diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2022-03-30 07:44:12 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-03-30 07:44:12 +0800 |
| commit | 2f378237037150f3c7405fec1d8762e73067d223 (patch) | |
| tree | c27349a2549df20f53db2032c0fdda4e24915096 /src/nvim/regexp_bt.c | |
| parent | e7ac16425c2bcbe26167d89134c51bf412c7b15e (diff) | |
| download | rneovim-2f378237037150f3c7405fec1d8762e73067d223.tar.gz rneovim-2f378237037150f3c7405fec1d8762e73067d223.tar.bz2 rneovim-2f378237037150f3c7405fec1d8762e73067d223.zip | |
vim-patch:8.2.4646: using buffer line after it has been freed (#17907)
Problem: Using buffer line after it has been freed in old regexp engine.
Solution: After getting mark get the line again.
https://github.com/vim/vim/commit/b55986c52d4cd88a22d0b0b0e8a79547ba13e1d5
Diffstat (limited to 'src/nvim/regexp_bt.c')
| -rw-r--r-- | src/nvim/regexp_bt.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/src/nvim/regexp_bt.c b/src/nvim/regexp_bt.c index 7340957903..3835a2bbae 100644 --- a/src/nvim/regexp_bt.c +++ b/src/nvim/regexp_bt.c @@ -3130,9 +3130,17 @@ static bool regmatch( { int mark = OPERAND(scan)[0]; int cmp = OPERAND(scan)[1]; - pos_T *pos; + pos_T *pos; + size_t col = REG_MULTI ? rex.input - rex.line : 0; pos = getmark_buf(rex.reg_buf, mark, false); + + // Line may have been freed, get it again. + if (REG_MULTI) { + rex.line = reg_getline(rex.lnum); + rex.input = rex.line + col; + } + if (pos == NULL // mark doesn't exist || pos->lnum <= 0) { // mark isn't set in reg_buf status = RA_NOMATCH; |