To: vim_dev@googlegroups.com Subject: Patch 9.0.0047 Fcc: outbox From: Bram Moolenaar Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ------------ Patch 9.0.0047 Problem: Using freed memory with recursive substitute. Solution: Always make a copy for reg_prev_sub. Files: src/regexp.c, src/ex_cmds.c, src/testdir/test_regexp_latin.vim *** ../vim-9.0.0046/src/regexp.c 2022-06-21 22:39:47.000000000 +0100 --- src/regexp.c 2022-07-07 22:17:15.913968778 +0100 *************** *** 1766,1776 **** } } vim_free(reg_prev_sub); ! if (newsub != source) // newsub was allocated, just keep it ! reg_prev_sub = newsub; ! else // no ~ found, need to save newsub ! reg_prev_sub = vim_strsave(newsub); return newsub; } --- 1766,1776 ---- } } + // Store a copy of newsub in reg_prev_sub. It is always allocated, + // because recursive calls may make the returned string invalid. vim_free(reg_prev_sub); ! reg_prev_sub = vim_strsave(newsub); ! return newsub; } *** ../vim-9.0.0046/src/ex_cmds.c 2022-06-21 22:03:42.000000000 +0100 --- src/ex_cmds.c 2022-07-07 22:18:40.049958335 +0100 *************** *** 3994,4000 **** sub_copy = sub; } else ! sub = regtilde(sub, magic_isset()); /* * Check for a match on each line. --- 3994,4009 ---- sub_copy = sub; } else ! { ! char_u *newsub = regtilde(sub, magic_isset()); ! ! if (newsub != sub) ! { ! // newsub was allocated, free it later. ! sub_copy = newsub; ! sub = newsub; ! } ! } /* * Check for a match on each line. *** ../vim-9.0.0046/src/testdir/test_regexp_latin.vim 2022-05-18 15:00:48.000000000 +0100 --- src/testdir/test_regexp_latin.vim 2022-07-07 22:16:42.653972123 +0100 *************** *** 1114,1117 **** --- 1114,1128 ---- bwipe! endfunc + func Test_recursive_substitute_expr() + new + func Repl() + s + endfunc + silent! s/\%')/~\=Repl() + + bwipe! + delfunc Repl + endfunc + " vim: shiftwidth=2 sts=2 expandtab *** ../vim-9.0.0046/src/version.c 2022-07-07 19:59:45.466244217 +0100 --- src/version.c 2022-07-07 22:19:50.577947707 +0100 *************** *** 737,738 **** --- 737,740 ---- { /* Add new patch number below this line */ + /**/ + 47, /**/ -- hundred-and-one symptoms of being an internet addict: 82. AT&T names you Customer of the Month for the third consecutive time. /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net \\\ /// \\\ \\\ sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ /// \\\ help me help AIDS victims -- http://ICCF-Holland.org ///