changeset 26161:9835f424bef5 v8.2.3612

patch 8.2.3612: using freed memory with regexp using a mark Commit: https://github.com/vim/vim/commit/64066b9acd9f8cffdf4840f797748f938a13f2d6 Author: Bram Moolenaar <Bram@vim.org> Date: Wed Nov 17 18:22:56 2021 +0000 patch 8.2.3612: using freed memory with regexp using a mark Problem: Using freed memory with regexp using a mark. Solution: Get the line again after getting the mark position.
author Bram Moolenaar <Bram@vim.org>
date Wed, 17 Nov 2021 19:30:04 +0100
parents b242c826c5cf
children dec9a06eec86
files src/regexp.c src/regexp_nfa.c src/testdir/test_regexp_latin.vim src/version.c
diffstat 4 files changed, 19 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/src/regexp.c
+++ b/src/regexp.c
@@ -1129,7 +1129,7 @@ typedef struct {
     // The current match-position is stord in these variables:
     linenr_T	lnum;		// line number, relative to first line
     char_u	*line;		// start of current line
-    char_u	*input;		// current input, points into "regline"
+    char_u	*input;		// current input, points into "line"
 
     int	need_clear_subexpr;	// subexpressions still need to be cleared
 #ifdef FEAT_SYN_HL
--- a/src/regexp_nfa.c
+++ b/src/regexp_nfa.c
@@ -6834,8 +6834,16 @@ nfa_regmatch(
 	    case NFA_MARK_GT:
 	    case NFA_MARK_LT:
 	      {
+		size_t	col = rex.input - rex.line;
 		pos_T	*pos = getmark_buf(rex.reg_buf, t->state->val, FALSE);
 
+		// Line may have been freed, get it again.
+		if (REG_MULTI)
+		{
+		    rex.line = reg_getline(rex.lnum);
+		    rex.input = rex.line + col;
+		}
+
 		// Compare the mark position to the match position, if the mark
 		// exists and mark is set in reg_buf.
 		if (pos != NULL && pos->lnum > 0)
--- a/src/testdir/test_regexp_latin.vim
+++ b/src/testdir/test_regexp_latin.vim
@@ -1037,4 +1037,12 @@ func Test_matching_pos()
   set re&
 endfunc
 
+func Test_using_mark_position()
+  " this was using freed memory
+  new
+  norm O0
+  call assert_fails("s/\\%')", 'E486:')
+  bwipe!
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab
--- a/src/version.c
+++ b/src/version.c
@@ -758,6 +758,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    3612,
+/**/
     3611,
 /**/
     3610,