diff options
| author | Bram Moolenaar <Bram@vim.org> | 2016-08-21 15:26:54 +0200 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2016-08-21 15:26:54 +0200 |
| commit | 989f592f7ffcbafdc4ec35cee4dc65bd053e2077 (patch) | |
| tree | 122c18af5dbbd1b69e025a7d0293ff0b55e4a93b | |
| parent | dd1248143e56b1450903fe40813e40c63691b071 (diff) | |
| download | vim-git-989f592f7ffcbafdc4ec35cee4dc65bd053e2077.tar.gz | |
patch 7.4.2235v7.4.2235
Problem: submatch() does not check for a valid argument.
Solution: Give an error if the argument is out of range. (Dominique Pelle)
| -rw-r--r-- | src/evalfunc.c | 6 | ||||
| -rw-r--r-- | src/testdir/test_expr.vim | 5 | ||||
| -rw-r--r-- | src/version.c | 2 |
3 files changed, 12 insertions, 1 deletions
diff --git a/src/evalfunc.c b/src/evalfunc.c index 53d3d752e..599a3d6db 100644 --- a/src/evalfunc.c +++ b/src/evalfunc.c @@ -11491,7 +11491,11 @@ f_submatch(typval_T *argvars, typval_T *rettv) no = (int)get_tv_number_chk(&argvars[0], &error); if (error) return; - error = FALSE; + if (no < 0 || no >= NSUBEXP) + { + EMSGN(_("E935: invalid submatch number: %d"), no); + return; + } if (argvars[1].v_type != VAR_UNKNOWN) retList = (int)get_tv_number_chk(&argvars[1], &error); if (error) diff --git a/src/testdir/test_expr.vim b/src/testdir/test_expr.vim index 76811255a..b23b4490b 100644 --- a/src/testdir/test_expr.vim +++ b/src/testdir/test_expr.vim @@ -198,6 +198,11 @@ func Test_substitute_expr() call assert_equal('--', substitute('xxx', 'x*', {-> '-' . Recurse() . '-'}, '')) endfunc +func Test_invalid_submatch() + " This was causing invalid memory access in Vim-7.4.2232 and older + call assert_fails("call substitute('x', '.', {-> submatch(10)}, '')", 'E935:') +endfunc + func Test_substitute_expr_arg() call assert_equal('123456789-123456789=', substitute('123456789', \ '\(.\)\(.\)\(.\)\(.\)\(.\)\(.\)\(.\)\(.\)\(.\)', diff --git a/src/version.c b/src/version.c index e9ce5971e..65eb6d7c0 100644 --- a/src/version.c +++ b/src/version.c @@ -764,6 +764,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 2235, +/**/ 2234, /**/ 2233, |