To: vim_dev@googlegroups.com
Subject: Patch 8.2.3428
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------

Patch 8.2.3428
Problem:    Using freed memory when replacing. (Dhiraj Mishra)
Solution:   Get the line pointer after calling ins_copychar().
Files:      src/normal.c, src/testdir/test_edit.vim


*** ../vim-8.2.3427/src/normal.c	2021-07-28 16:51:49.857364325 +0200
--- src/normal.c	2021-09-11 21:11:42.714541767 +0200
***************
*** 5099,5117 ****
  	    {
  		/*
  		 * Get ptr again, because u_save and/or showmatch() will have
! 		 * released the line.  At the same time we let know that the
! 		 * line will be changed.
  		 */
- 		ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
  		if (cap->nchar == Ctrl_E || cap->nchar == Ctrl_Y)
  		{
  		  int c = ins_copychar(curwin->w_cursor.lnum
  					   + (cap->nchar == Ctrl_Y ? -1 : 1));
  		  if (c != NUL)
  		    ptr[curwin->w_cursor.col] = c;
  		}
  		else
  		    ptr[curwin->w_cursor.col] = cap->nchar;
  		if (p_sm && msg_silent == 0)
  		    showmatch(cap->nchar);
  		++curwin->w_cursor.col;
--- 5099,5121 ----
  	    {
  		/*
  		 * Get ptr again, because u_save and/or showmatch() will have
! 		 * released the line.  This may also happen in ins_copychar().
! 		 * At the same time we let know that the line will be changed.
  		 */
  		if (cap->nchar == Ctrl_E || cap->nchar == Ctrl_Y)
  		{
  		  int c = ins_copychar(curwin->w_cursor.lnum
  					   + (cap->nchar == Ctrl_Y ? -1 : 1));
+ 
+ 		  ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
  		  if (c != NUL)
  		    ptr[curwin->w_cursor.col] = c;
  		}
  		else
+ 		{
+ 		    ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
  		    ptr[curwin->w_cursor.col] = cap->nchar;
+ 		}
  		if (p_sm && msg_silent == 0)
  		    showmatch(cap->nchar);
  		++curwin->w_cursor.col;
*** ../vim-8.2.3427/src/testdir/test_edit.vim	2021-06-12 13:46:38.055854976 +0200
--- src/testdir/test_edit.vim	2021-09-11 21:09:54.122510580 +0200
***************
*** 1895,1898 ****
--- 1895,1910 ----
    bw!
  endfunc
  
+ " Test for getting the character of the line below after "p"
+ func Test_edit_put_CTRL_E()
+   set encoding=latin1
+   new
+   let @" = ''
+   sil! norm orggRx
+   sil! norm pr
+   call assert_equal(['r', 'r'], getline(1, 2))
+   bwipe!
+   set encoding=utf-8
+ endfunc
+ 
  " vim: shiftwidth=2 sts=2 expandtab
*** ../vim-8.2.3427/src/version.c	2021-09-11 20:20:34.011127608 +0200
--- src/version.c	2021-09-11 20:33:42.105549551 +0200
***************
*** 757,758 ****
--- 757,760 ----
  {   /* Add new patch number below this line */
+ /**/
+     3428,
  /**/

-- 
hundred-and-one symptoms of being an internet addict:
28. You have comandeered your teenager's phone line for the net and even his
    friends know not to call on his line anymore.

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///                                                                      \\\
\\\        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///