kevin/neovim
1
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2024-12-20 11:15:14 -07:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:8.2.4977: memory access error when substitute expression changes window

Browse Source 
Problem:    Memory access error when substitute expression changes window.
Solution:   Disallow changing window in substitute expression.
e2bd8600b8

"textwinlock" was renamed back to "textlock" in patch 8.2.5029.
This commit is contained in:
zeertzjq 2022-06-24 06:30:47 +08:00
parent 0cf0be302b
commit 589f418fce
2 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/nvim/ex_cmds.c
View File

@ -4069,11 +4069,16 @@ static int do_sub(exarg_T *eap, proftime_T timeout, long cmdpreview_ns, handle_T
// Save flags for recursion. They can change for e.g.
// :s/^/\=execute("s#^##gn")
subflags_T subflags_save = subflags;
// Disallow changing text or switching window in an expression.
textlock++;
// get length of substitution part
sublen = vim_regsub_multi(&regmatch,
sub_firstlnum - regmatch.startpos[0].lnum,
(char_u *)sub, (char_u *)sub_firstline, 0,
REGSUB_BACKSLASH | (p_magic ? REGSUB_MAGIC : 0));
textlock--;
// If getting the substitute string caused an error, don't do
// the replacement.
// Don't keep flags set by a recursive call
@ -4111,10 +4116,12 @@ static int do_sub(exarg_T *eap, proftime_T timeout, long cmdpreview_ns, handle_T
int start_col = new_end - new_start;
current_match.start.col = start_col;
textlock++;
(void)vim_regsub_multi(&regmatch,
sub_firstlnum - regmatch.startpos[0].lnum,
(char_u *)sub, (char_u *)new_end, sublen,
REGSUB_COPY | REGSUB_BACKSLASH | (p_magic ? REGSUB_MAGIC : 0));
textlock--;
sub_nsubs++;
did_sub = true;

13
src/nvim/testdir/test_substitute.vim
View File

@ -838,6 +838,19 @@ func Test_using_old_sub()
set nocompatible
endfunc
" This was switching windows in between computing the length and using it.
func Test_sub_change_window()
silent! lfile
sil! norm o0000000000000000000000000000000000000000000000000000
func Repl()
lopen
endfunc
silent! s/\%')/\=Repl()
bwipe!
bwipe!
delfunc Repl
endfunc
" Test for the 2-letter and 3-letter :substitute commands
func Test_substitute_short_cmd()
new