commit 32acf1f1a72ebb9d8942b9c9d80023bf1bb668ea
author Bram Moolenaar <Bram@vim.org> Thu Jul 07 22:20:31 2022 +0100
committer Bram Moolenaar <Bram@vim.org> Thu Jul 07 22:20:31 2022 +0100
tree 2e7f8098e185f03d1c8eb8ffcdc40bc24343d849
parent baefde14550231f6468ac2ed2ed495bc381c0c92

patch 9.0.0047: using freed memory with recursive substitute

Problem:    Using freed memory with recursive substitute.
Solution:   Always make a copy for reg_prev_sub.

src/testdir/test_regexp_latin.vim

diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim
index 1fe4699..dce6709 100644
--- a/src/testdir/test_regexp_latin.vim
+++ b/src/testdir/test_regexp_latin.vim
@@ -1114,4 +1114,15 @@
   bwipe!
 endfunc
 
+func Test_recursive_substitute_expr()
+  new
+  func Repl()
+    s
+  endfunc
+  silent! s/\%')/~\=Repl()
+
+  bwipe!
+  delfunc Repl
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab