commit 8bfd9469cef536f171e6666f9d9217192e09d161
author Bram Moolenaar <Bram@vim.org> Sat Feb 16 18:07:57 2019 +0100
committer Bram Moolenaar <Bram@vim.org> Sat Feb 16 18:07:57 2019 +0100
tree 1f5b859c8c2b118440a067103edf130120300ca3
parent 985079c514e9ab85598b7bca019c77d3e42526f5

patch 8.1.0935: old regexp engine may use invalid buffer

Problem:    Old regexp engine may use invalid buffer for 'iskeyword' or
            uninitialized buffer pointer. (Kuang-che Wu)
Solution:   Set rex.reg_buf when compiling the pattern. (closes #3972)

src/regexp.c

diff --git a/src/regexp.c b/src/regexp.c
index 30a604b..8362048 100644
--- a/src/regexp.c
+++ b/src/regexp.c
@@ -7998,6 +7998,8 @@
     bt_regengine.expr = expr;
     nfa_regengine.expr = expr;
 #endif
+    // reg_iswordc() uses rex.reg_buf
+    rex.reg_buf = curbuf;
 
     /*
      * First try the NFA engine, unless backtracking was requested.

src/testdir/test_regexp_latin.vim

diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim
index 09104a1..d63b4f9 100644
--- a/src/testdir/test_regexp_latin.vim
+++ b/src/testdir/test_regexp_latin.vim
@@ -104,3 +104,19 @@
   s/^/[[=
   call assert_equal(1, search(getline(1)))
 endfunc
+
+func Test_rex_init()
+  set noincsearch
+  set re=1
+  new
+  setlocal iskeyword=a-z
+  call setline(1, ['abc', 'ABC'])
+  call assert_equal(1, search('[[:keyword:]]'))
+  new
+  setlocal iskeyword=A-Z
+  call setline(1, ['abc', 'ABC'])
+  call assert_equal(2, search('[[:keyword:]]'))
+  bwipe!
+  bwipe!
+  set re=0
+endfunc

src/version.c

diff --git a/src/version.c b/src/version.c
index dbf4083..8dd86f0 100644
--- a/src/version.c
+++ b/src/version.c
@@ -780,6 +780,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    935,
+/**/
     934,
 /**/
     933,