Mercurial > vim
changeset 26841:48d6f187e9c0 v8.2.3949
patch 8.2.3949: using freed memory with /%V
Commit: https://github.com/vim/vim/commit/4c13e5e6763c6eb36a343a2b8235ea227202e952
Author: Bram Moolenaar <Bram@vim.org>
Date: Thu Dec 30 14:49:43 2021 +0000
patch 8.2.3949: using freed memory with /\%V
Problem: Using freed memory with /\%V.
Solution: Get the line again after getvvcol().
| author | Bram Moolenaar <Bram@vim.org> |
|---|---|
| date | Thu, 30 Dec 2021 16:00:05 +0100 |
| parents | 1f49d1cd3100 |
| children | df509756e36d |
| files | src/regexp.c src/testdir/test_regexp_latin.vim src/version.c |
| diffstat | 3 files changed, 17 insertions(+), 2 deletions(-) [+] |
line wrap: on
line diff
--- a/src/regexp.c +++ b/src/regexp.c @@ -1310,9 +1310,9 @@ reg_match_visual(void) if (lnum < top.lnum || lnum > bot.lnum) return FALSE; + col = (colnr_T)(rex.input - rex.line); if (mode == 'v') { - col = (colnr_T)(rex.input - rex.line); if ((lnum == top.lnum && col < top.col) || (lnum == bot.lnum && col >= bot.col + (*p_sel != 'e'))) return FALSE; @@ -1327,7 +1327,12 @@ reg_match_visual(void) end = end2; if (top.col == MAXCOL || bot.col == MAXCOL || curswant == MAXCOL) end = MAXCOL; - cols = win_linetabsize(wp, rex.line, (colnr_T)(rex.input - rex.line)); + + // getvvcol() flushes rex.line, need to get it again + rex.line = reg_getline(rex.lnum); + rex.input = rex.line + col; + + cols = win_linetabsize(wp, rex.line, col); if (cols < start || cols > end - (*p_sel == 'e')) return FALSE; }
--- a/src/testdir/test_regexp_latin.vim +++ b/src/testdir/test_regexp_latin.vim @@ -1045,4 +1045,12 @@ func Test_using_mark_position() bwipe! endfunc +func Test_using_visual_position() + " this was using freed memory + new + exe "norm 0o\<Esc>\<C-V>k\<C-X>o0" + /\%V + bwipe! +endfunc + " vim: shiftwidth=2 sts=2 expandtab