kevin/neovim
1
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2024-12-19 18:55:14 -07:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:9.0.1145: invalid memory access with recursive substitute expression (#23132)

Browse Source 
Problem:    Invalid memory access with recursive substitute expression.
Solution:   Check the return value of vim_regsub().

3ac1d97a1d

Co-authored-by: Bram Moolenaar <Bram@vim.org>
This commit is contained in:
zeertzjq 2023-04-16 18:43:15 +08:00 committed by GitHub
parent 7f94a032e1
commit 227f06b7df
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/nvim/eval.c
View File

@ -8375,6 +8375,10 @@ char *do_string_sub(char *str, char *pat, char *sub, typval_T *expr, const char
// - The substituted text.
// - The text after the match.
sublen = vim_regsub(&regmatch, sub, expr, tail, 0, REGSUB_MAGIC);
if (sublen <= 0) {
ga_clear(&ga);
break;
}
ga_grow(&ga, (int)((end - tail) + sublen -
(regmatch.endp[0] - regmatch.startp[0])));

16
test/old/testdir/test_substitute.vim
View File

@ -1109,6 +1109,22 @@ func Test_sub_expr_goto_other_file()
bwipe!
endfunc
func Test_recursive_expr_substitute()
" this was reading invalid memory
let lines =<< trim END
func Repl(g, n)
s
r%:s000
endfunc
next 0
let caught = 0
s/\%')/\=Repl(0, 0)
qall!
END
call writefile(lines, 'XexprSubst', 'D')
call RunVim([], [], '--clean -S XexprSubst')
endfunc
" Test for the 2-letter and 3-letter :substitute commands
func Test_substitute_short_cmd()
new