vim-patch:7.4.593 #2657

Problem:    Crash when searching for "x\{0,90000}". (Dominique Pelle)
Solution:   Bail out from the NFA engine when the max limit is much higher
            than the min limit.

https://github.com/vim/vim/commit/v7-4-593

See https://groups.google.com/d/msg/vim_dev/c7owwoseba8/ZETgSNZ6p10J

1 files changed, 10 insertions, 0 deletions

diff --git a/src/nvim/regexp_nfa.c b/src/nvim/regexp_nfa.c
index 4ef91814ac..d9dc09b623 100644
--- a/src/nvim/regexp_nfa.c
+++ b/src/nvim/regexp_nfa.c
@@ -315,6 +315,9 @@ typedef struct {
   int has_pim;                  /* TRUE when any state has a PIM */
 } nfa_list_T;
 
+/// re_flags passed to nfa_regcomp().
+static int nfa_re_flags;
+
 /* NFA regexp \ze operator encountered. */
 static int nfa_has_zend;
 
@@ -1894,6 +1897,12 @@ static int nfa_regpiece(void)
       return OK;
     }
 
+    // The engine is very inefficient (uses too many states) when the maximum is
+    // much larger than the minimum. Bail out if we can use the other engine.
+    if ((nfa_re_flags & RE_AUTO) && maxval > minval + 200) {
+      return FAIL;
+    }
+
     /* Ignore previous call to nfa_regatom() */
     post_ptr = post_start + my_post_start;
     /* Save parse state after the repeated atom and the \{} */
@@ -6287,6 +6296,7 @@ static regprog_T *nfa_regcomp(char_u *expr, int re_flags)
     return NULL;
 
   nfa_regengine.expr = expr;
+  nfa_re_flags = re_flags;
 
   init_class_tab();