rneovim.git/test/old/testdir/crash/vim_regsub_both, branch fix_20726 Neovim fork with Rahm's personal hacks. vim-patch:9.0.1848: [security] buffer-overflow in vim_regsub_both() (#25001) 2023-09-03T05:47:55+00:00 zeertzjq zeertzjq@outlook.com 2023-09-03T05:47:55+00:00 bebdf1dab345471222f6755c574d04596fea92fd Problem: buffer-overflow in vim_regsub_both() Solution: Check remaining space https://github.com/vim/vim/commit/ced2c7394aafdc90fb7845e09b3a3fee23d48cb1 The change to do_sub() looks confusing. Maybe it's an overflow check? Then the crash may not be applicable to Nvim because of different casts. The test also looks confusing. It seems to source itself recursively. Also don't call strlen() twice on evaluation result. N/A patches for version.c: vim-patch:9.0.1849: CI error on different signedness in ex_cmds.c vim-patch:9.0.1853: CI error on different signedness in regexp.c Co-authored-by: Christian Brabandt <cb@256bit.org> 
Problem:  buffer-overflow in vim_regsub_both()
Solution: Check remaining space

https://github.com/vim/vim/commit/ced2c7394aafdc90fb7845e09b3a3fee23d48cb1

The change to do_sub() looks confusing. Maybe it's an overflow check?
Then the crash may not be applicable to Nvim because of different casts.
The test also looks confusing. It seems to source itself recursively.
Also don't call strlen() twice on evaluation result.

N/A patches for version.c:
vim-patch:9.0.1849: CI error on different signedness in ex_cmds.c
vim-patch:9.0.1853: CI error on different signedness in regexp.c

Co-authored-by: Christian Brabandt <cb@256bit.org>