Mercurial > vim
diff src/regexp.c @ 26841:48d6f187e9c0 v8.2.3949
patch 8.2.3949: using freed memory with /%V
Commit: https://github.com/vim/vim/commit/4c13e5e6763c6eb36a343a2b8235ea227202e952
Author: Bram Moolenaar <Bram@vim.org>
Date: Thu Dec 30 14:49:43 2021 +0000
patch 8.2.3949: using freed memory with /\%V
Problem: Using freed memory with /\%V.
Solution: Get the line again after getvvcol().
| author | Bram Moolenaar <Bram@vim.org> |
|---|---|
| date | Thu, 30 Dec 2021 16:00:05 +0100 |
| parents | 28745eec1dda |
| children | d4e61d61afd9 |
line wrap: on
line diff
--- a/src/regexp.c +++ b/src/regexp.c @@ -1310,9 +1310,9 @@ reg_match_visual(void) if (lnum < top.lnum || lnum > bot.lnum) return FALSE; + col = (colnr_T)(rex.input - rex.line); if (mode == 'v') { - col = (colnr_T)(rex.input - rex.line); if ((lnum == top.lnum && col < top.col) || (lnum == bot.lnum && col >= bot.col + (*p_sel != 'e'))) return FALSE; @@ -1327,7 +1327,12 @@ reg_match_visual(void) end = end2; if (top.col == MAXCOL || bot.col == MAXCOL || curswant == MAXCOL) end = MAXCOL; - cols = win_linetabsize(wp, rex.line, (colnr_T)(rex.input - rex.line)); + + // getvvcol() flushes rex.line, need to get it again + rex.line = reg_getline(rex.lnum); + rex.input = rex.line + col; + + cols = win_linetabsize(wp, rex.line, col); if (cols < start || cols > end - (*p_sel == 'e')) return FALSE; }