80 lines
2.0 KiB
Diff
80 lines
2.0 KiB
Diff
From 32acf1f1a72ebb9d8942b9c9d80023bf1bb668ea Mon Sep 17 00:00:00 2001
|
|
From: Bram Moolenaar <Bram@vim.org>
|
|
Date: Thu, 7 Jul 2022 22:20:31 +0100
|
|
Subject: [PATCH] patch 9.0.0047: using freed memory with recursive
|
|
substitute
|
|
|
|
Problem: Using freed memory with recursive substitute.
|
|
Solution: Always make a copy for reg_prev_sub.
|
|
---
|
|
src/ex_cmds.c | 11 ++++++++++-
|
|
src/regexp.c | 8 ++++----
|
|
src/testdir/test_regexp_latin.vim | 11 +++++++++++
|
|
3 files changed, 25 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/src/ex_cmds.c b/src/ex_cmds.c
|
|
index eb3016f..5253863 100644
|
|
--- a/src/ex_cmds.c
|
|
+++ b/src/ex_cmds.c
|
|
@@ -3994,7 +3994,16 @@ ex_substitute(exarg_T *eap)
|
|
sub_copy = sub;
|
|
}
|
|
else
|
|
- sub = regtilde(sub, magic_isset());
|
|
+ {
|
|
+ char_u *newsub = regtilde(sub, magic_isset());
|
|
+
|
|
+ if (newsub != sub)
|
|
+ {
|
|
+ // newsub was allocated, free it later.
|
|
+ sub_copy = newsub;
|
|
+ sub = newsub;
|
|
+ }
|
|
+ }
|
|
|
|
/*
|
|
* Check for a match on each line.
|
|
diff --git a/src/regexp.c b/src/regexp.c
|
|
index 2cbe64e..f35a5e8 100644
|
|
--- a/src/regexp.c
|
|
+++ b/src/regexp.c
|
|
@@ -1766,11 +1766,11 @@ regtilde(char_u *source, int magic)
|
|
}
|
|
}
|
|
|
|
+ // Store a copy of newsub in reg_prev_sub. It is always allocated,
|
|
+ // because recursive calls may make the returned string invalid.
|
|
vim_free(reg_prev_sub);
|
|
- if (newsub != source) // newsub was allocated, just keep it
|
|
- reg_prev_sub = newsub;
|
|
- else // no ~ found, need to save newsub
|
|
- reg_prev_sub = vim_strsave(newsub);
|
|
+ reg_prev_sub = vim_strsave(newsub);
|
|
+
|
|
return newsub;
|
|
}
|
|
|
|
diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim
|
|
index 1fe4699..dce6709 100644
|
|
--- a/src/testdir/test_regexp_latin.vim
|
|
+++ b/src/testdir/test_regexp_latin.vim
|
|
@@ -1114,4 +1114,15 @@ func Test_using_two_engines_pattern()
|
|
bwipe!
|
|
endfunc
|
|
|
|
+func Test_recursive_substitute_expr()
|
|
+ new
|
|
+ func Repl()
|
|
+ s
|
|
+ endfunc
|
|
+ silent! s/\%')/~\=Repl()
|
|
+
|
|
+ bwipe!
|
|
+ delfunc Repl
|
|
+endfunc
|
|
+
|
|
" vim: shiftwidth=2 sts=2 expandtab
|
|
--
|
|
1.8.3.1
|
|
|