From 0c95028688dfee776750c4732811508294557ba2 Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Tue, 31 May 2022 19:55:04 +0800 Subject: vim-patch:8.2.5046: vim_regsub() can overwrite the destination (#18812) Problem: vim_regsub() can overwrite the destination. Solution: Pass the destination length, give an error when it doesn't fit. https://github.com/vim/vim/commit/4aaf3e7f4db599932d01d87e5bbcdc342cccee27 --- src/nvim/eval.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'src/nvim/eval.c') diff --git a/src/nvim/eval.c b/src/nvim/eval.c index 02dc5ec954..6eb210fc79 100644 --- a/src/nvim/eval.c +++ b/src/nvim/eval.c @@ -10413,7 +10413,7 @@ char *do_string_sub(char *str, char *pat, char *sub, typval_T *expr, char *flags // - The text up to where the match is. // - The substituted text. // - The text after the match. - sublen = vim_regsub(®match, (char_u *)sub, expr, (char_u *)tail, false, true, false); + sublen = vim_regsub(®match, (char_u *)sub, expr, (char_u *)tail, 0, REGSUB_MAGIC); ga_grow(&ga, (int)((end - tail) + sublen - (regmatch.endp[0] - regmatch.startp[0]))); @@ -10421,8 +10421,9 @@ char *do_string_sub(char *str, char *pat, char *sub, typval_T *expr, char *flags int i = (int)(regmatch.startp[0] - (char_u *)tail); memmove((char_u *)ga.ga_data + ga.ga_len, tail, (size_t)i); // add the substituted text - (void)vim_regsub(®match, (char_u *)sub, expr, (char_u *)ga.ga_data - + ga.ga_len + i, true, true, false); + (void)vim_regsub(®match, (char_u *)sub, expr, + (char_u *)ga.ga_data + ga.ga_len + i, sublen, + REGSUB_COPY | REGSUB_MAGIC); ga.ga_len += i + sublen - 1; tail = (char *)regmatch.endp[0]; if (*tail == NUL) { -- cgit