Commit: patch 9.1.0436: Crash when using '?' as separator for :s

[Christian Brabandt]

patch 9.1.0436: Crash when using '?' as separator for :s

Commit: https://github.com/vim/vim/commit/789679cfc4f39505b135220672b43a260d8ca3b4
Author: zeertzjq <zeer...@outlook.com>
Date: Thu May 23 17:41:26 2024 +0200

patch 9.1.0436: Crash when using '?' as separator for :s

Problem: Crash when using '?' as separator for :s and pattern contains
escaped '?'s (after 9.1.0409).
Solution: Always compute startplen. (zeertzjq).

related: neovim/neovim#28935
closes: 14832

Signed-off-by: zeertzjq <zeer...@outlook.com>
Signed-off-by: Christian Brabandt <c...@256bit.org>

diff --git a/src/regexp.c b/src/regexp.c
index d43193219..147452aae 100644
--- a/src/regexp.c
+++ b/src/regexp.c
@@ -620,6 +620,7 @@ skip_regexp_ex(
{
magic_T mymagic;
char_u *p = startp;
+ size_t startplen = STRLEN(startp);

if (magic)
mymagic = MAGIC_ON;
@@ -642,12 +643,9 @@ skip_regexp_ex(
{
if (dirc == '?' && newp != NULL && p[1] == '?')
{
- size_t startplen = 0;
-
// change "\?" to "?", make a copy first.
if (*newp == NULL)
{
- startplen = STRLEN(startp);
*newp = vim_strnsave(startp, startplen);
if (*newp != NULL)
p = *newp + (p - startp);
diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
index cf2c73fb9..a2367cd23 100644
--- a/src/testdir/test_substitute.vim
+++ b/src/testdir/test_substitute.vim
@@ -173,6 +173,16 @@ func Test_substitute_repeat()
call feedkeys("Qsc\<CR>y", 'tx')
bwipe!
endfunc
+
+" Test :s with ? as separator.
+func Test_substitute_question_separator()
+ new
+ call setline(1, '??:??')
+ %s?\?\??!!?g
+ call assert_equal('!!:!!', getline(1))
+ bwipe!
+endfunc
+
" Test %s/
// which is implemented as a special case to use a
" more efficient join rather than doing a regular substitution.
func Test_substitute_join()
diff --git a/src/version.c b/src/version.c
index de9afee33..98ec4754e 100644
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 436,
/**/
435,
/**/