From c3a02d78bd7a4622e85af348b24fb1388d160de1 Mon Sep 17 00:00:00 2001
From: Christian Brabandt <cb@256bit.org>
Date: Wed, 28 Aug 2024 23:17:52 +0200
Subject: [PATCH] patch 9.1.0701: crash with NFA regex engine when searching
 for composing chars

Problem:  crash with NFA regex engine when searching for composing chars
          (SuyueGuo)
Solution: When there is no composing character, break out of the loop
          and check that out1 state is not null

fixes: #15583

Signed-off-by: Christian Brabandt <cb@256bit.org>
---
 src/regexp_nfa.c                     |   3 ++-
 src/testdir/crash/nullptr_regexp_nfa | Bin 0 -> 429 bytes
 src/testdir/test_crash.vim           |   5 +++++
 src/version.c                        |   2 ++
 4 files changed, 9 insertions(+), 1 deletion(-)
 create mode 100644 src/testdir/crash/nullptr_regexp_nfa

diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c
index 6db4134628..557d0e1aac 100644
--- a/src/regexp_nfa.c
+++ b/src/regexp_nfa.c
@@ -6525,7 +6525,8 @@ nfa_regmatch(
 			else
 			    result = FAIL;
 
-			if (t->state->out->out1->c == NFA_END_COMPOSING)
+			if (t->state->out->out1 != NULL
+				&& t->state->out->out1->c == NFA_END_COMPOSING)
 			{
 			    end = t->state->out->out1;
 			    ADD_STATE_IF_MATCH(end);
diff --git a/src/testdir/crash/nullptr_regexp_nfa b/src/testdir/crash/nullptr_regexp_nfa
new file mode 100644
index 0000000000000000000000000000000000000000..6b2edc62a36f64d27231ae5eb2b7959cbcbd4510
GIT binary patch
literal 429
zc-qs`OU-=29HYRM_rF-!!rab}t2i?!HLpZ5FTW^veGtn_ku%$XK!B?_zeu69NPz*U
zFeN6rw5UABGA1w8p*U5+p(Z+w%L>Ry%}dTt$;?Z)HA<>1N!2YaNz*knQ%F_NHB`_x
zH2lvM&k&Z%6=lekQ_R4Xq74HL|8*NC0qM+{mU;Olx{10asYSU-5)$$ZSj^?Z4uB?>
zDLhQ!bIwe&jE$*DE6vlgNXjhH%{SmmY-n{(is9xevy6&1&`lIe)Jl%gj;XOQ&;_YX
zG>?m^iBWa-aCP=}_V*3&5A|~iat(O*PVn73#&_@D)j;(m#k>Q7yiC>F;*^w>)U@mv
zpeewB0tZEAo^}j|p{Wo<GjdXaGSOMZ`FV@9&MeT<|0j@Gl%B)K#|8@F#GL9XO!E!3
QL8e7ROv?r9H^>EI0M?n38vp<R

literal 0
Hc-jL100001

diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim
index e741a18b4d..bfd04ff10f 100644
--- a/src/testdir/test_crash.vim
+++ b/src/testdir/test_crash.vim
@@ -228,6 +228,11 @@ func Test_crash1_3()
   call term_sendkeys(buf, args)
   call TermWait(buf, 50)
 
+  let file = 'crash/nullptr_regexp_nfa'
+  let cmn_args = "%s -u NONE -i NONE -n -X -m -n -e -s -S %s -c ':qa!'"
+  let args = printf(cmn_args, vim, file)
+  call term_sendkeys(buf, args)
+  call TermWait(buf, 50)
 
   " clean up
   exe buf .. "bw!"
diff --git a/src/version.c b/src/version.c
index 59bd3fcdcc..5dfb313d25 100644
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    701,
 /**/
     700,
 /**/
-- 
2.47.2