Blame SOURCES/0001-patch-8.2.4646-using-buffer-line-after-it-has-been-f.patch

5463be
diff -up vim80/src/regexp.c.cve1154 vim80/src/regexp.c
5463be
--- vim80/src/regexp.c.cve1154	2022-04-09 12:01:30.054452927 +0200
5463be
+++ vim80/src/regexp.c	2022-04-09 12:02:48.987999877 +0200
5463be
@@ -4415,8 +4415,17 @@ regmatch(
5463be
 		int	mark = OPERAND(scan)[0];
5463be
 		int	cmp = OPERAND(scan)[1];
5463be
 		pos_T	*pos;
5463be
+		size_t	col = REG_MULTI ? reginput - regline : 0;
5463be
 
5463be
 		pos = getmark_buf(rex.reg_buf, mark, FALSE);
5463be
+
5463be
+		// Line may have been freed, get it again.
5463be
+		if (REG_MULTI)
5463be
+		{
5463be
+		    regline = reg_getline(reglnum);
5463be
+		    reginput = regline + col;
5463be
+		}
5463be
+
5463be
 		if (pos == NULL		     /* mark doesn't exist */
5463be
 			|| pos->lnum <= 0    /* mark isn't set in reg_buf */
5463be
 			|| (pos->lnum == reglnum + rex.reg_firstlnum
5463be
diff -up vim80/src/testdir/test_regexp_latin.vim.cve1154 vim80/src/testdir/test_regexp_latin.vim