From dce615bc425795ad65f96ed1879ba37ff6a030d8 Mon Sep 17 00:00:00 2001
From: zeertzjq <zeertzjq@outlook.com>
Date: Wed, 17 Jul 2024 10:31:23 +0800
Subject: vim-patch:9.0.0228: crash when pattern looks below the last line

Problem:    Crash when pattern looks below the last line.
Solution:   Consider invalid lines to be empty. (closes vim/vim#10938)

https://github.com/vim/vim/commit/13ed494bb5edc5a02d0ed0feabddb68920f88570

Comment out the test as it uses Vim9 script and text properties.

Co-authored-by: Bram Moolenaar <Bram@vim.org>
---
 src/nvim/regexp.c | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

(limited to 'src/nvim')

diff --git a/src/nvim/regexp.c b/src/nvim/regexp.c
index 5a5ba9df07..52420cf64f 100644
--- a/src/nvim/regexp.c
+++ b/src/nvim/regexp.c
@@ -6254,15 +6254,21 @@ static bool regmatch(uint8_t *scan, const proftime_T *tm, int *timed_out)
           }
           break;
 
-        case RE_VCOL:
-          if (!re_num_cmp((unsigned)win_linetabsize(rex.reg_win == NULL ? curwin : rex.reg_win,
-                                                    rex.reg_firstlnum + rex.lnum,
-                                                    (char *)rex.line,
-                                                    (colnr_T)(rex.input - rex.line)) + 1,
-                          scan)) {
+        case RE_VCOL: {
+          win_T *wp = rex.reg_win == NULL ? curwin : rex.reg_win;
+          linenr_T lnum = rex.reg_firstlnum + rex.lnum;
+          int vcol = 0;
+
+          if (lnum > 0 && lnum <= wp->w_buffer->b_ml.ml_line_count) {
+            vcol = win_linetabsize(wp, lnum, (char *)rex.line,
+                                   (colnr_T)(rex.input - rex.line));
+          }
+          if (!re_num_cmp((uint32_t)vcol + 1, scan)) {
             status = RA_NOMATCH;
           }
           break;
+        }
+        break;
 
         case BOW:  // \<word; rex.input points to w
           if (c == NUL) {  // Can't match at end of line
@@ -15099,9 +15105,14 @@ static int nfa_regmatch(nfa_regprog_T *prog, nfa_state_T *start, regsubs_T *subm
           result = col > t->state->val * ts;
         }
         if (!result) {
-          int lts = win_linetabsize(wp, rex.reg_firstlnum + rex.lnum, (char *)rex.line, col);
+          linenr_T lnum = rex.reg_firstlnum + rex.lnum;
+          int vcol = 0;
+
+          if (lnum > 0 && lnum <= wp->w_buffer->b_ml.ml_line_count) {
+            vcol = win_linetabsize(wp, lnum, (char *)rex.line, col);
+          }
           assert(t->state->val >= 0);
-          result = nfa_re_num_cmp((uintmax_t)t->state->val, op, (uintmax_t)lts + 1);
+          result = nfa_re_num_cmp((uintmax_t)t->state->val, op, (uintmax_t)vcol + 1);
         }
         if (result) {
           add_here = true;
-- 
cgit