neovim

commit c416da9d1a41b919412d88aecf827aebb8ea973b
parent 8aece0089dab9d1d22462de8a36bba2ee3fa1188
Author: zeertzjq <zeertzjq@outlook.com>
Date:   Tue, 17 Jan 2023 20:15:42 +0800

vim-patch:8.2.5126: substitute may overrun destination buffer

Problem:    Substitute may overrun destination buffer.
Solution:   Disallow switching buffers in a substitute expression.

https://github.com/vim/vim/commit/d6211a52ab9f53b82f884561ed43d2fe4d24ff7d

Co-authored-by: Bram Moolenaar <Bram@vim.org>

Diffstat:
M
src/nvim/ex_docmd.c
 | 
6
+++---
M
src/nvim/testdir/test_substitute.vim
 | 
13
+++++++++++++

2 files changed, 16 insertions(+), 3 deletions(-)
diff --git a/src/nvim/ex_docmd.c b/src/nvim/ex_docmd.c
@@ -5249,9 +5249,9 @@ void do_exedit(exarg_T *eap, win_T *old_curwin)
                   old_curwin == NULL ? curwin : NULL);
   } else if ((eap->cmdidx != CMD_split && eap->cmdidx != CMD_vsplit)
              || *eap->arg != NUL) {
-    // Can't edit another file when "curbuf->b_ro_locked" is set.  Only ":edit"
-    // can bring us here, others are stopped earlier.
-    if (*eap->arg != NUL && curbuf_locked()) {
+    // Can't edit another file when "textlock" or "curbuf->b_ro_locked" is set.
+    // Only ":edit" or ":script" can bring us here, others are stopped earlier.
+    if (*eap->arg != NUL && text_or_buf_locked()) {
       return;
     }
     n = readonlymode;
diff --git a/src/nvim/testdir/test_substitute.vim b/src/nvim/testdir/test_substitute.vim
@@ -1076,6 +1076,19 @@ func Test_sub_open_cmdline_win()
   call delete('Xresult')
 endfunc
 
+" This was editing a script file from the expression
+func Test_sub_edit_scriptfile()
+  new
+  norm o0000000000000000000000000000000000000000000000000000
+  func EditScript()
+    silent! scr! Xfile
+  endfunc
+  s/\%')/\=EditScript()
+
+  delfunc EditScript
+  bwipe!
+endfunc
+
 " Test for the 2-letter and 3-letter :substitute commands
 func Test_substitute_short_cmd()
   new