Language: C
Label: safe
CWE: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.

Code:
nv_z_get_count(cmdarg_T *cap, int *nchar_arg)
{
    int		nchar = *nchar_arg;
    long	n;

    // "z123{nchar}": edit the count before obtaining {nchar}
    if (checkclearop(cap->oap))
	return FALSE;
    n = nchar - '0';

    for (;;)
    {
#ifdef USE_ON_FLY_SCROLL
	dont_scroll = TRUE;		// disallow scrolling here
#endif
	++no_mapping;
	++allow_keys;   // no mapping for nchar, but allow key codes
	nchar = plain_vgetc();
	LANGMAP_ADJUST(nchar, TRUE);
	--no_mapping;
	--allow_keys;
	(void)add_to_showcmd(nchar);

	if (nchar == K_DEL || nchar == K_KDEL)
	    n /= 10;
	else if (VIM_ISDIGIT(nchar))
	{
	    if (n > LONG_MAX / 10)
	    {
		clearopbeep(cap->oap);
		break;
	    }
	    n = n * 10 + (nchar - '0');
	}
	else if (nchar == CAR)
	{
#ifdef FEAT_GUI
	    need_mouse_correct = TRUE;
#endif
	    win_setheight((int)n);
	    break;
	}
	else if (nchar == 'l'
		|| nchar == 'h'
		|| nchar == K_LEFT
		|| nchar == K_RIGHT)
	{
	    cap->count1 = n ? n * cap->count1 : cap->count1;
	    *nchar_arg = nchar;
	    return TRUE;
	}
	else
	{
	    clearopbeep(cap->oap);
	    break;
	}
    }
    cap->oap->op_type = OP_NOP;
    return FALSE;
}