From 64869831171ffa455f35d1a1ce3a3f9c7e7416a2 Mon Sep 17 00:00:00 2001
From: zeertzjq <zeertzjq@outlook.com>
Date: Mon, 4 Apr 2022 11:15:31 +0800
Subject: vim-patch:8.2.4253: using freed memory when substitute with function
 call

Problem:    Using freed memory when substitute uses a recursive function call.
Solution:   Make a copy of the substitute text.
https://github.com/vim/vim/commit/37f47958b8a2a44abc60614271d9537e7f14e51a

'compatible' doesn't seem needed for the test.
---
 src/nvim/testdir/test_substitute.vim | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

(limited to 'src/nvim/testdir')

diff --git a/src/nvim/testdir/test_substitute.vim b/src/nvim/testdir/test_substitute.vim
index 9710a7ab84..86fd0147a5 100644
--- a/src/nvim/testdir/test_substitute.vim
+++ b/src/nvim/testdir/test_substitute.vim
@@ -819,4 +819,22 @@ func Test_substitute_skipped_range()
   bwipe!
 endfunc
 
+" This was using "old_sub" after it was freed.
+func Test_using_old_sub()
+  " set compatible maxfuncdepth=10
+  set maxfuncdepth=10
+  new
+  call setline(1, 'some text.')
+  func Repl()
+    ~
+    s/
+  endfunc
+  silent!  s/\%')/\=Repl()
+
+  delfunc Repl
+  bwipe!
+  set nocompatible
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab
-- 
cgit