patch 9.0.0947: invalid memory access in substitute with function

Problem:    Invalid memory access in substitute with function that goes to
            another file.
Solution:   Check for text locked in CTRL-W gf.

diff --git a/src/normal.c b/src/normal.c
index 938ae718efa265a8941b0b01f7e5af202c7bd0fc..0d1eba759e698462fdf443d45831e2138a652234 100644 (file)
--- a/src/normal.c
+++ b/src/normal.c
@@ -188,13 +188,33 @@ check_text_locked(oparg_T *oap)
 {
     if (text_locked())
     {
-       clearopbeep(oap);
+       if (oap != NULL)
+           clearopbeep(oap);
        text_locked_msg();
        return TRUE;
     }
     return FALSE;
 }
 
+/*
+ * If text is locked, "curbuf_lock" or "allbuf_lock" is set:
+ * Give an error message, possibly beep and return TRUE.
+ * "oap" may be NULL.
+ */
+    int
+check_text_or_curbuf_locked(oparg_T *oap)
+{
+    if (check_text_locked(oap))
+       return TRUE;
+    if (curbuf_locked())
+    {
+       if (oap != NULL)
+           clearop(oap);
+       return TRUE;
+    }
+    return FALSE;
+}
+
 /*
  * Handle the count before a normal command and set cap->count0.
  */
@@ -798,8 +818,7 @@ normal_cmd(
        goto normal_end;
     }
 
-    if ((nv_cmds[idx].cmd_flags & NV_NCW)
-                               && (check_text_locked(oap) || curbuf_locked()))
+    if ((nv_cmds[idx].cmd_flags & NV_NCW) && check_text_or_curbuf_locked(oap))
        // this command is not allowed now
        goto normal_end;
 
@@ -4026,13 +4045,9 @@ nv_gotofile(cmdarg_T *cap)
     char_u     *ptr;
     linenr_T   lnum = -1;
 
-    if (check_text_locked(cap->oap))
-       return;
-    if (curbuf_locked())
-    {
-       clearop(cap->oap);
+    if (check_text_or_curbuf_locked(cap->oap))
        return;
-    }
+
 #ifdef FEAT_PROP_POPUP
     if (ERROR_IF_TERM_POPUP_WINDOW)
        return;

diff --git a/src/proto/normal.pro b/src/proto/normal.pro
index 106d0e1395ba995b4ae76b22eb8ff9b79611dd1c..eff08dfa8b71b121dcccdf584f504cd04bad53fc 100644 (file)
--- a/src/proto/normal.pro
+++ b/src/proto/normal.pro
@@ -1,4 +1,5 @@
 /* normal.c */
+int check_text_or_curbuf_locked(oparg_T *oap);
 void normal_cmd(oparg_T *oap, int toplevel);
 void check_visual_highlight(void);
 void end_visual_mode(void);

diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
index 67df60ff90753c49d6748590161820996eaa9798..25132233720130e68ba855dff3bfd0bec8298297 100644 (file)
--- a/src/testdir/test_substitute.vim
+++ b/src/testdir/test_substitute.vim
@@ -1096,6 +1096,25 @@ func Test_sub_edit_scriptfile()
   bwipe!
 endfunc
 
+" This was editing another file from the expression.
+func Test_sub_expr_goto_other_file()
+  call writefile([''], 'Xfileone', 'D')
+  enew!
+  call setline(1, ['a', 'b', 'c', 'd',
+       \ 'Xfileone zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz'])
+
+  func g:SplitGotoFile()
+    exe "sil! norm 0\<C-W>gf"
+    return ''
+  endfunc
+
+  $
+  s/\%')/\=g:SplitGotoFile()
+
+  delfunc g:SplitGotoFile
+  bwipe!
+endfunc
+
 " Test for the 2-letter and 3-letter :substitute commands
 func Test_substitute_short_cmd()
   new

diff --git a/src/version.c b/src/version.c
index 0c3194c05dc1d50b3dad5d21e58ca9fbbeb53909..5686005f34d23de6d3e784efd339ff6e366bc7ff 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -695,6 +695,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    947,
 /**/
     946,
 /**/

diff --git a/src/window.c b/src/window.c
index 97cc77035f954ef9365f0ba469bd54fcf56b08f4..a2bebcaea4dfb57142928e57bb716830c25cad06 100644 (file)
--- a/src/window.c
+++ b/src/window.c
@@ -567,6 +567,8 @@ newwindow:
     case Ctrl_F:
 wingotofile:
                CHECK_CMDWIN;
+               if (check_text_or_curbuf_locked(NULL))
+                   break;
 
                ptr = grab_file_name(Prenum1, &lnum);
                if (ptr != NULL)
@@ -885,7 +887,7 @@ win_split(int size, int flags)
  * When "new_wp" is NULL: split the current window in two.
  * When "new_wp" is not NULL: insert this window at the far
  * top/left/right/bottom.
- * return FAIL for failure, OK otherwise
+ * Return FAIL for failure, OK otherwise.
  */
     int
 win_split_ins(