diff options
| author | Bram Moolenaar <Bram@vim.org> | 2022-05-30 20:58:55 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2022-05-30 20:58:55 +0100 |
| commit | 4aaf3e7f4db599932d01d87e5bbcdc342cccee27 (patch) | |
| tree | 951e0288738fd50c88a74c94a8ddb8d899985b51 /src/eval.c | |
| parent | 10db31f9493425a20f1e53d0f214e621f16d65de (diff) | |
| download | vim-git-4aaf3e7f4db599932d01d87e5bbcdc342cccee27.tar.gz | |
patch 8.2.5046: vim_regsub() can overwrite the destinationv8.2.5046
Problem: vim_regsub() can overwrite the destination.
Solution: Pass the destination length, give an error when it doesn't fit.
Diffstat (limited to 'src/eval.c')
| -rw-r--r-- | src/eval.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/src/eval.c b/src/eval.c index 2c70c3be1..5f9c3423d 100644 --- a/src/eval.c +++ b/src/eval.c @@ -6905,7 +6905,7 @@ do_string_sub( * - The substituted text. * - The text after the match. */ - sublen = vim_regsub(®match, sub, expr, tail, FALSE, TRUE, FALSE); + sublen = vim_regsub(®match, sub, expr, tail, 0, REGSUB_MAGIC); if (ga_grow(&ga, (int)((end - tail) + sublen - (regmatch.endp[0] - regmatch.startp[0]))) == FAIL) { @@ -6917,8 +6917,9 @@ do_string_sub( i = (int)(regmatch.startp[0] - tail); mch_memmove((char_u *)ga.ga_data + ga.ga_len, tail, (size_t)i); // add the substituted text - (void)vim_regsub(®match, sub, expr, (char_u *)ga.ga_data - + ga.ga_len + i, TRUE, TRUE, FALSE); + (void)vim_regsub(®match, sub, expr, + (char_u *)ga.ga_data + ga.ga_len + i, sublen, + REGSUB_COPY | REGSUB_MAGIC); ga.ga_len += i + sublen - 1; tail = regmatch.endp[0]; if (*tail == NUL) |