patch 9.0.0047: using freed memory with recursive substitutev9.0.0047

Problem:    Using freed memory with recursive substitute.
Solution:   Always make a copy for reg_prev_sub.

1 files changed, 10 insertions, 1 deletions

diff --git a/src/ex_cmds.c b/src/ex_cmds.c
index eb3016fe57..5253863c87 100644
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -3994,7 +3994,16 @@ ex_substitute(exarg_T *eap)
 	sub_copy = sub;
     }
     else
-	sub = regtilde(sub, magic_isset());
+    {
+	char_u *newsub = regtilde(sub, magic_isset());
+
+	if (newsub != sub)
+	{
+	    // newsub was allocated, free it later.
+	    sub_copy = newsub;
+	    sub = newsub;
+	}
+    }
 
     /*
      * Check for a match on each line.