vim-patch:8.2.4261: accessing invalid memory in a regular expression

Problem:    Accessing invalid memory when a regular expression checks the
            Visual area while matching in a string.
Solution:   Do not try matching the Visual area in a string.

https://github.com/vim/vim/commit/679d66c2d21dfe03d0f89b9a818b0aaebb4c3b87

Use CheckScriptFailure() instead of v9.CheckScriptFailure().

Co-authored-by: Bram Moolenaar <Bram@vim.org>

3 files changed, 39 insertions, 2 deletions

diff --git a/src/nvim/regexp.c b/src/nvim/regexp.c
index 70584c2a6c..e81df736a4 100644
--- a/src/nvim/regexp.c
+++ b/src/nvim/regexp.c
@@ -1094,8 +1094,8 @@ static bool reg_match_visual(void)
   colnr_T start2, end2;
   colnr_T curswant;
 
-  // Check if the buffer is the current buffer.
-  if (rex.reg_buf != curbuf || VIsual.lnum == 0) {
+  // Check if the buffer is the current buffer and not using a string.
+  if (rex.reg_buf != curbuf || VIsual.lnum == 0 || rex.reg_maxline == 0) {
     return false;
   }
 
diff --git a/src/nvim/testdir/test_help.vim b/src/nvim/testdir/test_help.vim
index b370a1e13e..6cebc49b61 100644
--- a/src/nvim/testdir/test_help.vim
+++ b/src/nvim/testdir/test_help.vim
@@ -1,6 +1,7 @@
 " Tests for :help
 
 source check.vim
+source vim9.vim
 
 func SetUp()
   let s:vimruntime = $VIMRUNTIME
@@ -207,5 +208,15 @@ func Test_help_long_argument()
   endtry
 endfunc
 
+func Test_help_using_visual_match()
+  let lines =<< trim END
+      call setline(1, ' ')
+      /^
+      exe "normal \<C-V>\<C-V>"
+      h5\%V€]
+  END
+  call CheckScriptFailure(lines, 'E149:')
+endfunc
+
 
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/nvim/testdir/vim9.vim b/src/nvim/testdir/vim9.vim
index db74ce3b11..d598683d81 100644
--- a/src/nvim/testdir/vim9.vim
+++ b/src/nvim/testdir/vim9.vim
@@ -2,6 +2,32 @@
 " Use a different file name for each run.
 let s:sequence = 1
 
+func CheckScriptFailure(lines, error, lnum = -3)
+  let cwd = getcwd()
+  let fname = 'XScriptFailure' .. s:sequence
+  let s:sequence += 1
+  call writefile(a:lines, fname)
+  try
+    call assert_fails('so ' .. fname, a:error, a:lines, a:lnum)
+  finally
+    call chdir(cwd)
+    call delete(fname)
+  endtry
+endfunc
+
+func CheckScriptSuccess(lines)
+  let cwd = getcwd()
+  let fname = 'XScriptSuccess' .. s:sequence
+  let s:sequence += 1
+  call writefile(a:lines, fname)
+  try
+    exe 'so ' .. fname
+  finally
+    call chdir(cwd)
+    call delete(fname)
+  endtry
+endfunc
+
 " Check that "lines" inside a legacy function has no error.
 func CheckLegacySuccess(lines)
   let cwd = getcwd()