a1622b8443
Signed-off-by: ExtinctFire <shenyining_00@126.com> (cherry picked from commit 20e53e3a69bad745d01299378ff5fdac9b08aa22)
67 lines
2.2 KiB
Diff
67 lines
2.2 KiB
Diff
From 64066b9acd9f8cffdf4840f797748f938a13f2d6 Mon Sep 17 00:00:00 2001
|
|
From: Bram Moolenaar <Bram@vim.org>
|
|
Date: Wed, 17 Nov 2021 18:22:56 +0000
|
|
Subject: [PATCH] patch 8.2.3612: using freed memory with regexp using a mark
|
|
|
|
Problem: Using freed memory with regexp using a mark.
|
|
Solution: Get the line again after getting the mark position.
|
|
|
|
Reference:https://github.com/vim/vim/commit/64066b9acd9f8cffdf4840f797748f938a13f2d6
|
|
---
|
|
src/regexp.c | 2 +-
|
|
src/regexp_nfa.c | 8 ++++++++
|
|
src/testdir/test_regexp_latin.vim | 8 ++++++++
|
|
3 files changed, 17 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/regexp.c b/src/regexp.c
|
|
index 112f753..2e94e5a 100644
|
|
--- a/src/regexp.c
|
|
+++ b/src/regexp.c
|
|
@@ -1092,7 +1092,7 @@ typedef struct {
|
|
// The current match-position is stord in these variables:
|
|
linenr_T lnum; // line number, relative to first line
|
|
char_u *line; // start of current line
|
|
- char_u *input; // current input, points into "regline"
|
|
+ char_u *input; // current input, points into "line"
|
|
|
|
int need_clear_subexpr; // subexpressions still need to be cleared
|
|
#ifdef FEAT_SYN_HL
|
|
diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c
|
|
index bc4a4b6..433523e 100644
|
|
--- a/src/regexp_nfa.c
|
|
+++ b/src/regexp_nfa.c
|
|
@@ -6623,8 +6623,16 @@ nfa_regmatch(
|
|
case NFA_MARK_GT:
|
|
case NFA_MARK_LT:
|
|
{
|
|
+ size_t col = rex.input - rex.line;
|
|
pos_T *pos = getmark_buf(rex.reg_buf, t->state->val, FALSE);
|
|
|
|
+ // Line may have been freed, get it again.
|
|
+ if (REG_MULTI)
|
|
+ {
|
|
+ rex.line = reg_getline(rex.lnum);
|
|
+ rex.input = rex.line + col;
|
|
+ }
|
|
+
|
|
// Compare the mark position to the match position.
|
|
result = (pos != NULL // mark doesn't exist
|
|
&& pos->lnum > 0 // mark isn't set in reg_buf
|
|
diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim
|
|
index 7a4d98f..3168edc 100644
|
|
--- a/src/testdir/test_regexp_latin.vim
|
|
+++ b/src/testdir/test_regexp_latin.vim
|
|
@@ -141,3 +141,11 @@ func Test_pattern_compile_speed()
|
|
call assert_inrange(0.01, 10.0, reltimefloat(reltime(start)))
|
|
set spc=
|
|
endfunc
|
|
+
|
|
+func Test_using_mark_position()
|
|
+ " this was using freed memory
|
|
+ new
|
|
+ norm O0
|
|
+ call assert_fails("s/\\%')", 'E486:')
|
|
+ bwipe!
|
|
+endfunc
|
|
--
|
|
2.23.0
|