Commit: patch 9.2.0526: missing out-of-memory check in ex_substitute()

[Christian Brabandt]

patch 9.2.0526: missing out-of-memory check in ex_substitute()

Commit: https://github.com/vim/vim/commit/2c23dde0b09971324906dcf179fb129ffe19d76c
Author: John Marriott <basi...@internode.on.net>
Date: Sun May 24 09:08:59 2026 +0000

patch 9.2.0526: missing out-of-memory check in ex_substitute()

Problem: missing out-of-memory check in ex_substitute()
Solution: Bail out in case of out-of-memory (John Marriott)

closes: #20308

Signed-off-by: John Marriott <basi...@internode.on.net>
Signed-off-by: Christian Brabandt <c...@256bit.org>

diff --git a/src/ex_cmds.c b/src/ex_cmds.c
index 7cf63adaf..3a598ddfa 100644
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -4144,6 +4144,8 @@ ex_substitute(exarg_T *eap)
pat = NULL; // search_regcomp() will use previous pattern
patlen = 0;
sub = vim_strsave(old_sub);
+ if (sub == NULL)
+ return;

// Vi compatibility quirk: repeating with ":s" keeps the cursor in the
// last column after using "$".
@@ -5003,6 +5005,12 @@ ex_substitute(exarg_T *eap)
vim_free(sub_firstline);
sub_firstline = vim_strnsave(ml_get(sub_firstlnum),
ml_get_len(sub_firstlnum));
+ if (sub_firstline == NULL)
+ {
+ vim_free(new_start);
+ goto outofmem;
+ }
+
// When going beyond the last line, stop substituting.
if (sub_firstlnum <= line2)
do_again = TRUE;
@@ -5019,6 +5027,11 @@ ex_substitute(exarg_T *eap)
// less than what it ought to be.
vim_free(sub_firstline);
sub_firstline = vim_strsave((char_u *)"");
+ if (sub_firstline == NULL)
+ {
+ vim_free(new_start);
+ goto outofmem;
+ }
copycol = 0;
}

diff --git a/src/version.c b/src/version.c
index 175d7ab57..91bfa5761 100644
--- a/src/version.c
+++ b/src/version.c
@@ -729,6 +729,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 526,
/**/
525,
/**/