(notice_overwritten_cursor): Check that phys_cursor.vpos

is valid.  If not, clear phys_cursor_on_p and return.

1 files changed, 8 insertions, 3 deletions

diff --git a/src/xdisp.c b/src/xdisp.c
index 71fca1b5eec..16b626959c6 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -20201,9 +20201,14 @@ notice_overwritten_cursor (w, area, x0, x1, y0, y1)
   if (area != TEXT_AREA)
     return;
 
-  row = w->current_matrix->rows + w->phys_cursor.vpos;
-  if (!row->displays_text_p)
-    return;
+  if (w->phys_cursor.vpos < 0
+      || w->phys_cursor.vpos >= w->current_matrix->nrows
+      || (row = w->current_matrix->rows + w->phys_cursor.vpos,
+          !(row->enabled_p && row->displays_text_p)))
+    {
+      w->phys_cursor_on_p = 0;
+      return;
+    }
 
   if (row->cursor_in_fringe_p)
     {