procyberian/emacs
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Avoid crashes when buffer modification hooks clobber match data

Browse source 
* src/search.c (Freplace_match): Error out if buffer modification
hooks triggered by buffer changes in replace_range, upcase-region,
and upcase-initials-region clobber the match data needed to be
adjusted for the replacement.  (Bug#23869)
This commit is contained in:
Eli Zaretskii 2016-07-04 18:34:40 +03:00
parent 178b2f5909
commit 3a9d6296b3
1 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/search.c
View file

@ -2684,6 +2684,14 @@ since only regular expressions have distinguished subexpressions. */)
xfree (substed); xfree (substed);
} }
/* The functions below modify the buffer, so they could trigger
various modification hooks (see signal_before_change and
signal_after_change), which might clobber the match data we need
to adjust after the replacement. If that happens, we error out. */
ptrdiff_t sub_start = search_regs.start[sub];
ptrdiff_t sub_end = search_regs.end[sub];
unsigned num_regs = search_regs.num_regs;
/* Replace the old text with the new in the cleanest possible way. */ /* Replace the old text with the new in the cleanest possible way. */
replace_range (search_regs.start[sub], search_regs.end[sub], replace_range (search_regs.start[sub], search_regs.end[sub],
newtext, 1, 0, 1); newtext, 1, 0, 1);
@ -2696,6 +2704,11 @@ since only regular expressions have distinguished subexpressions. */)
Fupcase_initials_region (make_number (search_regs.start[sub]), Fupcase_initials_region (make_number (search_regs.start[sub]),
make_number (newpoint)); make_number (newpoint));
if (search_regs.start[sub] != sub_start
|| search_regs.end[sub] != sub_end
|| search_regs.num_regs != num_regs)
error ("Match data clobbered by buffer modification hooks");
/* Adjust search data for this change. */ /* Adjust search data for this change. */
{ {
ptrdiff_t oldend = search_regs.end[sub]; ptrdiff_t oldend = search_regs.end[sub];