diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2023-04-16 18:43:15 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-04-16 18:43:15 +0800 |
| commit | 227f06b7dfe52f3cb15a26ba990237af5014e2b6 (patch) | |
| tree | 20035bc971a0cc5b72f821bae4a843ab275eba50 /src/nvim/eval.c | |
| parent | 7f94a032e1cfb662f0c5df15e60b1ebdc3e15c4b (diff) | |
| download | rneovim-227f06b7dfe52f3cb15a26ba990237af5014e2b6.tar.gz rneovim-227f06b7dfe52f3cb15a26ba990237af5014e2b6.tar.bz2 rneovim-227f06b7dfe52f3cb15a26ba990237af5014e2b6.zip | |
vim-patch:9.0.1145: invalid memory access with recursive substitute expression (#23132)
Problem: Invalid memory access with recursive substitute expression.
Solution: Check the return value of vim_regsub().
https://github.com/vim/vim/commit/3ac1d97a1d9353490493d30088256360435f7731
Co-authored-by: Bram Moolenaar <Bram@vim.org>
Diffstat (limited to 'src/nvim/eval.c')
| -rw-r--r-- | src/nvim/eval.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/nvim/eval.c b/src/nvim/eval.c index 8d517fa4d2..8d38df8421 100644 --- a/src/nvim/eval.c +++ b/src/nvim/eval.c @@ -8375,6 +8375,10 @@ char *do_string_sub(char *str, char *pat, char *sub, typval_T *expr, const char // - The substituted text. // - The text after the match. sublen = vim_regsub(®match, sub, expr, tail, 0, REGSUB_MAGIC); + if (sublen <= 0) { + ga_clear(&ga); + break; + } ga_grow(&ga, (int)((end - tail) + sublen - (regmatch.endp[0] - regmatch.startp[0]))); |