Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
patch 8.2.3612: using freed memory with regexp using a mark
Problem:    Using freed memory with regexp using a mark.
Solution:   Get the line again after getting the mark position.
  • Loading branch information
brammool committed Nov 17, 2021
1 parent 615ddd5 commit 64066b9
Show file tree
Hide file tree
Showing 4 changed files with 19 additions and 1 deletion.
2 changes: 1 addition & 1 deletion src/regexp.c
Expand Up @@ -1129,7 +1129,7 @@ typedef struct {
// The current match-position is stord in these variables:
linenr_T lnum; // line number, relative to first line
char_u *line; // start of current line
char_u *input; // current input, points into "regline"
char_u *input; // current input, points into "line"

int need_clear_subexpr; // subexpressions still need to be cleared
#ifdef FEAT_SYN_HL
Expand Down
8 changes: 8 additions & 0 deletions src/regexp_nfa.c
Expand Up @@ -6834,8 +6834,16 @@ nfa_regmatch(
case NFA_MARK_GT:
case NFA_MARK_LT:
{
size_t col = rex.input - rex.line;
pos_T *pos = getmark_buf(rex.reg_buf, t->state->val, FALSE);

// Line may have been freed, get it again.
if (REG_MULTI)
{
rex.line = reg_getline(rex.lnum);
rex.input = rex.line + col;
}

// Compare the mark position to the match position, if the mark
// exists and mark is set in reg_buf.
if (pos != NULL && pos->lnum > 0)
Expand Down
8 changes: 8 additions & 0 deletions src/testdir/test_regexp_latin.vim
Expand Up @@ -1037,4 +1037,12 @@ func Test_matching_pos()
set re&
endfunc

func Test_using_mark_position()
" this was using freed memory
new
norm O0
call assert_fails("s/\\%')", 'E486:')
bwipe!
endfunc

" vim: shiftwidth=2 sts=2 expandtab
2 changes: 2 additions & 0 deletions src/version.c
Expand Up @@ -757,6 +757,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
/**/
3612,
/**/
3611,
/**/
Expand Down

0 comments on commit 64066b9

Please sign in to comment.