diff options
author | Bram Moolenaar <Bram@vim.org> | 2022-07-07 22:20:31 +0100 |
---|---|---|
committer | Bram Moolenaar <Bram@vim.org> | 2022-07-07 22:20:31 +0100 |
commit | 32acf1f1a72ebb9d8942b9c9d80023bf1bb668ea (patch) | |
tree | 2e7f8098e185f03d1c8eb8ffcdc40bc24343d849 /src/regexp.c | |
parent | baefde14550231f6468ac2ed2ed495bc381c0c92 (diff) |
patch 9.0.0047: using freed memory with recursive substitutev9.0.0047
Problem: Using freed memory with recursive substitute.
Solution: Always make a copy for reg_prev_sub.
Diffstat (limited to 'src/regexp.c')
-rw-r--r-- | src/regexp.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/src/regexp.c b/src/regexp.c index 2cbe64eb89..f35a5e8002 100644 --- a/src/regexp.c +++ b/src/regexp.c @@ -1766,11 +1766,11 @@ regtilde(char_u *source, int magic) } } + // Store a copy of newsub in reg_prev_sub. It is always allocated, + // because recursive calls may make the returned string invalid. vim_free(reg_prev_sub); - if (newsub != source) // newsub was allocated, just keep it - reg_prev_sub = newsub; - else // no ~ found, need to save newsub - reg_prev_sub = vim_strsave(newsub); + reg_prev_sub = vim_strsave(newsub); + return newsub; } |