mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-09-28 14:08:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:8.2.5046: vim_regsub() can overwrite the destination (#18812)

Browse Source 
Problem:    vim_regsub() can overwrite the destination.
Solution:   Pass the destination length, give an error when it doesn't fit.
4aaf3e7f4d
This commit is contained in:
zeertzjq
2022-05-31 19:55:04 +08:00
committed by GitHub
parent 1a20aed3fb
commit 0c95028688
4 changed files with 75 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/nvim/ex_cmds.c
View File

@@ -4078,7 +4078,8 @@ static buf_T *do_sub(exarg_T *eap, proftime_T timeout, bool do_buf_event, handle
// get length of substitution part
sublen = vim_regsub_multi(&regmatch,
sub_firstlnum - regmatch.startpos[0].lnum,
(char_u *)sub, (char_u *)sub_firstline, false, p_magic, true);
(char_u *)sub, (char_u *)sub_firstline, 0,
REGSUB_BACKSLASH | (p_magic ? REGSUB_MAGIC : 0));
// If getting the substitute string caused an error, don't do
// the replacement.
// Don't keep flags set by a recursive call
@@ -4118,7 +4119,8 @@ static buf_T *do_sub(exarg_T *eap, proftime_T timeout, bool do_buf_event, handle
(void)vim_regsub_multi(&regmatch,
sub_firstlnum - regmatch.startpos[0].lnum,
(char_u *)sub, (char_u *)new_end, true, p_magic, true);
(char_u *)sub, (char_u *)new_end, sublen,
REGSUB_COPY | REGSUB_BACKSLASH | (p_magic ? REGSUB_MAGIC : 0));
sub_nsubs++;
did_sub = true;