From: Bram Moolenaar <Bram@vim.org>
Date: Mon, 20 May 2013 11:44:29 +0000 (+0200)
Subject: updated for version 7.3.975
X-Git-Tag: v7.3.975
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=bc0ea8f75e3ddd96339db39d41540ad69c6488f6;p=vim

updated for version 7.3.975
Problem:    Crash in regexp parsing.
Solution:   Correctly compute the end of allocated memory.
---

diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c
index 92292e502..eea173816 100644
--- a/src/regexp_nfa.c
+++ b/src/regexp_nfa.c
@@ -231,14 +231,19 @@ nfa_regcomp_start(expr, re_flags)
     /* A reasonable estimation for size */
     nstate_max = (STRLEN(expr) + 1) * NFA_POSTFIX_MULTIPLIER;
 
-    /* Size for postfix representation of expr */
+    /* Some items blow up in size, such as [A-z].  Add more space for that.
+     * TODO: some patterns may still fail. */
+//    nstate_max += 1000;
+
+    /* Size for postfix representation of expr. */
     postfix_size = sizeof(*post_start) * nstate_max;
+
     post_start = (int *)lalloc(postfix_size, TRUE);
     if (post_start == NULL)
 	return FAIL;
     vim_memset(post_start, 0, postfix_size);
     post_ptr = post_start;
-    post_end = post_start + postfix_size;
+    post_end = post_start + nstate_max;
     nfa_has_zend = FALSE;
 
     regcomp_start(expr, re_flags);
diff --git a/src/version.c b/src/version.c
index 6c6b6509b..6f07a0416 100644
--- a/src/version.c
+++ b/src/version.c
@@ -728,6 +728,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    975,
 /**/
     974,
 /**/