Skip to content
Permalink
Browse files
patch 8.2.3612: using freed memory with regexp using a mark
Problem:    Using freed memory with regexp using a mark.
Solution:   Get the line again after getting the mark position.
  • Loading branch information
brammool committed Nov 17, 2021
1 parent 615ddd5 commit 64066b9acd9f8cffdf4840f797748f938a13f2d6
Showing with 19 additions and 1 deletion.
  1. +1 −1 src/regexp.c
  2. +8 −0 src/regexp_nfa.c
  3. +8 −0 src/testdir/test_regexp_latin.vim
  4. +2 −0 src/version.c
@@ -1129,7 +1129,7 @@ typedef struct {
// The current match-position is stord in these variables:
linenr_T lnum; // line number, relative to first line
char_u *line; // start of current line
char_u *input; // current input, points into "regline"
char_u *input; // current input, points into "line"

int need_clear_subexpr; // subexpressions still need to be cleared
#ifdef FEAT_SYN_HL
@@ -6834,8 +6834,16 @@ nfa_regmatch(
case NFA_MARK_GT:
case NFA_MARK_LT:
{
size_t col = rex.input - rex.line;
pos_T *pos = getmark_buf(rex.reg_buf, t->state->val, FALSE);

// Line may have been freed, get it again.
if (REG_MULTI)
{
rex.line = reg_getline(rex.lnum);
rex.input = rex.line + col;
}

// Compare the mark position to the match position, if the mark
// exists and mark is set in reg_buf.
if (pos != NULL && pos->lnum > 0)
@@ -1037,4 +1037,12 @@ func Test_matching_pos()
set re&
endfunc

func Test_using_mark_position()
" this was using freed memory
new
norm O0
call assert_fails("s/\\%')", 'E486:')
bwipe!
endfunc

" vim: shiftwidth=2 sts=2 expandtab
@@ -757,6 +757,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
/**/
3612,
/**/
3611,
/**/

0 comments on commit 64066b9

Please sign in to comment.