Patch 9.0.1145

[Bram Moolenaar]

Patch 9.0.1145
Problem: Invalid memory access with recursive substitute expression.
Solution: Check the return value of vim_regsub().
Files: src/eval.c, src/testdir/test_substitute.vim


*** ../vim-9.0.1144/src/eval.c 2023-01-02 18:10:00.015271225 +0000
--- src/eval.c 2023-01-04 17:15:34.165800279 +0000
***************
*** 7312,7317 ****
--- 7312,7322 ----
* - The text after the match.
*/
sublen = vim_regsub(&regmatch, sub, expr, tail, 0, REGSUB_MAGIC);
+ if (sublen <= 0)
+ {
+ ga_clear(&ga);
+ break;
+ }
if (ga_grow(&ga, (int)((end - tail) + sublen -
(regmatch.endp[0] - regmatch.startp[0]))) == FAIL)
{
*** ../vim-9.0.1144/src/testdir/test_substitute.vim 2022-11-25 13:03:28.200437332 +0000
--- src/testdir/test_substitute.vim 2023-01-04 17:14:16.670345857 +0000
***************
*** 1115,1120 ****
--- 1115,1136 ----
bwipe!
endfunc

+ func Test_recursive_expr_substitute()
+ " this was reading invalid memory
+ let lines =<< trim END
+ func Repl(g, n)
+ s
+ r%:s000
+ endfunc
+ next 0
+ let caught = 0
+ s/\%')/\=Repl(0, 0)
+ qall!
+ END
+ call writefile(lines, 'XexprSubst', 'D')
+ call RunVim([], [], '--clean -S XexprSubst')
+ endfunc
+
" Test for the 2-letter and 3-letter :substitute commands
func Test_substitute_short_cmd()
new
*** ../vim-9.0.1144/src/version.c 2023-01-04 15:56:47.868550539 +0000
--- src/version.c 2023-01-04 17:09:17.972917464 +0000
***************
*** 697,698 ****
--- 697,700 ----
{ /* Add new patch number below this line */
+ /**/
+ 1145,
/**/

--
Computers make very fast, very accurate, mistakes.

/// Bram Moolenaar -- Br...@Moolenaar.net -- http://www.Moolenaar.net \\\
/// \\\
\\\ sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ ///
\\\ help me help AIDS victims -- http://ICCF-Holland.org ///