Mercurial > vim
diff src/regexp.c @ 18572:23fef64352a1 v8.1.2280
patch 8.1.2280: crash when passing partial to substitute()
Commit: https://github.com/vim/vim/commit/b0745b221d284e381f1bd4b591cd68ea54b6a51d
Author: Bram Moolenaar <Bram@vim.org>
Date: Sat Nov 9 22:28:11 2019 +0100
patch 8.1.2280: crash when passing partial to substitute()
Problem: Crash when passing partial to substitute().
Solution: Take extra arguments into account. (closes https://github.com/vim/vim/issues/5186)
author | Bram Moolenaar <Bram@vim.org> |
---|---|
date | Sat, 09 Nov 2019 22:30:04 +0100 |
parents | 68fd5296bf73 |
children | e9675870c480 |
line wrap: on
line diff
--- a/src/regexp.c +++ b/src/regexp.c @@ -1784,25 +1784,26 @@ static regsubmatch_T rsm; /* can only b #ifdef FEAT_EVAL /* - * Put the submatches in "argv[0]" which is a list passed into call_func() by - * vim_regsub_both(). + * Put the submatches in "argv[argskip]" which is a list passed into + * call_func() by vim_regsub_both(). */ static int -fill_submatch_list(int argc UNUSED, typval_T *argv, int argcount) +fill_submatch_list(int argc UNUSED, typval_T *argv, int argskip, int argcount) { listitem_T *li; int i; char_u *s; + typval_T *listarg = argv + argskip; - if (argcount == 0) - /* called function doesn't take an argument */ - return 0; + if (argcount == argskip) + // called function doesn't take a submatches argument + return argskip; - /* Relies on sl_list to be the first item in staticList10_T. */ - init_static_list((staticList10_T *)(argv->vval.v_list)); + // Relies on sl_list to be the first item in staticList10_T. + init_static_list((staticList10_T *)(listarg->vval.v_list)); - /* There are always 10 list items in staticList10_T. */ - li = argv->vval.v_list->lv_first; + // There are always 10 list items in staticList10_T. + li = listarg->vval.v_list->lv_first; for (i = 0; i < 10; ++i) { s = rsm.sm_match->startp[i]; @@ -1814,7 +1815,7 @@ fill_submatch_list(int argc UNUSED, typv li->li_tv.vval.v_string = s; li = li->li_next; } - return 1; + return argskip + 1; } static void