patch 9.1.0436: Crash when using '?' as separator for :s
Problem: Crash when using '?' as separator for :s and pattern contains
escaped '?'s (after 9.1.0409).
Solution: Always compute startplen. (zeertzjq).
related: neovim/neovim#28935
closes: 14832
Signed-off-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/regexp.c b/src/regexp.c
index d431932..147452a 100644
--- a/src/regexp.c
+++ b/src/regexp.c
@@ -620,6 +620,7 @@
{
magic_T mymagic;
char_u *p = startp;
+ size_t startplen = STRLEN(startp);
if (magic)
mymagic = MAGIC_ON;
@@ -642,12 +643,9 @@
{
if (dirc == '?' && newp != NULL && p[1] == '?')
{
- size_t startplen = 0;
-
// change "\?" to "?", make a copy first.
if (*newp == NULL)
{
- startplen = STRLEN(startp);
*newp = vim_strnsave(startp, startplen);
if (*newp != NULL)
p = *newp + (p - startp);
diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
index cf2c73f..a2367cd 100644
--- a/src/testdir/test_substitute.vim
+++ b/src/testdir/test_substitute.vim
@@ -173,6 +173,16 @@
call feedkeys("Qsc\<CR>y", 'tx')
bwipe!
endfunc
+
+" Test :s with ? as separator.
+func Test_substitute_question_separator()
+ new
+ call setline(1, '??:??')
+ %s?\?\??!!?g
+ call assert_equal('!!:!!', getline(1))
+ bwipe!
+endfunc
+
" Test %s/\n// which is implemented as a special case to use a
" more efficient join rather than doing a regular substitution.
func Test_substitute_join()
diff --git a/src/version.c b/src/version.c
index de9afee..98ec475 100644
--- a/src/version.c
+++ b/src/version.c
@@ -705,6 +705,8 @@
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 436,
+/**/
435,
/**/
434,