patch 9.1.0436: Crash when using '?' as separator for :s

Problem:  Crash when using '?' as separator for :s and pattern contains
          escaped '?'s (after 9.1.0409).
Solution: Always compute startplen. (zeertzjq).

related: neovim/neovim#28935
closes: 14832

Signed-off-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/src/regexp.c b/src/regexp.c
index d43193219126299b5e822410540b5fd5560d7e7e..147452aae27bea40c2cd1a2eae080305dd7831b7 100644 (file)
--- a/src/regexp.c
+++ b/src/regexp.c
@@ -620,6 +620,7 @@ skip_regexp_ex(
 {
     magic_T    mymagic;
     char_u     *p = startp;
+    size_t     startplen = STRLEN(startp);
 
     if (magic)
        mymagic = MAGIC_ON;
@@ -642,12 +643,9 @@ skip_regexp_ex(
        {
            if (dirc == '?' && newp != NULL && p[1] == '?')
            {
-               size_t  startplen = 0;
-
                // change "\?" to "?", make a copy first.
                if (*newp == NULL)
                {
-                   startplen = STRLEN(startp);
                    *newp = vim_strnsave(startp, startplen);
                    if (*newp != NULL)
                        p = *newp + (p - startp);

diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
index cf2c73fb954aff0156a4fa0a4a5dc7dc8943ba5e..a2367cd233d2522a241f5edcc2bab4b7137b082c 100644 (file)
--- a/src/testdir/test_substitute.vim
+++ b/src/testdir/test_substitute.vim
@@ -173,6 +173,16 @@ func Test_substitute_repeat()
   call feedkeys("Qsc\<CR>y", 'tx')
   bwipe!
 endfunc
+
+" Test :s with ? as separator.
+func Test_substitute_question_separator()
+  new
+  call setline(1, '??:??')
+  %s?\?\??!!?g
+  call assert_equal('!!:!!', getline(1))
+  bwipe!
+endfunc
+
 " Test %s/\n// which is implemented as a special case to use a
 " more efficient join rather than doing a regular substitution.
 func Test_substitute_join()

diff --git a/src/version.c b/src/version.c
index de9afee33fe5b33b56dd6830a2effe760cbf2ee3..98ec4754e5184867f24181300248f701963a1e81 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    436,
 /**/
     435,
 /**/