diff options
author | Bram Moolenaar <Bram@vim.org> | 2022-07-07 22:20:31 +0100 |
---|---|---|
committer | Bram Moolenaar <Bram@vim.org> | 2022-07-07 22:20:31 +0100 |
commit | 32acf1f1a72ebb9d8942b9c9d80023bf1bb668ea (patch) | |
tree | 2e7f8098e185f03d1c8eb8ffcdc40bc24343d849 /src | |
parent | baefde14550231f6468ac2ed2ed495bc381c0c92 (diff) |
patch 9.0.0047: using freed memory with recursive substitutev9.0.0047
Problem: Using freed memory with recursive substitute.
Solution: Always make a copy for reg_prev_sub.
Diffstat (limited to 'src')
-rw-r--r-- | src/ex_cmds.c | 11 | ||||
-rw-r--r-- | src/regexp.c | 8 | ||||
-rw-r--r-- | src/testdir/test_regexp_latin.vim | 11 | ||||
-rw-r--r-- | src/version.c | 2 |
4 files changed, 27 insertions, 5 deletions
diff --git a/src/ex_cmds.c b/src/ex_cmds.c index eb3016fe57..5253863c87 100644 --- a/src/ex_cmds.c +++ b/src/ex_cmds.c @@ -3994,7 +3994,16 @@ ex_substitute(exarg_T *eap) sub_copy = sub; } else - sub = regtilde(sub, magic_isset()); + { + char_u *newsub = regtilde(sub, magic_isset()); + + if (newsub != sub) + { + // newsub was allocated, free it later. + sub_copy = newsub; + sub = newsub; + } + } /* * Check for a match on each line. diff --git a/src/regexp.c b/src/regexp.c index 2cbe64eb89..f35a5e8002 100644 --- a/src/regexp.c +++ b/src/regexp.c @@ -1766,11 +1766,11 @@ regtilde(char_u *source, int magic) } } + // Store a copy of newsub in reg_prev_sub. It is always allocated, + // because recursive calls may make the returned string invalid. vim_free(reg_prev_sub); - if (newsub != source) // newsub was allocated, just keep it - reg_prev_sub = newsub; - else // no ~ found, need to save newsub - reg_prev_sub = vim_strsave(newsub); + reg_prev_sub = vim_strsave(newsub); + return newsub; } diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim index 1fe4699d10..dce6709ff7 100644 --- a/src/testdir/test_regexp_latin.vim +++ b/src/testdir/test_regexp_latin.vim @@ -1114,4 +1114,15 @@ func Test_using_two_engines_pattern() bwipe! endfunc +func Test_recursive_substitute_expr() + new + func Repl() + s + endfunc + silent! s/\%')/~\=Repl() + + bwipe! + delfunc Repl +endfunc + " vim: shiftwidth=2 sts=2 expandtab diff --git a/src/version.c b/src/version.c index de8e968f42..2d917a8317 100644 --- a/src/version.c +++ b/src/version.c @@ -736,6 +736,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 47, +/**/ 46, /**/ 45, |