|
 |
45b285 |
commit c604f3ad4782fde770617ff688e1ceac0dc1bd7c
|
|
|
45b285 |
Author: Tomas Korbar <tkorbar@redhat.com>
|
|
|
45b285 |
Date: Thu Feb 3 10:14:42 2022 +0100
|
|
|
45b285 |
|
|
|
45b285 |
Fix using freed memory when substitute with function call
|
|
|
45b285 |
|
|
|
45b285 |
diff --git a/src/ex_cmds.c b/src/ex_cmds.c
|
|
|
45b285 |
index e69fbd3..0788573 100644
|
|
|
45b285 |
--- a/src/ex_cmds.c
|
|
|
45b285 |
+++ b/src/ex_cmds.c
|
|
|
45b285 |
@@ -4767,6 +4767,7 @@ do_sub(exarg_T *eap)
|
|
|
45b285 |
int save_do_all; /* remember user specified 'g' flag */
|
|
|
45b285 |
int save_do_ask; /* remember user specified 'c' flag */
|
|
|
45b285 |
char_u *pat = NULL, *sub = NULL; /* init for GCC */
|
|
|
45b285 |
+ char_u *sub_copy = NULL;
|
|
|
45b285 |
int delimiter;
|
|
|
45b285 |
int sublen;
|
|
|
45b285 |
int got_quit = FALSE;
|
|
|
45b285 |
@@ -5062,11 +5063,20 @@ do_sub(exarg_T *eap)
|
|
|
45b285 |
sub_firstline = NULL;
|
|
|
45b285 |
|
|
|
45b285 |
/*
|
|
|
45b285 |
- * ~ in the substitute pattern is replaced with the old pattern.
|
|
|
45b285 |
- * We do it here once to avoid it to be replaced over and over again.
|
|
|
45b285 |
- * But don't do it when it starts with "\=", then it's an expression.
|
|
|
45b285 |
+ * If the substitute pattern starts with "\=" then it's an expression.
|
|
|
45b285 |
+ * Make a copy, a recursive function may free it.
|
|
|
45b285 |
+ * Otherwise, '~' in the substitute pattern is replaced with the old
|
|
|
45b285 |
+ * pattern. We do it here once to avoid it to be replaced over and over
|
|
|
45b285 |
+ * again.
|
|
|
45b285 |
*/
|
|
|
45b285 |
- if (!(sub[0] == '\\' && sub[1] == '='))
|
|
|
45b285 |
+ if (sub[0] == '\\' && sub[1] == '=')
|
|
|
45b285 |
+ {
|
|
|
45b285 |
+ sub = vim_strsave(sub);
|
|
|
45b285 |
+ if (sub == NULL)
|
|
|
45b285 |
+ return;
|
|
|
45b285 |
+ sub_copy = sub;
|
|
|
45b285 |
+ }
|
|
|
45b285 |
+ else
|
|
|
45b285 |
sub = regtilde(sub, p_magic);
|
|
|
45b285 |
|
|
|
45b285 |
/*
|
|
|
45b285 |
@@ -5825,6 +5835,7 @@ outofmem:
|
|
|
45b285 |
#endif
|
|
|
45b285 |
|
|
|
45b285 |
vim_regfree(regmatch.regprog);
|
|
|
45b285 |
+ vim_free(sub_copy);
|
|
|
45b285 |
|
|
|
45b285 |
/* Restore the flag values, they can be used for ":&&". */
|
|
|
45b285 |
subflags.do_all = save_do_all;
|