patch 7.4.936

Problem:    Crash when dragging with the mouse.
Solution:   Add safety check for NULL pointer. Check mouse position for valid
            value. (Hirohito Higashi)

3 files changed, 11 insertions, 0 deletions

diff --git a/src/term.c b/src/term.c
index 51698fb99..226bdee51 100644
--- a/src/term.c
+++ b/src/term.c
@@ -5231,6 +5231,13 @@ check_termcode(max_offset, buf, bufsize, buflen)
 	    else
 		key_name[1] = get_pseudo_mouse_code(current_button,
 							   is_click, is_drag);
+
+	    /* Make sure the mouse position is valid.  Some terminals may
+	     * return weird values. */
+	    if (mouse_col >= Columns)
+		mouse_col = Columns - 1;
+	    if (mouse_row >= Rows)
+		mouse_row = Rows - 1;
 	}
 #endif /* FEAT_MOUSE */
 
diff --git a/src/version.c b/src/version.c
index dafc3913d..9f0cfbf6a 100644
--- a/src/version.c
+++ b/src/version.c
@@ -742,6 +742,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    936,
+/**/
     935,
 /**/
     934,
diff --git a/src/window.c b/src/window.c
index e8134e06a..010d7ae50 100644
--- a/src/window.c
+++ b/src/window.c
@@ -5785,6 +5785,8 @@ win_drag_vsep_line(dragwin, offset)
 	offset = room;		/* Move as far as we can */
     if (offset <= 0)		/* No room at all, quit. */
 	return;
+    if (fr == NULL)
+	return;			/* Safety check, should not happen. */
 
     /* grow frame fr by offset lines */
     frame_new_width(fr, fr->fr_width + offset, left, FALSE);