Mercurial > vim
comparison src/normal.c @ 25786:ec62e0764ffa v8.2.3428
patch 8.2.3428: using freed memory when replacing
Commit: https://github.com/vim/vim/commit/35a9a00afcb20897d462a766793ff45534810dc3
Author: Bram Moolenaar <Bram@vim.org>
Date: Sat Sep 11 21:14:20 2021 +0200
patch 8.2.3428: using freed memory when replacing
Problem: Using freed memory when replacing. (Dhiraj Mishra)
Solution: Get the line pointer after calling ins_copychar().
| author | Bram Moolenaar <Bram@vim.org> |
|---|---|
| date | Sat, 11 Sep 2021 21:15:03 +0200 |
| parents | 4101d78f78e2 |
| children | 16a7d1154be8 |
comparison
equal
deleted
inserted
replaced
| 25785:468662f24b0a | 25786:ec62e0764ffa |
|---|---|
| 5097 */ | 5097 */ |
| 5098 for (n = cap->count1; n > 0; --n) | 5098 for (n = cap->count1; n > 0; --n) |
| 5099 { | 5099 { |
| 5100 /* | 5100 /* |
| 5101 * Get ptr again, because u_save and/or showmatch() will have | 5101 * Get ptr again, because u_save and/or showmatch() will have |
| 5102 * released the line. At the same time we let know that the | 5102 * released the line. This may also happen in ins_copychar(). |
| 5103 * line will be changed. | 5103 * At the same time we let know that the line will be changed. |
| 5104 */ | 5104 */ |
| 5105 ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE); | |
| 5106 if (cap->nchar == Ctrl_E || cap->nchar == Ctrl_Y) | 5105 if (cap->nchar == Ctrl_E || cap->nchar == Ctrl_Y) |
| 5107 { | 5106 { |
| 5108 int c = ins_copychar(curwin->w_cursor.lnum | 5107 int c = ins_copychar(curwin->w_cursor.lnum |
| 5109 + (cap->nchar == Ctrl_Y ? -1 : 1)); | 5108 + (cap->nchar == Ctrl_Y ? -1 : 1)); |
| 5109 | |
| 5110 ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE); | |
| 5110 if (c != NUL) | 5111 if (c != NUL) |
| 5111 ptr[curwin->w_cursor.col] = c; | 5112 ptr[curwin->w_cursor.col] = c; |
| 5112 } | 5113 } |
| 5113 else | 5114 else |
| 5115 { | |
| 5116 ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE); | |
| 5114 ptr[curwin->w_cursor.col] = cap->nchar; | 5117 ptr[curwin->w_cursor.col] = cap->nchar; |
| 5118 } | |
| 5115 if (p_sm && msg_silent == 0) | 5119 if (p_sm && msg_silent == 0) |
| 5116 showmatch(cap->nchar); | 5120 showmatch(cap->nchar); |
| 5117 ++curwin->w_cursor.col; | 5121 ++curwin->w_cursor.col; |
| 5118 } | 5122 } |
| 5119 #ifdef FEAT_NETBEANS_INTG | 5123 #ifdef FEAT_NETBEANS_INTG |