vim-patch:7.4.253

Problem:  Crash when using cpp syntax file with pattern using external
          match. (Havard Garnes)

Solution: Discard match when end column is before start column.

https://code.google.com/p/vim/source/detail?r=4901a36479f200b2e6700ad91c26911d92deb886

src/regexp.c

@@ -3665,11 +3665,14 @@ static long regtry(bt_regprog_T *prog, colnr_T col)
       if (REG_MULTI) {
         /* Only accept single line matches. */
         if (reg_startzpos[i].lnum >= 0
-            && reg_endzpos[i].lnum == reg_startzpos[i].lnum)
+            && reg_endzpos[i].lnum == reg_startzpos[i].lnum
+            && reg_endzpos[i].col >= reg_startzpos[i].col) {
           re_extmatch_out->matches[i] =
             vim_strnsave(reg_getline(reg_startzpos[i].lnum)
                          + reg_startzpos[i].col,
-                reg_endzpos[i].col - reg_startzpos[i].col);
+                         reg_endzpos[i].col
+                         - reg_startzpos[i].col);
+        }
       } else {
         if (reg_startzp[i] != NULL && reg_endzp[i] != NULL)
           re_extmatch_out->matches[i] =

src/regexp_nfa.c

@@ -6121,12 +6121,14 @@ static long nfa_regtry(nfa_regprog_T *prog, colnr_T col)
       if (REG_MULTI) {
         struct multipos *mpos = &subs.synt.list.multi[i];
 
-        /* Only accept single line matches. */
-        if (mpos->start.lnum >= 0 && mpos->start.lnum == mpos->end.lnum)
+        // Only accept single line matches that are valid.
+        if (mpos->start.lnum >= 0
+            && mpos->start.lnum == mpos->end.lnum
+            && mpos->end.col >= mpos->start.col) {
           re_extmatch_out->matches[i] =
-            vim_strnsave(reg_getline(mpos->start.lnum)
-                + mpos->start.col,
+            vim_strnsave(reg_getline(mpos->start.lnum) + mpos->start.col,
                          mpos->end.col - mpos->start.col);
+        }
       } else {
         struct linepos *lpos = &subs.synt.list.line[i];
 

src/version.c

@@ -207,7 +207,7 @@ static int included_patches[] = {
   //256,
   //255,
   //254,
-  //253,
+  253,
   //252,
   251,
   //250,
@@ -220,7 +220,6 @@ static int included_patches[] = {
   //243,
   //242,
   //241,
-  //240,
   240,
   239,
   //238,