vim crash after calling vimSearchGetHighlights after a canceled visual search/replace about libvim HOT 5 CLOSED

Woohoo! Thanks @bryphe! I'll pick up the latest and get this into my project.

from libvim.

I am debugging into vim_regcomp to see if I can track down the issue

from libvim.

vim_regcomp's signature is regprog_T * vim_regcomp(char_u *expr_arg, int re_flags)

and adding printf("expr_arg: %s\n", expr_arg); as the first line of the function causes the stack trace to start from printf. Since the error says heap-use-after-free and the test does vimKey("<esc>"), I believe what might be happening it is using the same char pointer for the search pattern, but it was freed due to pressing esc.

from libvim.

I worked around this by keeping track of whether search is active or not before calling vimSearchGetHighlights. I am pretty sure the issue is using the pointer to the search pattern after it was freed. But fixing this seems difficult. vim copies this pointer to several places and keeping track of it is not easy.

I think vimSearchGetHighlights and vimSearchGetPattern are both potentially unsafe due to this.

from libvim.

Awesome @city41 ! Let me know if you find any more issues - thanks again for the great repro 👍

from libvim.