(notice_overwritten_cursor): Check that phys_cursor.vpos

is valid.  If not, clear phys_cursor_on_p and return.

diff --git a/src/xdisp.c b/src/xdisp.c
index 71fca1b5eecba667bf0cfbdd09928eae296c2996..16b626959c6a21cd60d3231f9a6387643d8adc28 100644 (file)
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -20201,9 +20201,14 @@ notice_overwritten_cursor (w, area, x0, x1, y0, y1)
   if (area != TEXT_AREA)
     return;
 
-  row = w->current_matrix->rows + w->phys_cursor.vpos;
-  if (!row->displays_text_p)
-    return;
+  if (w->phys_cursor.vpos < 0
+      || w->phys_cursor.vpos >= w->current_matrix->nrows
+      || (row = w->current_matrix->rows + w->phys_cursor.vpos,
+         !(row->enabled_p && row->displays_text_p)))
+    {
+      w->phys_cursor_on_p = 0;
+      return;
+    }
 
   if (row->cursor_in_fringe_p)
     {