From: Bram Moolenaar <Bram@vim.org>
Date: Sun, 26 Feb 2017 13:00:07 +0000 (+0100)
Subject: patch 8.0.0374: invalid memory access when using :sc in Ex mode
X-Git-Tag: v8.0.0374
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ba748c8a847561c043a63827bcb1d98bdebe16e6;p=vim

patch 8.0.0374: invalid memory access when using :sc in Ex mode

Problem:    Invalid memory access when using :sc in Ex mode. (Dominique Pelle)
Solution:   Avoid the column being negative.  Also fix a hang in Ex mode.
---

diff --git a/src/ex_cmds.c b/src/ex_cmds.c
index 5b118e564..c38687d74 100644
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -5288,6 +5288,8 @@ do_sub(exarg_T *eap)
 
 			    getvcol(curwin, &curwin->w_cursor, &sc, NULL, NULL);
 			    curwin->w_cursor.col = regmatch.endpos[0].col - 1;
+			    if (curwin->w_cursor.col < 0)
+				curwin->w_cursor.col = 0;
 			    getvcol(curwin, &curwin->w_cursor, NULL, NULL, &ec);
 			    if (subflags.do_number || curwin->w_p_nu)
 			    {
diff --git a/src/ex_getln.c b/src/ex_getln.c
index 3c40ff79a..918031914 100644
--- a/src/ex_getln.c
+++ b/src/ex_getln.c
@@ -2369,9 +2369,16 @@ getexmodeline(
 	if (ga_grow(&line_ga, 40) == FAIL)
 	    break;
 
-	/* Get one character at a time. */
+	/*
+	 * Get one character at a time.
+	 */
 	prev_char = c1;
-	c1 = vgetc();
+
+	/* Check for a ":normal" command and no more characters left. */
+	if (ex_normal_busy > 0 && typebuf.tb_len == 0)
+	    c1 = '\n';
+	else
+	    c1 = vgetc();
 
 	/*
 	 * Handle line editing.
diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
index a3bc04dcd..f2dfdc701 100644
--- a/src/testdir/test_substitute.vim
+++ b/src/testdir/test_substitute.vim
@@ -106,3 +106,11 @@ function! Test_substitute_variants()
     endfor
   endfor
 endfunction
+
+func Test_substitute_repeat()
+  " This caused an invalid memory access.
+  split Xfile
+  s/^/x
+  call feedkeys("Qsc\<CR>y", 'tx')
+  bwipe!
+endfunc
diff --git a/src/version.c b/src/version.c
index b008d1408..b96daff1c 100644
--- a/src/version.c
+++ b/src/version.c
@@ -764,6 +764,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    374,
 /**/
     373,
 /**/