[vim/vim] NFA engine fallback can double free the compiled program (PR #20986)

## Problem

When the automatic regexp engine falls back to the backtracking engine in
vim_regexec_string(), the compiled program is freed before the replacement
is compiled.  When vim_strsave() of the pattern fails (out of memory), the
caller's regprog is left pointing at freed memory and is freed again later.
vim_regexec_multi() already has the guarded version of the same code.

## Solution

Free the previous program only after compiling the replacement succeeded,
mirroring vim_regexec_multi().

Found while auditing the ownership hand-off in #20941; the problem exists
on master independently of that PR.  OOM-only path, so no test; the change
is the same shape as the multi-line variant just below it.

AI assistance is acknowledged with Co-Authored-By trailers on the commit,
per AGENTS.md.
You can view, comment on, or merge this pull request online at:

  https://github.com/vim/vim/pull/20986

-- Commit Summary --

  * NFA engine fallback can double free the compiled program

-- File Changes --

    M src/regexp.c (12)

-- Patch Links --

https://github.com/vim/vim/pull/20986.patch
https://github.com/vim/vim/pull/20986.diff

-- 
Reply to this email directly or view it on GitHub:
https://github.com/vim/vim/pull/20986
You are receiving this because you are subscribed to this thread.

Message ID: <vim/vim/pull/[email protected]>

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups "vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/d/msgid/vim_dev/vim/vim/pull/20986%40github.com.