# HG changeset patch
# User Bram Moolenaar <Bram@vim.org>
# Date 1672853403 -3600
# Node ID f5bb69a83d8e9cf87d43fa5cf9de3734a23553b4
# Parent  60d16cdc965558c637038695b4152ad318b0d454
patch 9.0.1145: invalid memory access with recursive substitute expression

Commit: https://github.com/vim/vim/commit/3ac1d97a1d9353490493d30088256360435f7731
Author: Bram Moolenaar <Bram@vim.org>
Date:   Wed Jan 4 17:17:54 2023 +0000

    patch 9.0.1145: invalid memory access with recursive substitute expression

    Problem:    Invalid memory access with recursive substitute expression.
    Solution:   Check the return value of vim_regsub().

diff --git a/src/eval.c b/src/eval.c
--- a/src/eval.c
+++ b/src/eval.c
@@ -7312,6 +7312,11 @@ do_string_sub(
 	     * - The text after the match.
 	     */
 	    sublen = vim_regsub(&regmatch, sub, expr, tail, 0, REGSUB_MAGIC);
+	    if (sublen <= 0)
+	    {
+		ga_clear(&ga);
+		break;
+	    }
 	    if (ga_grow(&ga, (int)((end - tail) + sublen -
 			    (regmatch.endp[0] - regmatch.startp[0]))) == FAIL)
 	    {
diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
--- a/src/testdir/test_substitute.vim
+++ b/src/testdir/test_substitute.vim
@@ -1115,6 +1115,22 @@ func Test_sub_expr_goto_other_file()
   bwipe!
 endfunc
 
+func Test_recursive_expr_substitute()
+  " this was reading invalid memory
+  let lines =<< trim END
+      func Repl(g, n)
+        s
+        r%:s000
+      endfunc
+      next 0
+      let caught = 0
+      s/\%')/\=Repl(0, 0)
+      qall!
+  END
+  call writefile(lines, 'XexprSubst', 'D')
+  call RunVim([], [], '--clean -S XexprSubst')
+endfunc
+
 " Test for the 2-letter and 3-letter :substitute commands
 func Test_substitute_short_cmd()
   new
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -696,6 +696,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    1145,
+/**/
     1144,
 /**/
     1143,