patch 9.0.0047: using freed memory with recursive substitute
Problem: Using freed memory with recursive substitute.
Solution: Always make a copy for reg_prev_sub.
diff --git a/src/ex_cmds.c b/src/ex_cmds.c
index eb3016f..5253863 100644
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -3994,7 +3994,16 @@
sub_copy = sub;
}
else
- sub = regtilde(sub, magic_isset());
+ {
+ char_u *newsub = regtilde(sub, magic_isset());
+
+ if (newsub != sub)
+ {
+ // newsub was allocated, free it later.
+ sub_copy = newsub;
+ sub = newsub;
+ }
+ }
/*
* Check for a match on each line.