Mercurial > vim
diff src/regexp_nfa.c @ 26161:9835f424bef5 v8.2.3612
patch 8.2.3612: using freed memory with regexp using a mark
Commit: https://github.com/vim/vim/commit/64066b9acd9f8cffdf4840f797748f938a13f2d6
Author: Bram Moolenaar <Bram@vim.org>
Date: Wed Nov 17 18:22:56 2021 +0000
patch 8.2.3612: using freed memory with regexp using a mark
Problem: Using freed memory with regexp using a mark.
Solution: Get the line again after getting the mark position.
| author | Bram Moolenaar <Bram@vim.org> |
|---|---|
| date | Wed, 17 Nov 2021 19:30:04 +0100 |
| parents | 1c999a6e9d92 |
| children | ef0c07cbf53f |
line wrap: on
line diff
--- a/src/regexp_nfa.c +++ b/src/regexp_nfa.c @@ -6834,8 +6834,16 @@ nfa_regmatch( case NFA_MARK_GT: case NFA_MARK_LT: { + size_t col = rex.input - rex.line; pos_T *pos = getmark_buf(rex.reg_buf, t->state->val, FALSE); + // Line may have been freed, get it again. + if (REG_MULTI) + { + rex.line = reg_getline(rex.lnum); + rex.input = rex.line + col; + } + // Compare the mark position to the match position, if the mark // exists and mark is set in reg_buf. if (pos != NULL && pos->lnum > 0)