diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2022-07-21 16:00:45 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-07-21 16:00:45 +0800 |
| commit | 6a7d00469bd64e8fe63468b5c1643087432709e9 (patch) | |
| tree | c24e6965b63350916f74e2e18982bbad66e2306d /src/nvim/regexp.c | |
| parent | 1f1863ed54355c314a5016560809e65c3fb0cb79 (diff) | |
| download | rneovim-6a7d00469bd64e8fe63468b5c1643087432709e9.tar.gz rneovim-6a7d00469bd64e8fe63468b5c1643087432709e9.tar.bz2 rneovim-6a7d00469bd64e8fe63468b5c1643087432709e9.zip | |
vim-patch:9.0.0047: using freed memory with recursive substitute (#19457)
Problem: Using freed memory with recursive substitute.
Solution: Always make a copy for reg_prev_sub.
https://github.com/vim/vim/commit/32acf1f1a72ebb9d8942b9c9d80023bf1bb668ea
Diffstat (limited to 'src/nvim/regexp.c')
| -rw-r--r-- | src/nvim/regexp.c | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/src/nvim/regexp.c b/src/nvim/regexp.c index 4c49d30819..2e43e388cd 100644 --- a/src/nvim/regexp.c +++ b/src/nvim/regexp.c @@ -1587,12 +1587,10 @@ char_u *regtilde(char_u *source, int magic, bool preview) // Only change reg_prev_sub when not previewing. if (!preview) { + // Store a copy of newsub in reg_prev_sub. It is always allocated, + // because recursive calls may make the returned string invalid. xfree(reg_prev_sub); - if (newsub != source) { // newsub was allocated, just keep it - reg_prev_sub = newsub; - } else { // no ~ found, need to save newsub - reg_prev_sub = vim_strsave(newsub); - } + reg_prev_sub = vim_strsave(newsub); } return newsub; |