diff options
| author | Bram Moolenaar <Bram@vim.org> | 2021-12-30 14:49:43 +0000 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2021-12-30 14:49:43 +0000 |
| commit | 4c13e5e6763c6eb36a343a2b8235ea227202e952 (patch) | |
| tree | 2ab6e7bed15c5d524eca43adead7697910a8f004 | |
| parent | cfe3af284a26178f4838df7c7489b2a1edd4c3a1 (diff) | |
patch 8.2.3949: using freed memory with /\%Vv8.2.3949
Problem: Using freed memory with /\%V.
Solution: Get the line again after getvvcol().
| -rw-r--r-- | src/regexp.c | 9 | ||||
| -rw-r--r-- | src/testdir/test_regexp_latin.vim | 8 | ||||
| -rw-r--r-- | src/version.c | 2 |
3 files changed, 17 insertions, 2 deletions
diff --git a/src/regexp.c b/src/regexp.c index 7fbad451b6..9e3d218fb9 100644 --- a/src/regexp.c +++ b/src/regexp.c @@ -1310,9 +1310,9 @@ reg_match_visual(void) if (lnum < top.lnum || lnum > bot.lnum) return FALSE; + col = (colnr_T)(rex.input - rex.line); if (mode == 'v') { - col = (colnr_T)(rex.input - rex.line); if ((lnum == top.lnum && col < top.col) || (lnum == bot.lnum && col >= bot.col + (*p_sel != 'e'))) return FALSE; @@ -1327,7 +1327,12 @@ reg_match_visual(void) end = end2; if (top.col == MAXCOL || bot.col == MAXCOL || curswant == MAXCOL) end = MAXCOL; - cols = win_linetabsize(wp, rex.line, (colnr_T)(rex.input - rex.line)); + + // getvvcol() flushes rex.line, need to get it again + rex.line = reg_getline(rex.lnum); + rex.input = rex.line + col; + + cols = win_linetabsize(wp, rex.line, col); if (cols < start || cols > end - (*p_sel == 'e')) return FALSE; } diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim index 96c317736d..03efdbea30 100644 --- a/src/testdir/test_regexp_latin.vim +++ b/src/testdir/test_regexp_latin.vim @@ -1045,4 +1045,12 @@ func Test_using_mark_position() bwipe! endfunc +func Test_using_visual_position() + " this was using freed memory + new + exe "norm 0o\<Esc>\<C-V>k\<C-X>o0" + /\%V + bwipe! +endfunc + " vim: shiftwidth=2 sts=2 expandtab diff --git a/src/version.c b/src/version.c index a362dca9a7..9f5ed308a1 100644 --- a/src/version.c +++ b/src/version.c @@ -750,6 +750,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 3949, +/**/ 3948, /**/ 3947, |