|
 |
c1b08a |
diff -up vim80/src/ex_cmds.c.cve1785 vim80/src/ex_cmds.c
|
|
|
c1b08a |
--- vim80/src/ex_cmds.c.cve1785 2022-06-10 10:46:33.818286626 +0200
|
|
|
c1b08a |
+++ vim80/src/ex_cmds.c 2022-06-10 10:58:04.009515524 +0200
|
|
|
c1b08a |
@@ -5486,12 +5486,17 @@ do_sub(exarg_T *eap)
|
|
|
c1b08a |
/* Save flags for recursion. They can change for e.g.
|
|
|
c1b08a |
* :s/^/\=execute("s#^##gn") */
|
|
|
c1b08a |
subflags_save = subflags;
|
|
|
c1b08a |
+
|
|
|
c1b08a |
+ // Disallow changing text or switching window in an expression.
|
|
|
c1b08a |
+ ++textlock;
|
|
|
c1b08a |
#endif
|
|
|
c1b08a |
/* get length of substitution part */
|
|
|
c1b08a |
sublen = vim_regsub_multi(®match,
|
|
|
c1b08a |
sub_firstlnum - regmatch.startpos[0].lnum,
|
|
|
c1b08a |
sub, sub_firstline, FALSE, p_magic, TRUE);
|
|
|
c1b08a |
#ifdef FEAT_EVAL
|
|
|
c1b08a |
+ --textlock;
|
|
|
c1b08a |
+
|
|
|
c1b08a |
/* Don't keep flags set by a recursive call. */
|
|
|
c1b08a |
subflags = subflags_save;
|
|
|
c1b08a |
if (subflags.do_count)
|
|
|
c1b08a |
@@ -5570,9 +5575,15 @@ do_sub(exarg_T *eap)
|
|
|
c1b08a |
mch_memmove(new_end, sub_firstline + copycol, (size_t)copy_len);
|
|
|
c1b08a |
new_end += copy_len;
|
|
|
c1b08a |
|
|
|
c1b08a |
+#ifdef FEAT_EVAL
|
|
|
c1b08a |
+ ++textlock;
|
|
|
c1b08a |
+#endif
|
|
|
c1b08a |
(void)vim_regsub_multi(®match,
|
|
|
c1b08a |
sub_firstlnum - regmatch.startpos[0].lnum,
|
|
|
c1b08a |
sub, new_end, TRUE, p_magic, TRUE);
|
|
|
c1b08a |
+#ifdef FEAT_EVAL
|
|
|
c1b08a |
+ --textlock;
|
|
|
c1b08a |
+#endif
|
|
|
c1b08a |
sub_nsubs++;
|
|
|
c1b08a |
did_sub = TRUE;
|
|
|
c1b08a |
|
|
|
c1b08a |
diff -up vim80/src/testdir/test_substitute.vim.cve1785 vim80/src/testdir/test_substitute.vim
|
|
|
c1b08a |
--- vim80/src/testdir/test_substitute.vim.cve1785 2022-06-10 10:46:33.818286626 +0200
|
|
|
c1b08a |
+++ vim80/src/testdir/test_substitute.vim 2022-06-10 10:59:17.168437630 +0200
|
|
|
c1b08a |
@@ -500,3 +500,16 @@ func Test_sub_cmd_8()
|
|
|
c1b08a |
enew!
|
|
|
c1b08a |
set titlestring&
|
|
|
c1b08a |
endfunc
|
|
|
c1b08a |
+
|
|
|
c1b08a |
+" This was switching windows in between computing the length and using it.
|
|
|
c1b08a |
+func Test_sub_change_window()
|
|
|
c1b08a |
+ silent! lfile
|
|
|
c1b08a |
+ sil! norm o0000000000000000000000000000000000000000000000000000
|
|
|
c1b08a |
+ func Repl()
|
|
|
c1b08a |
+ lopen
|
|
|
c1b08a |
+ endfunc
|
|
|
c1b08a |
+ silent! s/\%')/\=Repl()
|
|
|
c1b08a |
+ bwipe!
|
|
|
c1b08a |
+ bwipe!
|
|
|
c1b08a |
+ delfunc Repl
|
|
|
c1b08a |
+endfunc
|