From: Bram Moolenaar <Bram@vim.org>
Date: Sun, 30 Jan 2022 16:42:56 +0000 (+0000)
Subject: patch 8.2.4261: accessing invalid memory in a regular expression
X-Git-Tag: v8.2.4261
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=679d66c2d21dfe03d0f89b9a818b0aaebb4c3b87;p=vim

patch 8.2.4261: accessing invalid memory in a regular expression

Problem:    Accessing invalid memory when a regular expression checks the
            Visual area while matching in a string.
Solution:   Do not try matching the Visual area in a string.
---

diff --git a/src/regexp.c b/src/regexp.c
index c9e781b4a..950576555 100644
--- a/src/regexp.c
+++ b/src/regexp.c
@@ -1267,8 +1267,8 @@ reg_match_visual(void)
     colnr_T	cols;
     colnr_T	curswant;
 
-    // Check if the buffer is the current buffer.
-    if (rex.reg_buf != curbuf || VIsual.lnum == 0)
+    // Check if the buffer is the current buffer and not using a string.
+    if (rex.reg_buf != curbuf || VIsual.lnum == 0 || rex.reg_maxline == 0)
 	return FALSE;
 
     if (VIsual_active)
diff --git a/src/testdir/test_help.vim b/src/testdir/test_help.vim
index 3e358d6bb..b8b9bbc78 100644
--- a/src/testdir/test_help.vim
+++ b/src/testdir/test_help.vim
@@ -1,6 +1,7 @@
 " Tests for :help
 
 source check.vim
+import './vim9.vim' as v9
 
 func Test_help_restore_snapshot()
   help
@@ -168,5 +169,15 @@ func Test_help_long_argument()
   endtry
 endfunc
 
+func Test_help_using_visual_match()
+  let lines =<< trim END
+      call setline(1, ' ')
+      /^
+      exe "normal \<C-V>\<C-V>"
+      h5\%V€]
+  END
+  call v9.CheckScriptFailure(lines, 'E149:')
+endfunc
+
 
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index f696b3033..4946c3ee2 100644
--- a/src/version.c
+++ b/src/version.c
@@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4261,
 /**/
     4260,
 /**/