To: vim_dev@googlegroups.com Subject: Patch 9.0.1145 Fcc: outbox From: Bram Moolenaar Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ------------ Patch 9.0.1145 Problem: Invalid memory access with recursive substitute expression. Solution: Check the return value of vim_regsub(). Files: src/eval.c, src/testdir/test_substitute.vim *** ../vim-9.0.1144/src/eval.c 2023-01-02 18:10:00.015271225 +0000 --- src/eval.c 2023-01-04 17:15:34.165800279 +0000 *************** *** 7312,7317 **** --- 7312,7322 ---- * - The text after the match. */ sublen = vim_regsub(®match, sub, expr, tail, 0, REGSUB_MAGIC); + if (sublen <= 0) + { + ga_clear(&ga); + break; + } if (ga_grow(&ga, (int)((end - tail) + sublen - (regmatch.endp[0] - regmatch.startp[0]))) == FAIL) { *** ../vim-9.0.1144/src/testdir/test_substitute.vim 2022-11-25 13:03:28.200437332 +0000 --- src/testdir/test_substitute.vim 2023-01-04 17:14:16.670345857 +0000 *************** *** 1115,1120 **** --- 1115,1136 ---- bwipe! endfunc + func Test_recursive_expr_substitute() + " this was reading invalid memory + let lines =<< trim END + func Repl(g, n) + s + r%:s000 + endfunc + next 0 + let caught = 0 + s/\%')/\=Repl(0, 0) + qall! + END + call writefile(lines, 'XexprSubst', 'D') + call RunVim([], [], '--clean -S XexprSubst') + endfunc + " Test for the 2-letter and 3-letter :substitute commands func Test_substitute_short_cmd() new *** ../vim-9.0.1144/src/version.c 2023-01-04 15:56:47.868550539 +0000 --- src/version.c 2023-01-04 17:09:17.972917464 +0000 *************** *** 697,698 **** --- 697,700 ---- { /* Add new patch number below this line */ + /**/ + 1145, /**/ -- Computers make very fast, very accurate, mistakes. /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net \\\ /// \\\ \\\ sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ /// \\\ help me help AIDS victims -- http://ICCF-Holland.org ///