From b55986c52d4cd88a22d0b0b0e8a79547ba13e1d5 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Tue, 29 Mar 2022 13:24:58 +0100
Subject: [PATCH] patch 8.2.4646: using buffer line after it has been freed

Problem:    Using buffer line after it has been freed in old regexp engine.
Solution:   After getting mark get the line again.
---
 src/regexp_bt.c                   | 9 +++++++++
 src/testdir/test_regexp_latin.vim | 7 +++++++
 2 files changed, 16 insertions(+)

diff --git a/src/regexp_bt.c b/src/regexp_bt.c
index e017ba5..ff92576 100644
--- a/src/regexp_bt.c
+++ b/src/regexp_bt.c
@@ -3188,8 +3188,17 @@ regmatch(
 		int	mark = OPERAND(scan)[0];
 		int	cmp = OPERAND(scan)[1];
 		pos_T	*pos;
+		size_t	col = REG_MULTI ? rex.input - rex.line : 0;
 
 		pos = getmark_buf(rex.reg_buf, mark, FALSE);
+
+		// Line may have been freed, get it again.
+		if (REG_MULTI)
+		{
+		    rex.line = reg_getline(rex.lnum);
+		    rex.input = rex.line + col;
+		}
+
 		if (pos == NULL		     // mark doesn't exist
 			|| pos->lnum <= 0    // mark isn't set in reg_buf
 			|| (pos->lnum == rex.lnum + rex.reg_firstlnum
diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim
index 5b1db5a..a242d91 100644
--- a/src/testdir/test_regexp_latin.vim
+++ b/src/testdir/test_regexp_latin.vim
@@ -152,10 +152,17 @@ endfunc
 
 func Test_using_mark_position()
   " this was using freed memory
+  " new engine
   new
   norm O0
   call assert_fails("s/\\%')", 'E486:')
   bwipe!
+
+  " old engine
+  new
+  norm O0
+  call assert_fails("s/\\%#=1\\%')", 'E486:')
+  bwipe!
 endfunc
 
 func Test_using_invalid_visual_position()
-- 
1.8.3.1