patch 9.1.0701: crash with NFA regex engine when searching for composing chars

Problem:  crash with NFA regex engine when searching for composing chars
          (SuyueGuo)
Solution: When there is no composing character, break out of the loop
          and check that out1 state is not null

fixes: #15583

Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c
index 6db4134628710fa2a45e4fe80377cdabda575b8b..557d0e1aac66bdeaca10e39c616c0268cad95e31 100644 (file)
--- a/src/regexp_nfa.c
+++ b/src/regexp_nfa.c
@@ -6525,7 +6525,8 @@ nfa_regmatch(
                        else
                            result = FAIL;
 
-                       if (t->state->out->out1->c == NFA_END_COMPOSING)
+                       if (t->state->out->out1 != NULL
+                               && t->state->out->out1->c == NFA_END_COMPOSING)
                        {
                            end = t->state->out->out1;
                            ADD_STATE_IF_MATCH(end);

diff --git a/src/testdir/crash/nullptr_regexp_nfa b/src/testdir/crash/nullptr_regexp_nfa
new file mode 100644 (file)
index 0000000..6b2edc6
Binary files /dev/null and b/src/testdir/crash/nullptr_regexp_nfa differ

diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim
index e741a18b4d354b4b0853ce683b873b97b5d3377a..bfd04ff10f9a1bb6e04913e7e2e984b76bd39c1e 100644 (file)
--- a/src/testdir/test_crash.vim
+++ b/src/testdir/test_crash.vim
@@ -228,6 +228,11 @@ func Test_crash1_3()
   call term_sendkeys(buf, args)
   call TermWait(buf, 50)
 
+  let file = 'crash/nullptr_regexp_nfa'
+  let cmn_args = "%s -u NONE -i NONE -n -X -m -n -e -s -S %s -c ':qa!'"
+  let args = printf(cmn_args, vim, file)
+  call term_sendkeys(buf, args)
+  call TermWait(buf, 50)
 
   " clean up
   exe buf .. "bw!"

diff --git a/src/version.c b/src/version.c
index 59bd3fcdcce146ef405a4a53e2d11d1ed25801c3..5dfb313d25b46820b784d8486ee4126370d439dd 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    701,
 /**/
     700,
 /**/