|
 |
83f671 |
diff -up vim82/src/ex_cmds.c.cve1785 vim82/src/ex_cmds.c
|
|
|
83f671 |
--- vim82/src/ex_cmds.c.cve1785 2022-06-10 10:26:16.883312704 +0200
|
|
|
83f671 |
+++ vim82/src/ex_cmds.c 2022-06-10 10:26:16.910312568 +0200
|
|
|
83f671 |
@@ -4356,12 +4356,17 @@ ex_substitute(exarg_T *eap)
|
|
|
83f671 |
// Save flags for recursion. They can change for e.g.
|
|
|
83f671 |
// :s/^/\=execute("s#^##gn")
|
|
|
83f671 |
subflags_save = subflags;
|
|
|
83f671 |
+
|
|
|
83f671 |
+ // Disallow changing text or switching window in an expression.
|
|
|
83f671 |
+ ++textwinlock;
|
|
|
83f671 |
#endif
|
|
|
83f671 |
// get length of substitution part
|
|
|
83f671 |
sublen = vim_regsub_multi(®match,
|
|
|
83f671 |
sub_firstlnum - regmatch.startpos[0].lnum,
|
|
|
83f671 |
sub, sub_firstline, FALSE, magic_isset(), TRUE);
|
|
|
83f671 |
#ifdef FEAT_EVAL
|
|
|
83f671 |
+ --textwinlock;
|
|
|
83f671 |
+
|
|
|
83f671 |
// If getting the substitute string caused an error, don't do
|
|
|
83f671 |
// the replacement.
|
|
|
83f671 |
// Don't keep flags set by a recursive call.
|
|
|
83f671 |
@@ -4462,9 +4467,15 @@ ex_substitute(exarg_T *eap)
|
|
|
83f671 |
mch_memmove(new_end, sub_firstline + copycol, (size_t)copy_len);
|
|
|
83f671 |
new_end += copy_len;
|
|
|
83f671 |
|
|
|
83f671 |
+#ifdef FEAT_EVAL
|
|
|
83f671 |
+ ++textwinlock;
|
|
|
83f671 |
+#endif
|
|
|
83f671 |
(void)vim_regsub_multi(®match,
|
|
|
83f671 |
sub_firstlnum - regmatch.startpos[0].lnum,
|
|
|
83f671 |
sub, new_end, TRUE, magic_isset(), TRUE);
|
|
|
83f671 |
+#ifdef FEAT_EVAL
|
|
|
83f671 |
+ --textwinlock;
|
|
|
83f671 |
+#endif
|
|
|
83f671 |
sub_nsubs++;
|
|
|
83f671 |
did_sub = TRUE;
|
|
|
83f671 |
|
|
|
83f671 |
diff -up vim82/src/testdir/test_substitute.vim.cve1785 vim82/src/testdir/test_substitute.vim
|
|
|
83f671 |
--- vim82/src/testdir/test_substitute.vim.cve1785 2022-06-10 10:26:16.910312568 +0200
|
|
|
83f671 |
+++ vim82/src/testdir/test_substitute.vim 2022-06-10 10:27:02.166084629 +0200
|
|
|
83f671 |
@@ -942,5 +942,18 @@ func Test_using_old_sub()
|
|
|
83f671 |
set nocompatible
|
|
|
83f671 |
endfunc
|
|
|
83f671 |
|
|
|
83f671 |
+" This was switching windows in between computing the length and using it.
|
|
|
83f671 |
+func Test_sub_change_window()
|
|
|
83f671 |
+ silent! lfile
|
|
|
83f671 |
+ sil! norm o0000000000000000000000000000000000000000000000000000
|
|
|
83f671 |
+ func Repl()
|
|
|
83f671 |
+ lopen
|
|
|
83f671 |
+ endfunc
|
|
|
83f671 |
+ silent! s/\%')/\=Repl()
|
|
|
83f671 |
+ bwipe!
|
|
|
83f671 |
+ bwipe!
|
|
|
83f671 |
+ delfunc Repl
|
|
|
83f671 |
+endfunc
|
|
|
83f671 |
+
|
|
|
83f671 |
|
|
|
83f671 |
" vim: shiftwidth=2 sts=2 expandtab
|