Blame SOURCES/0001-patch-8.2.4253-using-freed-memory-when-substitute-wi.patch

9bb4fd
commit c604f3ad4782fde770617ff688e1ceac0dc1bd7c
9bb4fd
Author: Tomas Korbar <tkorbar@redhat.com>
9bb4fd
Date:   Thu Feb 3 10:14:42 2022 +0100
9bb4fd
9bb4fd
    Fix using freed memory when substitute with function call
9bb4fd
9bb4fd
diff --git a/src/ex_cmds.c b/src/ex_cmds.c
9bb4fd
index e69fbd3..0788573 100644
9bb4fd
--- a/src/ex_cmds.c
9bb4fd
+++ b/src/ex_cmds.c
9bb4fd
@@ -4767,6 +4767,7 @@ do_sub(exarg_T *eap)
9bb4fd
     int		save_do_all;		/* remember user specified 'g' flag */
9bb4fd
     int		save_do_ask;		/* remember user specified 'c' flag */
9bb4fd
     char_u	*pat = NULL, *sub = NULL;	/* init for GCC */
9bb4fd
+	char_u	*sub_copy = NULL;
9bb4fd
     int		delimiter;
9bb4fd
     int		sublen;
9bb4fd
     int		got_quit = FALSE;
9bb4fd
@@ -5062,11 +5063,20 @@ do_sub(exarg_T *eap)
9bb4fd
     sub_firstline = NULL;
9bb4fd
 
9bb4fd
     /*
9bb4fd
-     * ~ in the substitute pattern is replaced with the old pattern.
9bb4fd
-     * We do it here once to avoid it to be replaced over and over again.
9bb4fd
-     * But don't do it when it starts with "\=", then it's an expression.
9bb4fd
+     * If the substitute pattern starts with "\=" then it's an expression.
9bb4fd
+     * Make a copy, a recursive function may free it.
9bb4fd
+     * Otherwise, '~' in the substitute pattern is replaced with the old
9bb4fd
+     * pattern.  We do it here once to avoid it to be replaced over and over
9bb4fd
+     * again.
9bb4fd
      */
9bb4fd
-    if (!(sub[0] == '\\' && sub[1] == '='))
9bb4fd
+    if (sub[0] == '\\' && sub[1] == '=')
9bb4fd
+    {
9bb4fd
+	sub = vim_strsave(sub);
9bb4fd
+	if (sub == NULL)
9bb4fd
+	    return;
9bb4fd
+	sub_copy = sub;
9bb4fd
+    }
9bb4fd
+    else
9bb4fd
 	sub = regtilde(sub, p_magic);
9bb4fd
 
9bb4fd
     /*
9bb4fd
@@ -5825,6 +5835,7 @@ outofmem:
9bb4fd
 #endif
9bb4fd
 
9bb4fd
     vim_regfree(regmatch.regprog);
9bb4fd
+	vim_free(sub_copy);
9bb4fd
 
9bb4fd
     /* Restore the flag values, they can be used for ":&&". */
9bb4fd
     subflags.do_all = save_do_all;