patch 9.0.0047: using freed memory with recursive substitutev9.0.0047

Problem:    Using freed memory with recursive substitute.
Solution:   Always make a copy for reg_prev_sub.

1 files changed, 4 insertions, 4 deletions

diff --git a/src/regexp.c b/src/regexp.c
index 2cbe64eb8..f35a5e800 100644
--- a/src/regexp.c
+++ b/src/regexp.c
@@ -1766,11 +1766,11 @@ regtilde(char_u *source, int magic)
 	}
     }
 
+    // Store a copy of newsub  in reg_prev_sub.  It is always allocated,
+    // because recursive calls may make the returned string invalid.
     vim_free(reg_prev_sub);
-    if (newsub != source)	// newsub was allocated, just keep it
-	reg_prev_sub = newsub;
-    else			// no ~ found, need to save newsub
-	reg_prev_sub = vim_strsave(newsub);
+    reg_prev_sub = vim_strsave(newsub);
+
     return newsub;
 }