Mercurial > vim

diff src/regexp.c @ 29410:be069ab9d583 v9.0.0047

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
patch 9.0.0047: using freed memory with recursive substitute Commit: https://github.com/vim/vim/commit/32acf1f1a72ebb9d8942b9c9d80023bf1bb668ea Author: Bram Moolenaar <Bram@vim.org> Date: Thu Jul 7 22:20:31 2022 +0100 patch 9.0.0047: using freed memory with recursive substitute Problem: Using freed memory with recursive substitute. Solution: Always make a copy for reg_prev_sub.
author Bram Moolenaar <Bram@vim.org>
date Thu, 07 Jul 2022 23:30:02 +0200
parents 8175cd4c8fdd
children 057c26b5c33a
line wrap: on
line diff
--- a/src/regexp.c
+++ b/src/regexp.c
@@ -1766,11 +1766,11 @@ regtilde(char_u *source, int magic)
 	}
     }
 
+    // Store a copy of newsub  in reg_prev_sub.  It is always allocated,
+    // because recursive calls may make the returned string invalid.
     vim_free(reg_prev_sub);
-    if (newsub != source)	// newsub was allocated, just keep it
-	reg_prev_sub = newsub;
-    else			// no ~ found, need to save newsub
-	reg_prev_sub = vim_strsave(newsub);
+    reg_prev_sub = vim_strsave(newsub);
+
     return newsub;
 }