60 lines
1.6 KiB
Diff
60 lines
1.6 KiB
Diff
From b55986c52d4cd88a22d0b0b0e8a79547ba13e1d5 Mon Sep 17 00:00:00 2001
|
|
From: Bram Moolenaar <Bram@vim.org>
|
|
Date: Tue, 29 Mar 2022 13:24:58 +0100
|
|
Subject: [PATCH] patch 8.2.4646: using buffer line after it has been freed
|
|
|
|
Problem: Using buffer line after it has been freed in old regexp engine.
|
|
Solution: After getting mark get the line again.
|
|
---
|
|
src/regexp_bt.c | 9 +++++++++
|
|
src/testdir/test_regexp_latin.vim | 7 +++++++
|
|
2 files changed, 16 insertions(+)
|
|
|
|
diff --git a/src/regexp_bt.c b/src/regexp_bt.c
|
|
index e017ba5..ff92576 100644
|
|
--- a/src/regexp_bt.c
|
|
+++ b/src/regexp_bt.c
|
|
@@ -3188,8 +3188,17 @@ regmatch(
|
|
int mark = OPERAND(scan)[0];
|
|
int cmp = OPERAND(scan)[1];
|
|
pos_T *pos;
|
|
+ size_t col = REG_MULTI ? rex.input - rex.line : 0;
|
|
|
|
pos = getmark_buf(rex.reg_buf, mark, FALSE);
|
|
+
|
|
+ // Line may have been freed, get it again.
|
|
+ if (REG_MULTI)
|
|
+ {
|
|
+ rex.line = reg_getline(rex.lnum);
|
|
+ rex.input = rex.line + col;
|
|
+ }
|
|
+
|
|
if (pos == NULL // mark doesn't exist
|
|
|| pos->lnum <= 0 // mark isn't set in reg_buf
|
|
|| (pos->lnum == rex.lnum + rex.reg_firstlnum
|
|
diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim
|
|
index 5b1db5a..a242d91 100644
|
|
--- a/src/testdir/test_regexp_latin.vim
|
|
+++ b/src/testdir/test_regexp_latin.vim
|
|
@@ -152,10 +152,17 @@ endfunc
|
|
|
|
func Test_using_mark_position()
|
|
" this was using freed memory
|
|
+ " new engine
|
|
new
|
|
norm O0
|
|
call assert_fails("s/\\%')", 'E486:')
|
|
bwipe!
|
|
+
|
|
+ " old engine
|
|
+ new
|
|
+ norm O0
|
|
+ call assert_fails("s/\\%#=1\\%')", 'E486:')
|
|
+ bwipe!
|
|
endfunc
|
|
|
|
func Test_using_invalid_visual_position()
|
|
--
|
|
1.8.3.1
|
|
|