal('foo', getline(2))
+  call assert_equal('bar doneb', getline(3))
+  call assert_equal('c', getline(4))
+
+  normal .
+  call assert_equal('bar donfoo', getline(3))
+  call assert_equal('bar doneeb', getline(4))
+  call assert_equal('c', getline(5))
+  bwipe!
+endfunc
+
+func Test_paste_cmdline()
+  call feedkeys(":a\<Esc>[200~foo\<CR>bar\<Esc>[201~b\<Home>\"\<CR>", 'xt')
+  call assert_equal("\"afoo\<CR>barb", getreg(':'))
+endfunc

src/testdir/test_put.vim

@@ -0,0 +1,36 @@
+
+func Test_put_block()
+  if !has('multi_byte')
+    return
+  endif
+  new
+  call feedkeys("i\<C-V>u2500\<CR>x\<ESC>", 'x')
+  call feedkeys("\<C-V>y", 'x')
+  call feedkeys("gg0p", 'x')
+  call assert_equal("\u2500x", getline(1))
+  bwipe!
+endfunc
+
+func Test_put_char_block()
+  new
+  call setline(1, ['Line 1', 'Line 2'])
+  f Xfile_put
+  " visually select both lines and put the cursor at the top of the visual
+  " selection and then put the buffer name over it
+  exe "norm! G0\<c-v>ke\"%p"
+  call assert_equal(['Xfile_put 1', 'Xfile_put 2'], getline(1,2))
+  bw!
+endfunc
+
+func Test_put_char_block2()
+  new
+  let a = [ getreg('a'), getregtype('a') ]
+  call setreg('a', ' one ', 'v')
+  call setline(1, ['Line 1', '', 'Line 3', ''])
+  " visually select the first 3 lines and put register a over it
+  exe "norm! ggl\<c-v>2j2l\"ap"
+  call assert_equal(['L one  1', '', 'L one  3', ''], getline(1,4))
+  " clean up
+  bw!
+  call setreg('a', a[0], a[1])
+endfunc

src/version.c

@@ -764,6 +764,32 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    234,
+/**/
+    233,
+/**/
+    232,
+/**/
+    231,
+/**/
+    230,
+/**/
+    229,
+/**/
+    228,
+/**/
+    227,
+/**/
+    226,
+/**/
+    225,
+/**/
+    224,
+/**/
+    223,
+/**/
+    222,
 /**/
     221,
 /**/