mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-10-06 18:06:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:8.2.3949: using freed memory with /\%V

Browse Source 
Problem:    Using freed memory with /\%V.
Solution:   Get the line again after getvvcol().
4c13e5e676
This commit is contained in:
zeertzjq
2022-03-10 16:40:45 +08:00
parent 9e9322b222
commit d2d3be0a4a
2 changed files with 15 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/nvim/regexp.c
View File

@@ -1136,8 +1136,8 @@ static bool reg_match_visual(void)
return false;
}
col = (colnr_T)(rex.input - rex.line);
if (mode == 'v') {
col = (colnr_T)(rex.input - rex.line);
if ((lnum == top.lnum && col < top.col)
|| (lnum == bot.lnum && col >= bot.col + (*p_sel != 'e'))) {
return false;
@@ -1152,8 +1152,12 @@ static bool reg_match_visual(void)
if (top.col == MAXCOL || bot.col == MAXCOL || curswant == MAXCOL) {
end = MAXCOL;
}
unsigned int cols_u = win_linetabsize(wp, rex.line,
(colnr_T)(rex.input - rex.line));
// getvvcol() flushes rex.line, need to get it again
rex.line = reg_getline(rex.lnum);
rex.input = rex.line + col;
unsigned int cols_u = win_linetabsize(wp, rex.line, col);
assert(cols_u <= MAXCOL);
colnr_T cols = (colnr_T)cols_u;
if (cols < start || cols > end - (*p_sel == 'e')) {

8
src/nvim/testdir/test_regexp_latin.vim
View File

@@ -795,4 +795,12 @@ func Test_using_mark_position()
bwipe!
endfunc
func Test_using_visual_position()
" this was using freed memory
new
exe "norm 0o\<Esc>\<C-V>k\<C-X>o0"
/\%V
bwipe!
endfunc
" vim: shiftwidth=2 sts=2 expandtab