From 526dbcafd1cd3eae24e7c615aadef3555b6791aa Mon Sep 17 00:00:00 2001
From: Jan Edmund Lazo <jan.lazo@mail.utoronto.ca>
Date: Sat, 20 Jul 2019 17:22:17 -0400
Subject: vim-patch:8.1.1720: crash with very long %[] pattern

Problem:    Crash with very long %[] pattern. (Reza Mirzazade farkhani)
Solution:   Check for reg_toolong. (closes vim/vim#4703)
https://github.com/vim/vim/commit/2a5b52758bb327b89d22660cc28c157ec29782e5
---
 src/nvim/regexp.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

(limited to 'src/nvim/regexp.c')

diff --git a/src/nvim/regexp.c b/src/nvim/regexp.c
index 8598da6376..eb1e565b1f 100644
--- a/src/nvim/regexp.c
+++ b/src/nvim/regexp.c
@@ -2058,10 +2058,14 @@ static char_u *regatom(int *flagp)
             EMSG2_RET_NULL(_(e_missing_sb),
                 reg_magic == MAGIC_ALL);
           br = regnode(BRANCH);
-          if (ret == NULL)
+          if (ret == NULL) {
             ret = br;
-          else
+          } else {
             regtail(lastnode, br);
+            if (reg_toolong) {
+              return NULL;
+            }
+          }
 
           ungetchr();
           one_exactly = TRUE;
@@ -2083,6 +2087,9 @@ static char_u *regatom(int *flagp)
           for (br = ret; br != lastnode; ) {
             if (OP(br) == BRANCH) {
               regtail(br, lastbranch);
+              if (reg_toolong) {
+                return NULL;
+              }
               br = OPERAND(br);
             } else
               br = regnext(br);
-- 
cgit