From 0de85e322a83282ad63fb07014a8530bbe05c6e3 Mon Sep 17 00:00:00 2001
From: zeertzjq <zeertzjq@outlook.com>
Date: Thu, 15 Jan 2026 13:56:05 +0800
Subject: [PATCH] vim-patch:9.1.0701: crash with NFA regex engine when
 searching for composing chars

Problem:  crash with NFA regex engine when searching for composing chars
          (SuyueGuo)
Solution: When there is no composing character, break out of the loop
          and check that out1 state is not null

fixes: vim/vim#15583

https://github.com/vim/vim/commit/c3a02d78bd7a4622e85af348b24fb1388d160de1

Test uses DBCS 'encoding', which is N/A.

Co-authored-by: Christian Brabandt <cb@256bit.org>
---
 src/nvim/regexp.c                         |   3 ++-
 test/old/testdir/crash/nullptr_regexp_nfa | Bin 0 -> 429 bytes
 test/old/testdir/test_crash.vim           |   5 +++++
 3 files changed, 7 insertions(+), 1 deletion(-)
 create mode 100644 test/old/testdir/crash/nullptr_regexp_nfa

diff --git a/src/nvim/regexp.c b/src/nvim/regexp.c
index 9a0c424011..451debf940 100644
--- a/src/nvim/regexp.c
+++ b/src/nvim/regexp.c
@@ -14799,7 +14799,8 @@ static int nfa_regmatch(nfa_regprog_T *prog, nfa_state_T *start, regsubs_T *subm
               result = FAIL;
             }
 
-            if (t->state->out->out1->c == NFA_END_COMPOSING) {
+            if (t->state->out->out1 != NULL
+                && t->state->out->out1->c == NFA_END_COMPOSING) {
               end = t->state->out->out1;
               ADD_STATE_IF_MATCH(end);
             }
diff --git a/test/old/testdir/crash/nullptr_regexp_nfa b/test/old/testdir/crash/nullptr_regexp_nfa
new file mode 100644
index 0000000000000000000000000000000000000000..6b2edc62a36f64d27231ae5eb2b7959cbcbd4510
GIT binary patch
literal 429
zcmdPXOU-=29HYRM_rF-!!rab}t2i?!HLpZ5FTW^veGtn_ku%%2ZQCZmRh(a>P+FwG
zz?JtuB__GFs656pCNI^YI90)+COVDFsyJ04H7_|oB{MJG)+nj6BvrSxBu&@QOd(Z4
z*HA&*(C|N3JVRJ2SCk=FPB8;liZ%>1{MT)mq^+%;Iny#PzeG1tw<NVFH%UT5o&k%w
zT-ZTQF+-Wc!xTQ}%rwi`n3}ZGJS~f)%o5#v1Fpn|R_CM`Zmu%RsAvP-M6pDz<QVOk
z8Vdtmkjg~!xR{z4Rc8-ZXK!bJ-vIwmKbIiafOqc%-@Rje_wHQ{R8LaOI}pgrRIM#e
zNl8gf%Z`cBj>$>Q0|!NBo;HY!YG^9N(2Sf^?U<VAtm6E<MOtSTXzBkGNGwXv;p1Zi
eg>Yg{brr}>sOB4LgPa%*abhl5zd>$Iv;hFtnUWg-

literal 0
HcmV?d00001

diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim
index 4f13949fc6..ba11a94e06 100644
--- a/test/old/testdir/test_crash.vim
+++ b/test/old/testdir/test_crash.vim
@@ -232,6 +232,11 @@ func Test_crash1_3()
   call term_sendkeys(buf, args)
   call TermWait(buf, 50)
 
+  let file = 'crash/nullptr_regexp_nfa'
+  let cmn_args = "%s -u NONE -i NONE -n -X -m -n -e -s -S %s -c ':qa!'"
+  let args = printf(cmn_args, vim, file)
+  call term_sendkeys(buf, args)
+  call TermWait(buf, 50)
 
   " clean up
   exe buf .. "bw!"