From 64066b9acd9f8cffdf4840f797748f938a13f2d6 Mon Sep 17 00:00:00 2001 From: Bram Moolenaar Date: Wed, 17 Nov 2021 18:22:56 +0000 Subject: [PATCH] patch 8.2.3612: using freed memory with regexp using a mark Problem: Using freed memory with regexp using a mark. Solution: Get the line again after getting the mark position. Reference:https://github.com/vim/vim/commit/64066b9acd9f8cffdf4840f797748f938a13f2d6 --- src/regexp.c | 2 +- src/regexp_nfa.c | 8 ++++++++ src/testdir/test_regexp_latin.vim | 8 ++++++++ 3 files changed, 17 insertions(+), 1 deletion(-) diff --git a/src/regexp.c b/src/regexp.c index 112f753..2e94e5a 100644 --- a/src/regexp.c +++ b/src/regexp.c @@ -1092,7 +1092,7 @@ typedef struct { // The current match-position is stord in these variables: linenr_T lnum; // line number, relative to first line char_u *line; // start of current line - char_u *input; // current input, points into "regline" + char_u *input; // current input, points into "line" int need_clear_subexpr; // subexpressions still need to be cleared #ifdef FEAT_SYN_HL diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c index bc4a4b6..433523e 100644 --- a/src/regexp_nfa.c +++ b/src/regexp_nfa.c @@ -6623,8 +6623,16 @@ nfa_regmatch( case NFA_MARK_GT: case NFA_MARK_LT: { + size_t col = rex.input - rex.line; pos_T *pos = getmark_buf(rex.reg_buf, t->state->val, FALSE); + // Line may have been freed, get it again. + if (REG_MULTI) + { + rex.line = reg_getline(rex.lnum); + rex.input = rex.line + col; + } + // Compare the mark position to the match position. result = (pos != NULL // mark doesn't exist && pos->lnum > 0 // mark isn't set in reg_buf diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim index 7a4d98f..3168edc 100644 --- a/src/testdir/test_regexp_latin.vim +++ b/src/testdir/test_regexp_latin.vim @@ -141,3 +141,11 @@ func Test_pattern_compile_speed() call assert_inrange(0.01, 10.0, reltimefloat(reltime(start))) set spc= endfunc + +func Test_using_mark_position() + " this was using freed memory + new + norm O0 + call assert_fails("s/\\%')", 'E486:') + bwipe! +endfunc -- 2.23.0