Patch 8.2.4977

[Bram Moolenaar]

Patch 8.2.4977
Problem: Memory access error when substitute expression changes window.
Solution: Disallow changing window in substitute expression.
Files: src/ex_cmds.c, src/testdir/test_substitute.vim


*** ../vim-8.2.4976/src/ex_cmds.c 2022-05-09 20:09:19.282641427 +0100
--- src/ex_cmds.c 2022-05-18 13:10:39.699436601 +0100
***************
*** 4412,4423 ****
--- 4412,4428 ----
// Save flags for recursion. They can change for e.g.
// :s/^/\=execute("s#^##gn")
subflags_save = subflags;
+
+ // Disallow changing text or switching window in an expression.
+ ++textwinlock;
#endif
// get length of substitution part
sublen = vim_regsub_multi(&regmatch,
sub_firstlnum - regmatch.startpos[0].lnum,
sub, sub_firstline, FALSE, magic_isset(), TRUE);
#ifdef FEAT_EVAL
+ --textwinlock;
+
// If getting the substitute string caused an error, don't do
// the replacement.
// Don't keep flags set by a recursive call.
***************
*** 4518,4526 ****
--- 4523,4537 ----
mch_memmove(new_end, sub_firstline + copycol, (size_t)copy_len);
new_end += copy_len;

+ #ifdef FEAT_EVAL
+ ++textwinlock;
+ #endif
(void)vim_regsub_multi(&regmatch,
sub_firstlnum - regmatch.startpos[0].lnum,
sub, new_end, TRUE, magic_isset(), TRUE);
+ #ifdef FEAT_EVAL
+ --textwinlock;
+ #endif
sub_nsubs++;
did_sub = TRUE;

*** ../vim-8.2.4976/src/testdir/test_substitute.vim 2022-03-25 21:19:22.115496681 +0000
--- src/testdir/test_substitute.vim 2022-05-18 13:03:43.599312130 +0100
***************
*** 1000,1005 ****
--- 1000,1018 ----
set nocompatible
endfunc

+ " This was switching windows in between computing the length and using it.
+ func Test_sub_change_window()
+ silent! lfile
+ sil! norm o0000000000000000000000000000000000000000000000000000
+ func Repl()
+ lopen
+ endfunc
+ silent! s/\%')/\=Repl()
+ bwipe!
+ bwipe!
+ delfunc Repl
+ endfunc
+
" Test for the 2-letter and 3-letter :substitute commands
func Test_substitute_short_cmd()
new
*** ../vim-8.2.4976/src/version.c 2022-05-18 11:00:44.295519512 +0100
--- src/version.c 2022-05-18 12:50:00.472556525 +0100
***************
*** 748,749 ****
--- 748,751 ----
{ /* Add new patch number below this line */
+ /**/
+ 4977,
/**/

--
hundred-and-one symptoms of being an internet addict:
227. You sleep next to your monitor. Or on top of it.

/// Bram Moolenaar -- Br...@Moolenaar.net -- http://www.Moolenaar.net \\\
/// \\\
\\\ sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ ///
\\\ help me help AIDS victims -- http://ICCF-Holland.org ///