commit e2bd8600b873d2cd1f9d667c28cba8b1dba18839
author Bram Moolenaar <Bram@vim.org> Wed May 18 13:11:57 2022 +0100
committer Bram Moolenaar <Bram@vim.org> Wed May 18 13:11:57 2022 +0100
tree 64b679c01edbe4d0c1e131f0f132fd66bd2c1bcf
parent b1040dc11fa15818eda724c35a334f460cf98005

patch 8.2.4977: memory access error when substitute expression changes window

Problem:    Memory access error when substitute expression changes window.
Solution:   Disallow changing window in substitute expression.

src/ex_cmds.c

diff --git a/src/ex_cmds.c b/src/ex_cmds.c
index 7e730be..210e21f 100644
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -4412,12 +4412,17 @@
 		// Save flags for recursion.  They can change for e.g.
 		// :s/^/\=execute("s#^##gn")
 		subflags_save = subflags;
+
+		// Disallow changing text or switching window in an expression.
+		++textwinlock;
 #endif
 		// get length of substitution part
 		sublen = vim_regsub_multi(&regmatch,
 				    sub_firstlnum - regmatch.startpos[0].lnum,
 			       sub, sub_firstline, FALSE, magic_isset(), TRUE);
 #ifdef FEAT_EVAL
+		--textwinlock;
+
 		// If getting the substitute string caused an error, don't do
 		// the replacement.
 		// Don't keep flags set by a recursive call.
@@ -4518,9 +4523,15 @@
 		mch_memmove(new_end, sub_firstline + copycol, (size_t)copy_len);
 		new_end += copy_len;
 
+#ifdef FEAT_EVAL
+		++textwinlock;
+#endif
 		(void)vim_regsub_multi(&regmatch,
 				    sub_firstlnum - regmatch.startpos[0].lnum,
 				      sub, new_end, TRUE, magic_isset(), TRUE);
+#ifdef FEAT_EVAL
+		--textwinlock;
+#endif
 		sub_nsubs++;
 		did_sub = TRUE;