patch 9.2.0526: missing out-of-memory check in ex_substitute()

Problem:  missing out-of-memory check in ex_substitute()
Solution: Bail out in case of out-of-memory (John Marriott)

closes: #20308

Signed-off-by: John Marriott <basilisk@internode.on.net>
Signed-off-by: Christian Brabandt <cb@256bit.org>

src/ex_cmds.c

@@ -4144,6 +4144,8 @@ ex_substitute(exarg_T *eap)
 	pat = NULL;		// search_regcomp() will use previous pattern
 	patlen = 0;
 	sub = vim_strsave(old_sub);
+	if (sub == NULL)
+	    return;
 
 	// Vi compatibility quirk: repeating with ":s" keeps the cursor in the
 	// last column after using "$".
@@ -5003,6 +5005,12 @@ ex_substitute(exarg_T *eap)
 		    vim_free(sub_firstline);
 		    sub_firstline = vim_strnsave(ml_get(sub_firstlnum),
 						    ml_get_len(sub_firstlnum));
+		    if (sub_firstline == NULL)
+		    {
+			vim_free(new_start);
+			goto outofmem;
+		    }
+
 		    // When going beyond the last line, stop substituting.
 		    if (sub_firstlnum <= line2)
 			do_again = TRUE;
@@ -5019,6 +5027,11 @@ ex_substitute(exarg_T *eap)
 		    // less than what it ought to be.
 		    vim_free(sub_firstline);
 		    sub_firstline = vim_strsave((char_u *)"");
+		    if (sub_firstline == NULL)
+		    {
+			vim_free(new_start);
+			goto outofmem;
+		    }
 		    copycol = 0;
 		}
 

src/version.c

@@ -729,6 +729,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    526,
 /**/
     525,
 /**/