diff options
author | Bram Moolenaar <Bram@vim.org> | 2022-07-07 22:20:31 +0100 |
---|---|---|
committer | Bram Moolenaar <Bram@vim.org> | 2022-07-07 22:20:31 +0100 |
commit | 32acf1f1a72ebb9d8942b9c9d80023bf1bb668ea (patch) | |
tree | 2e7f8098e185f03d1c8eb8ffcdc40bc24343d849 /src/ex_cmds.c | |
parent | baefde14550231f6468ac2ed2ed495bc381c0c92 (diff) |
patch 9.0.0047: using freed memory with recursive substitutev9.0.0047
Problem: Using freed memory with recursive substitute.
Solution: Always make a copy for reg_prev_sub.
Diffstat (limited to 'src/ex_cmds.c')
-rw-r--r-- | src/ex_cmds.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/src/ex_cmds.c b/src/ex_cmds.c index eb3016fe57..5253863c87 100644 --- a/src/ex_cmds.c +++ b/src/ex_cmds.c @@ -3994,7 +3994,16 @@ ex_substitute(exarg_T *eap) sub_copy = sub; } else - sub = regtilde(sub, magic_isset()); + { + char_u *newsub = regtilde(sub, magic_isset()); + + if (newsub != sub) + { + // newsub was allocated, free it later. + sub_copy = newsub; + sub = newsub; + } + } /* * Check for a match on each line. |