commit 4aaf3e7f4db599932d01d87e5bbcdc342cccee27
author Bram Moolenaar <Bram@vim.org> Mon May 30 20:58:55 2022 +0100
committer Bram Moolenaar <Bram@vim.org> Mon May 30 20:58:55 2022 +0100
tree 951e0288738fd50c88a74c94a8ddb8d899985b51
parent 10db31f9493425a20f1e53d0f214e621f16d65de

patch 8.2.5046: vim_regsub() can overwrite the destination

Problem:    vim_regsub() can overwrite the destination.
Solution:   Pass the destination length, give an error when it doesn't fit.

src/ex_cmds.c

diff --git a/src/ex_cmds.c b/src/ex_cmds.c
index 4a6073d..e01d067 100644
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -4419,7 +4419,9 @@
 		// get length of substitution part
 		sublen = vim_regsub_multi(&regmatch,
 				    sub_firstlnum - regmatch.startpos[0].lnum,
-			       sub, sub_firstline, FALSE, magic_isset(), TRUE);
+			       sub, sub_firstline, 0,
+			       REGSUB_BACKSLASH
+				    | (magic_isset() ? REGSUB_MAGIC : 0));
 #ifdef FEAT_EVAL
 		--textlock;
 
@@ -4528,7 +4530,9 @@
 #endif
 		(void)vim_regsub_multi(&regmatch,
 				    sub_firstlnum - regmatch.startpos[0].lnum,
-				      sub, new_end, TRUE, magic_isset(), TRUE);
+				      sub, new_end, sublen,
+				      REGSUB_COPY | REGSUB_BACKSLASH
+					 | (magic_isset() ? REGSUB_MAGIC : 0));
 #ifdef FEAT_EVAL
 		--textlock;
 #endif