updated for version 7.4.421

Problem:    Crash when searching for "\ze*". (Urtica Dioica)
Solution:   Disallow a multi after \ze and \zs.

src/regexp_nfa.c

@@ -291,6 +291,7 @@ static int nfa_regpiece __ARGS((void));
 static int nfa_regconcat __ARGS((void));
 static int nfa_regbranch __ARGS((void));
 static int nfa_reg __ARGS((int paren));
+static int re_mult_next __ARGS((char *what));
 #ifdef DEBUG
 static void nfa_set_code __ARGS((int c));
 static void nfa_postfix_dump __ARGS((char_u *expr, int retval));
@@ -1323,10 +1324,14 @@ nfa_regatom()
 	    {
 		case 's':
 		    EMIT(NFA_ZSTART);
+		    if (re_mult_next("\\zs") == FAIL)
+			return FAIL;
 		    break;
 		case 'e':
 		    EMIT(NFA_ZEND);
 		    nfa_has_zend = TRUE;
+		    if (re_mult_next("\\ze") == FAIL)
+			return FAIL;
 		    break;
 #ifdef FEAT_SYN_HL
 		case '1':
@@ -2276,6 +2281,18 @@ nfa_reg(paren)
     return OK;
 }
 
+/*
+ * Used in a place where no * or \+ can follow.
+ */
+    static int
+re_mult_next(what)
+    char *what;
+{
+    if (re_multi_type(peekchr()) == MULTI_MULT)
+	EMSG2_RET_FAIL(_("E888: (NFA regexp) cannot repeat %s"), what);
+    return OK;
+}
+
 #ifdef DEBUG
 static char_u code[50];
 

src/testdir/test64.in

@@ -608,6 +608,17 @@ yeGopA END:"
 "ayb20gg/..\%$
 "bybGo"apo"bp:"
 :"
+:" Check for detecting error
+:set regexpengine=2
+:for pat in [' \ze*', ' \zs*']
+:  try
+:    let l = matchlist('x x', pat)
+:    $put ='E888 NOT detected for ' . pat
+:  catch
+:    $put ='E888 detected for ' . pat
+:  endtry
+:endfor
+:"
 :""""" Write the results """""""""""""
 :/\%#=1^Results/,$wq! test.out
 ENDTEST

src/testdir/test64.ok

@@ -1097,3 +1097,5 @@ Test
 Test END
 EN
 E
+E888 detected for  \ze*
+E888 detected for  \zs*

src/version.c

@@ -741,6 +741,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    421,
 /**/
     420,
 /**/