patch 8.2.5126: substitute may overrun destination buffer

Problem:    Substitute may overrun destination buffer.
Solution:   Disallow switching buffers in a substitute expression.

diff --git a/src/ex_docmd.c b/src/ex_docmd.c
index fed9330b52e92e1206eb519942ea1e4879cfa9d7..1185cd1550a61812b02f930c04f2e1f3f7154157 100644 (file)
--- a/src/ex_docmd.c
+++ b/src/ex_docmd.c
@@ -7138,9 +7138,10 @@ do_exedit(
 #endif
            )
     {
-       // Can't edit another file when "curbuf_lock" is set.  Only ":edit"
-       // can bring us here, others are stopped earlier.
-       if (*eap->arg != NUL && curbuf_locked())
+       // Can't edit another file when "textlock" or "curbuf_lock" is set.
+       // Only ":edit" or ":script" can bring us here, others are stopped
+       // earlier.
+       if (*eap->arg != NUL && text_or_buf_locked())
            return;
 
        n = readonlymode;

diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
index 46ea95513192862229443c821e9945590de99622..c056fa9656929b2ac052b42912d78a75ac0e5e2e 100644 (file)
--- a/src/testdir/test_substitute.vim
+++ b/src/testdir/test_substitute.vim
@@ -1063,6 +1063,19 @@ func Test_sub_open_cmdline_win()
   call delete('Xresult')
 endfunc
 
+" This was editing a script file from the expression
+func Test_sub_edit_scriptfile()
+  new
+  norm o0000000000000000000000000000000000000000000000000000
+  func EditScript()
+    silent! scr! Xfile
+  endfunc
+  s/\%')/\=EditScript()
+
+  delfunc EditScript
+  bwipe!
+endfunc
+
 " Test for the 2-letter and 3-letter :substitute commands
 func Test_substitute_short_cmd()
   new

diff --git a/src/version.c b/src/version.c
index 82ac4eaf2dd99eceb9043f1a787e11725fb23851..2f397ae315f7c9f86f69a6752e2b5610d805177d 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -734,6 +734,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    5126,
 /**/
     5125,
 /**/