Patch 7.3.1280
Problem: Reading memory already freed since patch 7.3.1247. (Simon
Ruderich, Dominique Pelle)
Solution: Copy submatches before reallocating the state list.
Files: src/regexp_nfa.c
*** ../vim-7.3.1279/src/regexp_nfa.c 2013-06-30 13:17:18.000000000 +0200
--- src/regexp_nfa.c 2013-06-30 23:17:46.000000000 +0200
***************
*** 3538,3544 ****
static int match_backref __ARGS((regsub_T *sub, int subidx, int *bytelen));
static int has_state_with_pos __ARGS((nfa_list_T *l, nfa_state_T *state,
regsubs_T *subs));
static int state_in_list __ARGS((nfa_list_T *l, nfa_state_T *state, regsubs_T
*subs));
! static void addstate __ARGS((nfa_list_T *l, nfa_state_T *state, regsubs_T
*subs, nfa_pim_T *pim, int off));
static void addstate_here __ARGS((nfa_list_T *l, nfa_state_T *state,
regsubs_T *subs, nfa_pim_T *pim, int *ip));
/*
--- 3538,3544 ----
static int match_backref __ARGS((regsub_T *sub, int subidx, int *bytelen));
static int has_state_with_pos __ARGS((nfa_list_T *l, nfa_state_T *state,
regsubs_T *subs));
static int state_in_list __ARGS((nfa_list_T *l, nfa_state_T *state, regsubs_T
*subs));
! static regsubs_T *addstate __ARGS((nfa_list_T *l, nfa_state_T *state,
regsubs_T *subs_arg, nfa_pim_T *pim, int off));
static void addstate_here __ARGS((nfa_list_T *l, nfa_state_T *state,
regsubs_T *subs, nfa_pim_T *pim, int *ip));
/*
***************
*** 3832,3844 ****
return FALSE;
}
! static void
! addstate(l, state, subs, pim, off)
! nfa_list_T *l; /* runtime state list */
! nfa_state_T *state; /* state to update */
! regsubs_T *subs; /* pointers to subexpressions */
! nfa_pim_T *pim; /* postponed look-behind match */
! int off; /* byte offset, when -1 go to next line
*/
{
int subidx;
nfa_thread_T *thread;
--- 3832,3849 ----
return FALSE;
}
! /*
! * Add "state" and possibly what follows to state list ".".
! * Returns "subs_arg", possibly copied into temp_subs.
! */
!
! static regsubs_T *
! addstate(l, state, subs_arg, pim, off)
! nfa_list_T *l; /* runtime state list */
! nfa_state_T *state; /* state to update */
! regsubs_T *subs_arg; /* pointers to subexpressions */
! nfa_pim_T *pim; /* postponed look-behind match */
! int off; /* byte offset, when -1 go to next
line */
{
int subidx;
nfa_thread_T *thread;
***************
*** 3847,3852 ****
--- 3852,3859 ----
char_u *save_ptr;
int i;
regsub_T *sub;
+ regsubs_T *subs = subs_arg;
+ static regsubs_T temp_subs;
#ifdef ENABLE_LOG
int did_print = FALSE;
#endif
***************
*** 3941,3947 ****
fprintf(log_fd, "> Not adding state %d to list %d. char %d:
%s\n",
abs(state->id), l->id, state->c, code);
#endif
! return;
}
/* Do not add the state again when it exists with the same
--- 3948,3954 ----
fprintf(log_fd, "> Not adding state %d to list %d. char %d:
%s\n",
abs(state->id), l->id, state->c, code);
#endif
! return subs;
}
/* Do not add the state again when it exists with the same
***************
*** 3956,3961 ****
--- 3963,3980 ----
{
int newlen = l->len * 3 / 2 + 50;
+ if (subs != &temp_subs)
+ {
+ /* "subs" may point into the current array, need to make a
+ * copy before it becomes invalid. */
+ copy_sub(&temp_subs.norm, &subs->norm);
+ #ifdef FEAT_SYN_HL
+ if (nfa_has_zsubexpr)
+ copy_sub(&temp_subs.synt, &subs->synt);
+ #endif
+ subs = &temp_subs;
+ }
+
l->t = vim_realloc(l->t, newlen * sizeof(nfa_thread_T));
l->len = newlen;
}
***************
*** 3991,4004 ****
case NFA_SPLIT:
/* order matters here */
! addstate(l, state->out, subs, pim, off);
! addstate(l, state->out1, subs, pim, off);
break;
case NFA_SKIP_CHAR:
case NFA_NOPEN:
case NFA_NCLOSE:
! addstate(l, state->out, subs, pim, off);
break;
case NFA_MOPEN:
--- 4010,4023 ----
case NFA_SPLIT:
/* order matters here */
! subs = addstate(l, state->out, subs, pim, off);
! subs = addstate(l, state->out1, subs, pim, off);
break;
case NFA_SKIP_CHAR:
case NFA_NOPEN:
case NFA_NCLOSE:
! subs = addstate(l, state->out, subs, pim, off);
break;
case NFA_MOPEN:
***************
*** 4094,4100 ****
sub->list.line[subidx].start = reginput + off;
}
! addstate(l, state->out, subs, pim, off);
if (save_in_use == -1)
{
--- 4113,4119 ----
sub->list.line[subidx].start = reginput + off;
}
! subs = addstate(l, state->out, subs, pim, off);
if (save_in_use == -1)
{
***************
*** 4112,4118 ****
{
/* Do not overwrite the position set by \ze. If no \ze
* encountered end will be set in nfa_regtry(). */
! addstate(l, state->out, subs, pim, off);
break;
}
case NFA_MCLOSE1:
--- 4131,4137 ----
{
/* Do not overwrite the position set by \ze. If no \ze
* encountered end will be set in nfa_regtry(). */
! subs = addstate(l, state->out, subs, pim, off);
break;
}
case NFA_MCLOSE1:
***************
*** 4181,4187 ****
sub->list.line[subidx].end = reginput + off;
}
! addstate(l, state->out, subs, pim, off);
if (REG_MULTI)
sub->list.multi[subidx].end = save_lpos;
--- 4200,4206 ----
sub->list.line[subidx].end = reginput + off;
}
! subs = addstate(l, state->out, subs, pim, off);
if (REG_MULTI)
sub->list.multi[subidx].end = save_lpos;
***************
*** 4190,4195 ****
--- 4209,4215 ----
sub->in_use = save_in_use;
break;
}
+ return subs;
}
/*
*** ../vim-7.3.1279/src/version.c 2013-06-30 22:43:22.000000000 +0200
--- src/version.c 2013-06-30 23:23:02.000000000 +0200
***************
*** 730,731 ****
--- 730,733 ----
{ /* Add new patch number below this line */
+ /**/
+ 1280,
/**/
--
DENNIS: Listen -- strange women lying in ponds distributing swords is no
basis for a system of government. Supreme executive power derives
from a mandate from the masses, not from some farcical aquatic
ceremony.
The Quest for the Holy Grail (Monty Python)
/// Bram Moolenaar -- [email protected] -- http://www.Moolenaar.net \\\
/// sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\ an exciting new programming language -- http://www.Zimbu.org ///
\\\ help me help AIDS victims -- http://ICCF-Holland.org ///
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
