From 64066b9acd9f8cffdf4840f797748f938a13f2d6 Mon Sep 17 00:00:00 2001 From: Bram Moolenaar Date: Wed, 17 Nov 2021 18:22:56 +0000 Subject: patch 8.2.3612: using freed memory with regexp using a mark Problem: Using freed memory with regexp using a mark. Solution: Get the line again after getting the mark position. --- src/regexp_nfa.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'src/regexp_nfa.c') diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c index c7db98187..a0f1a960b 100644 --- a/src/regexp_nfa.c +++ b/src/regexp_nfa.c @@ -6834,8 +6834,16 @@ nfa_regmatch( case NFA_MARK_GT: case NFA_MARK_LT: { + size_t col = rex.input - rex.line; pos_T *pos = getmark_buf(rex.reg_buf, t->state->val, FALSE); + // Line may have been freed, get it again. + if (REG_MULTI) + { + rex.line = reg_getline(rex.lnum); + rex.input = rex.line + col; + } + // Compare the mark position to the match position, if the mark // exists and mark is set in reg_buf. if (pos != NULL && pos->lnum > 0) -- cgit v1.2.1