changeset 15854:4ac1c185b0b8 v8.1.0934

patch 8.1.0934: invalid memory access in search pattern commit https://github.com/vim/vim/commit/985079c514e9ab85598b7bca019c77d3e42526f5 Author: Bram Moolenaar <Bram@vim.org> Date: Sat Feb 16 17:07:47 2019 +0100 patch 8.1.0934: invalid memory access in search pattern Problem: Invalid memory access in search pattern. (Kuang-che Wu) Solution: Check for incomplete equivalence class. (closes https://github.com/vim/vim/issues/3970)
author Bram Moolenaar <Bram@vim.org>
date Sat, 16 Feb 2019 17:15:06 +0100
parents 099a69c5c228
children defb99439bca
files src/regexp.c src/testdir/test_regexp_latin.vim src/version.c
diffstat 3 files changed, 10 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/src/regexp.c
+++ b/src/regexp.c
@@ -730,7 +730,7 @@ get_equi_class(char_u **pp)
     int		l = 1;
     char_u	*p = *pp;
 
-    if (p[1] == '=')
+    if (p[1] == '=' && p[2] != NUL)
     {
 	if (has_mbyte)
 	    l = (*mb_ptr2len)(p + 2);
--- a/src/testdir/test_regexp_latin.vim
+++ b/src/testdir/test_regexp_latin.vim
@@ -97,3 +97,10 @@ func Test_out_of_memory()
   " This will be slow...
   call assert_fails('call search("\\v((n||<)+);")', 'E363:')
 endfunc
+
+func Test_get_equi_class()
+  new
+  " Incomplete equivalence class caused invalid memory access
+  s/^/[[=
+  call assert_equal(1, search(getline(1)))
+endfunc
--- a/src/version.c
+++ b/src/version.c
@@ -780,6 +780,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    934,
+/**/
     933,
 /**/
     932,