# HG changeset patch # User Bram Moolenaar # Date 1550333706 -3600 # Node ID 4ac1c185b0b81ca5c2dafd00a63e1e8504186e36 # Parent 099a69c5c228961e5b13546cdf3929a4399d0354 patch 8.1.0934: invalid memory access in search pattern commit https://github.com/vim/vim/commit/985079c514e9ab85598b7bca019c77d3e42526f5 Author: Bram Moolenaar Date: Sat Feb 16 17:07:47 2019 +0100 patch 8.1.0934: invalid memory access in search pattern Problem: Invalid memory access in search pattern. (Kuang-che Wu) Solution: Check for incomplete equivalence class. (closes https://github.com/vim/vim/issues/3970) diff --git a/src/regexp.c b/src/regexp.c --- a/src/regexp.c +++ b/src/regexp.c @@ -730,7 +730,7 @@ get_equi_class(char_u **pp) int l = 1; char_u *p = *pp; - if (p[1] == '=') + if (p[1] == '=' && p[2] != NUL) { if (has_mbyte) l = (*mb_ptr2len)(p + 2); diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim --- a/src/testdir/test_regexp_latin.vim +++ b/src/testdir/test_regexp_latin.vim @@ -97,3 +97,10 @@ func Test_out_of_memory() " This will be slow... call assert_fails('call search("\\v((n||<)+);")', 'E363:') endfunc + +func Test_get_equi_class() + new + " Incomplete equivalence class caused invalid memory access + s/^/[[= + call assert_equal(1, search(getline(1))) +endfunc diff --git a/src/version.c b/src/version.c --- a/src/version.c +++ b/src/version.c @@ -780,6 +780,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 934, +/**/ 933, /**/ 932,