patch 8.0.1475: invalid memory access in read_redo()
Problem: Invalid memory access in read_redo(). (gy741)
Solution: Convert the replacement character back from a negative number to
CR or NL. (hint by Dominique Pelle, closes #2616)
diff --git a/src/normal.c b/src/normal.c
index 745a2f6..79e0b68 100644
--- a/src/normal.c
+++ b/src/normal.c
@@ -1685,11 +1685,19 @@
get_op_char(oap->op_type), get_extra_op_char(oap->op_type),
oap->motion_force, cap->cmdchar, cap->nchar);
else if (cap->cmdchar != ':')
+ {
+ int nchar = oap->op_type == OP_REPLACE ? cap->nchar : NUL;
+
+ /* reverse what nv_replace() did */
+ if (nchar == REPLACE_CR_NCHAR)
+ nchar = CAR;
+ else if (nchar == REPLACE_NL_NCHAR)
+ nchar = NL;
prep_redo(oap->regname, 0L, NUL, 'v',
get_op_char(oap->op_type),
get_extra_op_char(oap->op_type),
- oap->op_type == OP_REPLACE
- ? cap->nchar : NUL);
+ nchar);
+ }
if (!redo_VIsual_busy)
{
redo_VIsual_mode = resel_VIsual_mode;
@@ -7023,10 +7031,12 @@
reset_VIsual();
if (had_ctrl_v)
{
- if (cap->nchar == '\r')
- cap->nchar = -1;
- else if (cap->nchar == '\n')
- cap->nchar = -2;
+ /* Use a special (negative) number to make a difference between a
+ * literal CR or NL and a line break. */
+ if (cap->nchar == CAR)
+ cap->nchar = REPLACE_CR_NCHAR;
+ else if (cap->nchar == NL)
+ cap->nchar = REPLACE_NL_NCHAR;
}
nv_operator(cap);
return;