thac0/vim
1
0
Fork 0
forked from aniani/vim
Code Activity

patch 8.2.3612: using freed memory with regexp using a mark

Browse Source 
Problem:    Using freed memory with regexp using a mark.
Solution:   Get the line again after getting the mark position.
This commit is contained in:
Bram Moolenaar
2021-11-17 18:22:56 +00:00
parent 615ddd5342
commit 64066b9acd
4 changed files with 19 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/regexp_nfa.c
View File

@@ -6834,8 +6834,16 @@ nfa_regmatch(
case NFA_MARK_GT:
case NFA_MARK_LT:
{
size_t col = rex.input - rex.line;
pos_T *pos = getmark_buf(rex.reg_buf, t->state->val, FALSE);
// Line may have been freed, get it again.
if (REG_MULTI)
{
rex.line = reg_getline(rex.lnum);
rex.input = rex.line + col;
}
// Compare the mark position to the match position, if the mark
// exists and mark is set in reg_buf.
if (pos != NULL && pos->lnum > 0)