From 64869831171ffa455f35d1a1ce3a3f9c7e7416a2 Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Mon, 4 Apr 2022 11:15:31 +0800 Subject: vim-patch:8.2.4253: using freed memory when substitute with function call Problem: Using freed memory when substitute uses a recursive function call. Solution: Make a copy of the substitute text. https://github.com/vim/vim/commit/37f47958b8a2a44abc60614271d9537e7f14e51a 'compatible' doesn't seem needed for the test. --- src/nvim/ex_cmds.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) (limited to 'src/nvim/ex_cmds.c') diff --git a/src/nvim/ex_cmds.c b/src/nvim/ex_cmds.c index 71b3517adc..830e764104 100644 --- a/src/nvim/ex_cmds.c +++ b/src/nvim/ex_cmds.c @@ -3627,13 +3627,20 @@ static buf_T *do_sub(exarg_T *eap, proftime_T timeout, bool do_buf_event, handle sub_firstline = NULL; - // ~ in the substitute pattern is replaced with the old pattern. - // We do it here once to avoid it to be replaced over and over again. - // But don't do it when it starts with "\=", then it's an expression. assert(sub != NULL); bool sub_needs_free = false; - if (!(sub[0] == '\\' && sub[1] == '=')) { + char_u *sub_copy = NULL; + + // If the substitute pattern starts with "\=" then it's an expression. + // Make a copy, a recursive function may free it. + // Otherwise, '~' in the substitute pattern is replaced with the old + // pattern. We do it here once to avoid it to be replaced over and over + // again. + if (sub[0] == '\\' && sub[1] == '=') { + sub = vim_strsave(sub); + sub_copy = sub; + } else { char_u *source = sub; sub = regtilde(sub, p_magic); // When previewing, the new pattern allocated by regtilde() needs to be freed @@ -4412,6 +4419,7 @@ skip: } vim_regfree(regmatch.regprog); + xfree(sub_copy); // Restore the flag values, they can be used for ":&&". subflags.do_all = save_do_all; -- cgit