From e7859d2ad504a3e3cae1d540d5fd4f9b560d154a Mon Sep 17 00:00:00 2001
From: zeertzjq <zeertzjq@outlook.com>
Date: Fri, 24 May 2024 05:57:00 +0800
Subject: [PATCH] vim-patch:9.1.0436: Crash when using '?' as separator for :s
 (#28955)

Problem:  Crash when using '?' as separator for :s and pattern contains
          escaped '?'s (after 9.1.0409).
Solution: Always compute startplen. (zeertzjq).

related: neovim/neovim#28935
closes: 14832

https://github.com/vim/vim/commit/789679cfc4f39505b135220672b43a260d8ca3b4
---
 src/nvim/regexp.c                    |  3 +--
 test/old/testdir/test_substitute.vim | 10 ++++++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/src/nvim/regexp.c b/src/nvim/regexp.c
index 1027ce05b6..fa6e577c74 100644
--- a/src/nvim/regexp.c
+++ b/src/nvim/regexp.c
@@ -774,6 +774,7 @@ char *skip_regexp_ex(char *startp, int dirc, int magic, char **newp, int *droppe
 {
   magic_T mymagic;
   char *p = startp;
+  size_t startplen = strlen(startp);
 
   if (magic) {
     mymagic = MAGIC_ON;
@@ -793,11 +794,9 @@ char *skip_regexp_ex(char *startp, int dirc, int magic, char **newp, int *droppe
         break;
       }
     } else if (p[0] == '\\' && p[1] != NUL) {
-      size_t startplen = 0;
       if (dirc == '?' && newp != NULL && p[1] == '?') {
         // change "\?" to "?", make a copy first.
         if (*newp == NULL) {
-          startplen = strlen(startp);
           *newp = xstrnsave(startp, startplen);
           p = *newp + (p - startp);
         }
diff --git a/test/old/testdir/test_substitute.vim b/test/old/testdir/test_substitute.vim
index a9e317da02..bce2e6ea73 100644
--- a/test/old/testdir/test_substitute.vim
+++ b/test/old/testdir/test_substitute.vim
@@ -173,6 +173,16 @@ func Test_substitute_repeat()
   call feedkeys("Qsc\<CR>y", 'tx')
   bwipe!
 endfunc
+
+" Test :s with ? as separator.
+func Test_substitute_question_separator()
+  new
+  call setline(1, '??:??')
+  %s?\?\??!!?g
+  call assert_equal('!!:!!', getline(1))
+  bwipe!
+endfunc
+
 " Test %s/\n// which is implemented as a special case to use a
 " more efficient join rather than doing a regular substitution.
 func Test_substitute_join()