[vim/vim] NFA engine fallback can double free the compiled program (PR #20986)
Samuel Schlesinger
Problem
When the automatic regexp engine falls back to the backtracking engine in
vim_regexec_string(), the compiled program is freed before the replacement
is compiled. When vim_strsave() of the pattern fails (out of memory), the
caller's regprog is left pointing at freed memory and is freed again later.
vim_regexec_multi() already has the guarded version of the same code.
Solution
Free the previous program only after compiling the replacement succeeded,
mirroring vim_regexec_multi().
Found while auditing the ownership hand-off in #20941; the problem exists
on master independently of that PR. OOM-only path, so no test; the change
is the same shape as the multi-line variant just below it.
AI assistance is acknowledged with Co-Authored-By trailers on the commit,
per AGENTS.md.
You can view, comment on, or merge this pull request online at:
https://github.com/vim/vim/pull/20986
Commit Summary
- 5a07577 NFA engine fallback can double free the compiled program
File Changes
(1 file)
- M src/regexp.c (12)
Patch Links:
—
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today!
You are receiving this because you are subscribed to this thread.
Christian Brabandt
chrisbra left a comment (vim/vim#20986)thanks
—
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today!
You are receiving this because you are subscribed to this thread.