From bae8a19c63381c3f6c860bae75af3580d68bf3b3 Mon Sep 17 00:00:00 2001 From: Michael Ennen Date: Mon, 19 Dec 2016 17:24:21 -0700 Subject: vim-patch:7.4.2235 Problem: submatch() does not check for a valid argument. Solution: Give an error if the argument is out of range. (Dominique Pelle) https://github.com/vim/vim/commit/989f592f7ffcbafdc4ec35cee4dc65bd053e2077 --- src/nvim/eval.c | 6 +++++- src/nvim/testdir/test_expr.vim | 5 +++++ src/nvim/version.c | 2 +- 3 files changed, 11 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/nvim/eval.c b/src/nvim/eval.c index 5d10002846..2e412781af 100644 --- a/src/nvim/eval.c +++ b/src/nvim/eval.c @@ -17129,12 +17129,16 @@ static void f_submatch(typval_T *argvars, typval_T *rettv, FunPtr fptr) return; } + if (no < 0 || no >= NSUBEXP) { + EMSGN(_("E935: invalid submatch number: %d"), no); + return; + } int retList = 0; if (argvars[1].v_type != VAR_UNKNOWN) { retList = get_tv_number_chk(&argvars[1], &error); if (error) { - return; + return; } } diff --git a/src/nvim/testdir/test_expr.vim b/src/nvim/testdir/test_expr.vim index 3b87c4b087..7ceef2834f 100644 --- a/src/nvim/testdir/test_expr.vim +++ b/src/nvim/testdir/test_expr.vim @@ -125,6 +125,11 @@ func Test_substitute_expr() call assert_equal('--', substitute('xxx', 'x*', {-> '-' . Recurse() . '-'}, '')) endfunc +func Test_invalid_submatch() + " This was causing invalid memory access in Vim-7.4.2232 and older + call assert_fails("call substitute('x', '.', {-> submatch(10)}, '')", 'E935:') +endfunc + func Test_substitute_expr_arg() call assert_equal('123456789-123456789=', substitute('123456789', \ '\(.\)\(.\)\(.\)\(.\)\(.\)\(.\)\(.\)\(.\)\(.\)', diff --git a/src/nvim/version.c b/src/nvim/version.c index bd8dacfd8d..e4890b9568 100644 --- a/src/nvim/version.c +++ b/src/nvim/version.c @@ -205,7 +205,7 @@ static int included_patches[] = { // 2238 NA 2237, // 2236, - // 2235, + 2235, // 2234 NA 2233, // 2232 NA -- cgit