commit 4aaf3e7f4db599932d01d87e5bbcdc342cccee27
author Bram Moolenaar <Bram@vim.org> Mon May 30 20:58:55 2022 +0100
committer Bram Moolenaar <Bram@vim.org> Mon May 30 20:58:55 2022 +0100
tree 951e0288738fd50c88a74c94a8ddb8d899985b51
parent 10db31f9493425a20f1e53d0f214e621f16d65de

patch 8.2.5046: vim_regsub() can overwrite the destination

Problem:    vim_regsub() can overwrite the destination.
Solution:   Pass the destination length, give an error when it doesn't fit.

src/eval.c

diff --git a/src/eval.c b/src/eval.c
index 2c70c3b..5f9c342 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -6905,7 +6905,7 @@
 	     * - The substituted text.
 	     * - The text after the match.
 	     */
-	    sublen = vim_regsub(&regmatch, sub, expr, tail, FALSE, TRUE, FALSE);
+	    sublen = vim_regsub(&regmatch, sub, expr, tail, 0, REGSUB_MAGIC);
 	    if (ga_grow(&ga, (int)((end - tail) + sublen -
 			    (regmatch.endp[0] - regmatch.startp[0]))) == FAIL)
 	    {
@@ -6917,8 +6917,9 @@
 	    i = (int)(regmatch.startp[0] - tail);
 	    mch_memmove((char_u *)ga.ga_data + ga.ga_len, tail, (size_t)i);
 	    // add the substituted text
-	    (void)vim_regsub(&regmatch, sub, expr, (char_u *)ga.ga_data
-					  + ga.ga_len + i, TRUE, TRUE, FALSE);
+	    (void)vim_regsub(&regmatch, sub, expr,
+				  (char_u *)ga.ga_data + ga.ga_len + i, sublen,
+				  REGSUB_COPY | REGSUB_MAGIC);
 	    ga.ga_len += i + sublen - 1;
 	    tail = regmatch.endp[0];
 	    if (*tail == NUL)