Mercurial > vim
changeset 26161:9835f424bef5 v8.2.3612
patch 8.2.3612: using freed memory with regexp using a mark
Commit: https://github.com/vim/vim/commit/64066b9acd9f8cffdf4840f797748f938a13f2d6
Author: Bram Moolenaar <Bram@vim.org>
Date: Wed Nov 17 18:22:56 2021 +0000
patch 8.2.3612: using freed memory with regexp using a mark
Problem: Using freed memory with regexp using a mark.
Solution: Get the line again after getting the mark position.
author | Bram Moolenaar <Bram@vim.org> |
---|---|
date | Wed, 17 Nov 2021 19:30:04 +0100 |
parents | b242c826c5cf |
children | dec9a06eec86 |
files | src/regexp.c src/regexp_nfa.c src/testdir/test_regexp_latin.vim src/version.c |
diffstat | 4 files changed, 19 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/src/regexp.c +++ b/src/regexp.c @@ -1129,7 +1129,7 @@ typedef struct { // The current match-position is stord in these variables: linenr_T lnum; // line number, relative to first line char_u *line; // start of current line - char_u *input; // current input, points into "regline" + char_u *input; // current input, points into "line" int need_clear_subexpr; // subexpressions still need to be cleared #ifdef FEAT_SYN_HL
--- a/src/regexp_nfa.c +++ b/src/regexp_nfa.c @@ -6834,8 +6834,16 @@ nfa_regmatch( case NFA_MARK_GT: case NFA_MARK_LT: { + size_t col = rex.input - rex.line; pos_T *pos = getmark_buf(rex.reg_buf, t->state->val, FALSE); + // Line may have been freed, get it again. + if (REG_MULTI) + { + rex.line = reg_getline(rex.lnum); + rex.input = rex.line + col; + } + // Compare the mark position to the match position, if the mark // exists and mark is set in reg_buf. if (pos != NULL && pos->lnum > 0)
--- a/src/testdir/test_regexp_latin.vim +++ b/src/testdir/test_regexp_latin.vim @@ -1037,4 +1037,12 @@ func Test_matching_pos() set re& endfunc +func Test_using_mark_position() + " this was using freed memory + new + norm O0 + call assert_fails("s/\\%')", 'E486:') + bwipe! +endfunc + " vim: shiftwidth=2 sts=2 expandtab