Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
patch 9.0.1145: invalid memory access with recursive substitute expre…
…ssion

Problem:    Invalid memory access with recursive substitute expression.
Solution:   Check the return value of vim_regsub().
  • Loading branch information
brammool committed Jan 4, 2023
1 parent c32949b commit 3ac1d97
Show file tree
Hide file tree
Showing 3 changed files with 23 additions and 0 deletions.
5 changes: 5 additions & 0 deletions src/eval.c
Expand Up @@ -7312,6 +7312,11 @@ do_string_sub(
* - The text after the match.
*/
sublen = vim_regsub(&regmatch, sub, expr, tail, 0, REGSUB_MAGIC);
if (sublen <= 0)
{
ga_clear(&ga);
break;
}
if (ga_grow(&ga, (int)((end - tail) + sublen -
(regmatch.endp[0] - regmatch.startp[0]))) == FAIL)
{
Expand Down
16 changes: 16 additions & 0 deletions src/testdir/test_substitute.vim
Expand Up @@ -1115,6 +1115,22 @@ func Test_sub_expr_goto_other_file()
bwipe!
endfunc
func Test_recursive_expr_substitute()
" this was reading invalid memory
let lines =<< trim END
func Repl(g, n)
s
r%:s000
endfunc
next 0
let caught = 0
s/\%')/\=Repl(0, 0)
qall!
END
call writefile(lines, 'XexprSubst', 'D')
call RunVim([], [], '--clean -S XexprSubst')
endfunc
" Test for the 2-letter and 3-letter :substitute commands
func Test_substitute_short_cmd()
new
Expand Down
2 changes: 2 additions & 0 deletions src/version.c
Expand Up @@ -695,6 +695,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
/**/
1145,
/**/
1144,
/**/
Expand Down

1 comment on commit 3ac1d97

@lyi61pd1
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

great

Please sign in to comment.