patch 8.0.0374: invalid memory access when using :sc in Ex mode

Problem:    Invalid memory access when using :sc in Ex mode. (Dominique Pelle)
Solution:   Avoid the column being negative.  Also fix a hang in Ex mode.

diff --git a/src/ex_cmds.c b/src/ex_cmds.c
index 5b118e564c747eb1df64bb44c76ddab2cd815718..c38687d740d6b1d56ed342678dd2b1a6ce3e069c 100644 (file)
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -5288,6 +5288,8 @@ do_sub(exarg_T *eap)
 
                            getvcol(curwin, &curwin->w_cursor, &sc, NULL, NULL);
                            curwin->w_cursor.col = regmatch.endpos[0].col - 1;
+                           if (curwin->w_cursor.col < 0)
+                               curwin->w_cursor.col = 0;
                            getvcol(curwin, &curwin->w_cursor, NULL, NULL, &ec);
                            if (subflags.do_number || curwin->w_p_nu)
                            {

diff --git a/src/ex_getln.c b/src/ex_getln.c
index 3c40ff79aa66658d0cffea5082c00ca34893de61..91803191484412378e2d01a4591fbb3ebdcd4bec 100644 (file)
--- a/src/ex_getln.c
+++ b/src/ex_getln.c
@@ -2369,9 +2369,16 @@ getexmodeline(
        if (ga_grow(&line_ga, 40) == FAIL)
            break;
 
-       /* Get one character at a time. */
+       /*
+        * Get one character at a time.
+        */
        prev_char = c1;
-       c1 = vgetc();
+
+       /* Check for a ":normal" command and no more characters left. */
+       if (ex_normal_busy > 0 && typebuf.tb_len == 0)
+           c1 = '\n';
+       else
+           c1 = vgetc();
 
        /*
         * Handle line editing.

diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
index a3bc04dcd024372658ba4f41cb289df7346e077d..f2dfdc70191c6c6679ac00127b3bbf1e280ea62c 100644 (file)
--- a/src/testdir/test_substitute.vim
+++ b/src/testdir/test_substitute.vim
@@ -106,3 +106,11 @@ function! Test_substitute_variants()
     endfor
   endfor
 endfunction
+
+func Test_substitute_repeat()
+  " This caused an invalid memory access.
+  split Xfile
+  s/^/x
+  call feedkeys("Qsc\<CR>y", 'tx')
+  bwipe!
+endfunc

diff --git a/src/version.c b/src/version.c
index b008d140880fed0f220b256766b63b72bcf0df0c..b96daff1cbd20ceda8e39bf1cb1fe5ab9908c0b2 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -764,6 +764,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    374,
 /**/
     373,
 /**/