commit 2186ffa2c7d8a9e2cb09316a7ac9e4ade3957c2f
author Bram Moolenaar <Bram@vim.org> Mon May 04 10:33:15 2015 +0200
committer Bram Moolenaar <Bram@vim.org> Mon May 04 10:33:15 2015 +0200
tree 7c869d126780d802efde4d98b7a040cab032da0f
parent 069dd08d8dbbbadc4e6780d5c881a24bce79a4f7

patch 7.4.715
Problem:    Invalid memory access when there are illegal bytes.
Solution:   Get the length from the text, not from the character. (Dominique
            Pelle)

src/regexp_nfa.c

diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c
index 825f960..bb55a71 100644
--- a/src/regexp_nfa.c
+++ b/src/regexp_nfa.c
@@ -6602,7 +6602,7 @@
 		/* If ireg_icombine is not set only skip over the character
 		 * itself.  When it is set skip over composing characters. */
 		if (result && enc_utf8 && !ireg_icombine)
-		    clen = utf_char2len(curc);
+		    clen = utf_ptr2len(reginput);
 #endif
 		ADD_STATE_IF_MATCH(t->state);
 		break;