From 227f06b7dfe52f3cb15a26ba990237af5014e2b6 Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Sun, 16 Apr 2023 18:43:15 +0800 Subject: vim-patch:9.0.1145: invalid memory access with recursive substitute expression (#23132) Problem: Invalid memory access with recursive substitute expression. Solution: Check the return value of vim_regsub(). https://github.com/vim/vim/commit/3ac1d97a1d9353490493d30088256360435f7731 Co-authored-by: Bram Moolenaar --- src/nvim/eval.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'src') diff --git a/src/nvim/eval.c b/src/nvim/eval.c index 8d517fa4d2..8d38df8421 100644 --- a/src/nvim/eval.c +++ b/src/nvim/eval.c @@ -8375,6 +8375,10 @@ char *do_string_sub(char *str, char *pat, char *sub, typval_T *expr, const char // - The substituted text. // - The text after the match. sublen = vim_regsub(®match, sub, expr, tail, 0, REGSUB_MAGIC); + if (sublen <= 0) { + ga_clear(&ga); + break; + } ga_grow(&ga, (int)((end - tail) + sublen - (regmatch.endp[0] - regmatch.startp[0]))); -- cgit