diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2023-04-16 18:43:15 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-04-16 18:43:15 +0800 |
| commit | 227f06b7dfe52f3cb15a26ba990237af5014e2b6 (patch) | |
| tree | 20035bc971a0cc5b72f821bae4a843ab275eba50 | |
| parent | 7f94a032e1cfb662f0c5df15e60b1ebdc3e15c4b (diff) | |
| download | rneovim-227f06b7dfe52f3cb15a26ba990237af5014e2b6.tar.gz rneovim-227f06b7dfe52f3cb15a26ba990237af5014e2b6.tar.bz2 rneovim-227f06b7dfe52f3cb15a26ba990237af5014e2b6.zip | |
vim-patch:9.0.1145: invalid memory access with recursive substitute expression (#23132)
Problem: Invalid memory access with recursive substitute expression.
Solution: Check the return value of vim_regsub().
https://github.com/vim/vim/commit/3ac1d97a1d9353490493d30088256360435f7731
Co-authored-by: Bram Moolenaar <Bram@vim.org>
| -rw-r--r-- | src/nvim/eval.c | 4 | ||||
| -rw-r--r-- | test/old/testdir/test_substitute.vim | 16 |
2 files changed, 20 insertions, 0 deletions
diff --git a/src/nvim/eval.c b/src/nvim/eval.c index 8d517fa4d2..8d38df8421 100644 --- a/src/nvim/eval.c +++ b/src/nvim/eval.c @@ -8375,6 +8375,10 @@ char *do_string_sub(char *str, char *pat, char *sub, typval_T *expr, const char // - The substituted text. // - The text after the match. sublen = vim_regsub(®match, sub, expr, tail, 0, REGSUB_MAGIC); + if (sublen <= 0) { + ga_clear(&ga); + break; + } ga_grow(&ga, (int)((end - tail) + sublen - (regmatch.endp[0] - regmatch.startp[0]))); diff --git a/test/old/testdir/test_substitute.vim b/test/old/testdir/test_substitute.vim index f15ef122ec..75bd3cff6f 100644 --- a/test/old/testdir/test_substitute.vim +++ b/test/old/testdir/test_substitute.vim @@ -1109,6 +1109,22 @@ func Test_sub_expr_goto_other_file() bwipe! endfunc +func Test_recursive_expr_substitute() + " this was reading invalid memory + let lines =<< trim END + func Repl(g, n) + s + r%:s000 + endfunc + next 0 + let caught = 0 + s/\%')/\=Repl(0, 0) + qall! + END + call writefile(lines, 'XexprSubst', 'D') + call RunVim([], [], '--clean -S XexprSubst') +endfunc + " Test for the 2-letter and 3-letter :substitute commands func Test_substitute_short_cmd() new |