patch 9.2.0526: missing out-of-memory check in ex_substitute()

Problem:  missing out-of-memory check in ex_substitute()
Solution: Bail out in case of out-of-memory (John Marriott)

closes: #20308

Signed-off-by: John Marriott <basilisk@internode.on.net>
Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/src/ex_cmds.c b/src/ex_cmds.c
index 7cf63adaf9a2f6c7641d893c607403163d1fa51b..3a598ddfa099f3f54814a2f924fdd910ae9f5038 100644 (file)
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -4144,6 +4144,8 @@ ex_substitute(exarg_T *eap)
        pat = NULL;             // search_regcomp() will use previous pattern
        patlen = 0;
        sub = vim_strsave(old_sub);
+       if (sub == NULL)
+           return;
 
        // Vi compatibility quirk: repeating with ":s" keeps the cursor in the
        // last column after using "$".
@@ -5003,6 +5005,12 @@ ex_substitute(exarg_T *eap)
                    vim_free(sub_firstline);
                    sub_firstline = vim_strnsave(ml_get(sub_firstlnum),
                                                    ml_get_len(sub_firstlnum));
+                   if (sub_firstline == NULL)
+                   {
+                       vim_free(new_start);
+                       goto outofmem;
+                   }
+
                    // When going beyond the last line, stop substituting.
                    if (sub_firstlnum <= line2)
                        do_again = TRUE;
@@ -5019,6 +5027,11 @@ ex_substitute(exarg_T *eap)
                    // less than what it ought to be.
                    vim_free(sub_firstline);
                    sub_firstline = vim_strsave((char_u *)"");
+                   if (sub_firstline == NULL)
+                   {
+                       vim_free(new_start);
+                       goto outofmem;
+                   }
                    copycol = 0;
                }
 

diff --git a/src/version.c b/src/version.c
index 175d7ab57ceb46ea507b35dde884f2373415adc3..91bfa5761c3c41a93c8b51a23b3ce536ddcb2099 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -729,6 +729,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    526,
 /**/
     525,
 /**/