vim-patch:7.4.2235

Problem:    submatch() does not check for a valid argument.
Solution:   Give an error if the argument is out of range. (Dominique Pelle)

989f592f7f

src/nvim/eval.c

@@ -17129,6 +17129,10 @@ static void f_submatch(typval_T *argvars, typval_T *rettv, FunPtr fptr)
     return;
   }
 
+  if (no < 0 || no >= NSUBEXP) {
+    EMSGN(_("E935: invalid submatch number: %d"), no);
+    return;
+  }
   int retList = 0;
 
   if (argvars[1].v_type != VAR_UNKNOWN) {

src/nvim/testdir/test_expr.vim

@@ -125,6 +125,11 @@ func Test_substitute_expr()
   call assert_equal('--', substitute('xxx', 'x*', {-> '-' . Recurse() . '-'}, ''))
 endfunc
 
+func Test_invalid_submatch()
+  " This was causing invalid memory access in Vim-7.4.2232 and older
+  call assert_fails("call substitute('x', '.', {-> submatch(10)}, '')", 'E935:')
+endfunc
+
 func Test_substitute_expr_arg()
   call assert_equal('123456789-123456789=', substitute('123456789',
 	\ '\(.\)\(.\)\(.\)\(.\)\(.\)\(.\)\(.\)\(.\)\(.\)',

src/nvim/version.c

@@ -205,7 +205,7 @@ static int included_patches[] = {
   // 2238 NA
   2237,
   // 2236,
-  // 2235,
+  2235,
   // 2234 NA
   2233,
   // 2232 NA