patch 7.4.2235

Problem:    submatch() does not check for a valid argument.
Solution:   Give an error if the argument is out of range. (Dominique Pelle)

diff --git a/src/evalfunc.c b/src/evalfunc.c
index 53d3d752ecae034cbe21a8e9afaa75653a3a7efe..599a3d6db1f1c07f88cf2489c32493113eadc66b 100644 (file)
--- a/src/evalfunc.c
+++ b/src/evalfunc.c
@@ -11491,7 +11491,11 @@ f_submatch(typval_T *argvars, typval_T *rettv)
     no = (int)get_tv_number_chk(&argvars[0], &error);
     if (error)
        return;
-    error = FALSE;
+    if (no < 0 || no >= NSUBEXP)
+    {
+        EMSGN(_("E935: invalid submatch number: %d"), no);
+        return;
+    }
     if (argvars[1].v_type != VAR_UNKNOWN)
        retList = (int)get_tv_number_chk(&argvars[1], &error);
     if (error)

diff --git a/src/testdir/test_expr.vim b/src/testdir/test_expr.vim
index 76811255aa03a69c08e44a3cb3c1d81ca2754f7c..b23b4490bbead0746c9c11fd4a436641933f5f07 100644 (file)
--- a/src/testdir/test_expr.vim
+++ b/src/testdir/test_expr.vim
@@ -198,6 +198,11 @@ func Test_substitute_expr()
   call assert_equal('--', substitute('xxx', 'x*', {-> '-' . Recurse() . '-'}, ''))
 endfunc
 
+func Test_invalid_submatch()
+  " This was causing invalid memory access in Vim-7.4.2232 and older
+  call assert_fails("call substitute('x', '.', {-> submatch(10)}, '')", 'E935:')
+endfunc
+
 func Test_substitute_expr_arg()
   call assert_equal('123456789-123456789=', substitute('123456789',
        \ '\(.\)\(.\)\(.\)\(.\)\(.\)\(.\)\(.\)\(.\)\(.\)',

diff --git a/src/version.c b/src/version.c
index e9ce5971ea3b3a422c6a2db0ad41bd67851cf4f8..65eb6d7c0682dc0a4349a1d7f77bc210377bcd60 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -763,6 +763,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2235,
 /**/
     2234,
 /**/