thac0/vim
1
0
Fork 0
forked from aniani/vim
Code Activity

patch 8.2.4646: using buffer line after it has been freed

Browse Source 
Problem:    Using buffer line after it has been freed in old regexp engine.
Solution:   After getting mark get the line again.
This commit is contained in:
Bram Moolenaar
2022-03-29 13:24:58 +01:00
parent fd01280d01
commit b55986c52d
3 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/regexp_bt.c
View File

@@ -3360,8 +3360,17 @@ regmatch(
int mark = OPERAND(scan)[0];
int cmp = OPERAND(scan)[1];
pos_T *pos;
size_t col = REG_MULTI ? rex.input - rex.line : 0;
pos = getmark_buf(rex.reg_buf, mark, FALSE);
// Line may have been freed, get it again.
if (REG_MULTI)
{
rex.line = reg_getline(rex.lnum);
rex.input = rex.line + col;
}
if (pos == NULL // mark doesn't exist
|| pos->lnum <= 0) // mark isn't set in reg_buf
{