1. editor_realloc_lines failure is indistinguishable from success. .failed returns eax = 0, but 0 is also a valid delta whenever mem.ReAlloc returns the same address. None of the nine call sites checks it, and line_add_spaces (tp-common.asm:367) does add esi,eax and then writes through esi into a buffer that was not grown - silent heap corruption where before there was an immediate crash. Signal failure with CF and make callers bail.
2. 16 -> 18 is right, but not for the stated reason. EDITOR_LINE_DATA is 6 bytes, not 8 (dd + dw; struct.inc:123 adds no padding), so a line costs 16 plus text and the old constant was correct. The actual gap was the terminator slot, which the new add ebx,sizeof.EDITOR_LINE_DATA supplies. 18 just over-reserves 2 bytes per line.
3. key.ctrl_y (tp-key.asm:744) is the one remaining Lines.Count decrement without a terminator restore.
It survives - it never reads the terminator's Size and its rep movsd carries it along - but if set_lines_terminator is the invariant, apply it there too.
Nit: set_lines_terminator leaves the terminator's Flags as garbage.
**1. `editor_realloc_lines` failure is indistinguishable from success.**
`.failed` returns `eax = 0`, but 0 is also a valid delta whenever `mem.ReAlloc` returns the same address. None of the nine call sites checks it, and `line_add_spaces` (tp-common.asm:367) does `add esi,eax` and then writes through `esi` into a buffer that was not grown - silent heap corruption where before there was an immediate crash. Signal failure with CF and make callers bail.
**2. 16 -> 18 is right, but not for the stated reason.**
`EDITOR_LINE_DATA` is 6 bytes, not 8 (`dd` + `dw`; struct.inc:123 adds no padding), so a line costs 16 plus text and the old constant was correct. The actual gap was the terminator slot, which the new `add ebx,sizeof.EDITOR_LINE_DATA` supplies. 18 just over-reserves 2 bytes per line.
**3. `key.ctrl_y` (tp-key.asm:744) is the one remaining `Lines.Count` decrement without a terminator restore.**
It survives - it never reads the terminator's `Size` and its `rep movsd` carries it along - but if `set_lines_terminator` is the invariant, apply it there too.
Nit: `set_lines_terminator` leaves the terminator's `Flags` as garbage.
The lines buffer is terminated by a line header with zero Size, but
Lines.Size was computed as 16 bytes per line plus the file length, while
a line actually takes 8 bytes of header, the text and 10 trailing
spaces. It matched only because line separators are not stored, so the
terminator ended up outside of Lines.Size.
delete_selection moves the tail of the buffer up to Lines+Lines.Size, so
the terminator was not carried over and its new place kept garbage from
the deleted text. That garbage was then read as the next line Size,
editor_realloc_lines asked for a huge block, mcall 68.20 returned 0 and
cur_editor.Lines became null: reading at address 0 gave EAX=554E454D and
a page fault in get_real_length.
Reserve the worst case in load_from_memory, restore the terminator after
the line count decreases, and keep the old buffer when the realloc fails.
Assisted-by: Claude Opus 5 <noreply@anthropic.com>
editor_realloc_lines now reports failure with CF, and the callers that
grow the buffer bail out instead of writing into a buffer that was not
grown. line_add_spaces passes the failure on.
EDITOR_LINE_DATA is 6 bytes, so 16 bytes per line was already enough;
only the terminator slot was missing. Restore the terminator in
key.ctrl_y as well and clear its Flags.
Assisted-by: Claude Opus 5 <noreply@anthropic.com>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Burer
IgorA
fixes both issues in #173
Tinypad select all delete crashto apps/tinypad: fix select all delete crash (fix #173)1.
editor_realloc_linesfailure is indistinguishable from success..failedreturnseax = 0, but 0 is also a valid delta whenevermem.ReAllocreturns the same address. None of the nine call sites checks it, andline_add_spaces(tp-common.asm:367) doesadd esi,eaxand then writes throughesiinto a buffer that was not grown - silent heap corruption where before there was an immediate crash. Signal failure with CF and make callers bail.2. 16 -> 18 is right, but not for the stated reason.
EDITOR_LINE_DATAis 6 bytes, not 8 (dd+dw; struct.inc:123 adds no padding), so a line costs 16 plus text and the old constant was correct. The actual gap was the terminator slot, which the newadd ebx,sizeof.EDITOR_LINE_DATAsupplies. 18 just over-reserves 2 bytes per line.3.
key.ctrl_y(tp-key.asm:744) is the one remainingLines.Countdecrement without a terminator restore.It survives - it never reads the terminator's
Sizeand itsrep movsdcarries it along - but ifset_lines_terminatoris the invariant, apply it there too.Nit:
set_lines_terminatorleaves the terminator'sFlagsas garbage.f6c21afd9etofc31e8ee54