regexp: wrong match with 'ic' and comparing multi-byte with single by…

…te char

This is v2 of v9.1.296, but still draft to see if this still breaks.

When the regexp engine compares two utf-8 codepoints case insensitively it may
match an adjacent character, because it assumes it can step over as many bytes
as the pattern contains.

This however is not necessarily true because of case-folding, a multi-byte
UTF-8 character can be considered equal to some single-byte value.

Let's consider the pattern 'ſ' and the string 's'. When comparing and ignoring
case, the single character 's' matches, and since it matches Vim will try to
step over the match (by the amount of bytes of the pattern), assuming that
since it matches, the length of both strings is the same.

However in that case, it should only step over the single byte value 's' by 1
byte and try to start matching after it again. So for the backtracking engine
we need to ensure:
- we try to match the correct length for the pattern and the text
- in case of a match, we step over it correctly

There is one tricky thing for the backtracing engine. We also need to calculate
correctly the number of bytes to compare the 2 different utf-8 strings s1 and
s2. So we will count the number of characters in s1 that the byte len
specified. Then we count the number of bytes to step over the same number of
characters in string s2 and then we can correctly compare the 2 utf-8 strings.

A similar thing can happen for the NFA engine, when skipping to the next
character to test for a match. We are skipping over the regstart pointer,
however we do not consider the case that because of case-folding we may need to
adjust the number of bytes to skip over. So this needs to be adjusted in
find_match_text() as well.

A related issue turned out, when prog->match_text is actually empty. In that
case we should try to find the next match and skip this condition.

Note: this breaks Mail and CSS Syntax highlighting and CI on FreeBSD/MacOS
vim#14487 and
https://groups.google.com/d/msgid/vim_dev/CAJkCKXtui%3DDTWx9eV8Dbs19XoFL9b63ObSNXWCRvLsEZCB6yfw%40mail.gmail.com.

fixes: vim#14294

Signed-off-by: Christian Brabandt <[email protected]>

src/mbyte.c

@@ -3800,6 +3800,15 @@ utf_strnicmp(
  * Returns zero if s1 and s2 are equal (ignoring case), the difference between
  * two characters otherwise.
  */
+    int
+mb_strnicmp2(char_u *s1, char_u *s2, size_t n1, size_t n2)
+{
+    if (n1 == n2 || !enc_utf8)
+	return mb_strnicmp(s1, s2, n1);
+    else
+	return utf_strnicmp(s1, s2, n1, n2);
+}
+
     int
 mb_strnicmp(char_u *s1, char_u *s2, size_t nn)
 {

src/proto/mbyte.pro

@@ -48,6 +48,7 @@ int utf_islower(int a);
 int utf_tolower(int a);
 int utf_isupper(int a);
 int mb_strnicmp(char_u *s1, char_u *s2, size_t nn);
+int mb_strnicmp2(char_u *s1, char_u *s2, size_t n1, size_t n2);
 void show_utf8(void);
 int latin_head_off(char_u *base, char_u *p);
 int dbcs_screen_head_off(char_u *base, char_u *p);

src/regexp.c

@@ -1729,7 +1729,9 @@ mb_decompose(int c, int *c1, int *c2, int *c3)
 /*
  * Compare two strings, ignore case if rex.reg_ic set.
  * Return 0 if strings match, non-zero otherwise.
- * Correct the length "*n" when composing characters are ignored.
+ * Correct the length "*n" when composing characters are ignored
+ * or for utf8 when both utf codepoints are considered equal because of
+ * case-folding but have different length (e.g. 's' and 'ſ')
  */
     static int
 cstrncmp(char_u *s1, char_u *s2, int *n)
@@ -1738,6 +1740,29 @@ cstrncmp(char_u *s1, char_u *s2, int *n)
 
     if (!rex.reg_ic)
 	result = STRNCMP(s1, s2, *n);
+    else if (enc_utf8)
+    {
+	char_u *p = s1;
+	size_t n2 = 0;
+	int n1 = *n;
+	// count the number of characters for byte-length of s1
+	while (n1 > 0 && *p != NUL)
+	{
+	    n1 -= mb_ptr2len(s1);
+	    MB_PTR_ADV(p);
+	    n2++;
+	}
+	// count the number of bytes to advance the same number of chars for s2
+	p = s2;
+	while (n2-- > 0 && *p != NUL)
+	    MB_PTR_ADV(p);
+
+	n2 = p - s2;
+
+	result = MB_STRNICMP2(s1, s2, *n, n2);
+	if (result == 0 && (int)n2 < *n)
+	    *n = n2;
+    }
     else
 	result = MB_STRNICMP(s1, s2, *n);
 

src/regexp_bt.c

@@ -3823,6 +3823,14 @@ regmatch(
 			}
 		    }
 		}
+		else if (enc_utf8)
+		{
+		    if (cstrncmp(opnd, rex.input, &len) != 0)
+		    {
+			status = RA_NOMATCH;
+			break;
+		    }
+		}
 		else
 		    for (i = 0; i < len; ++i)
 			if (opnd[i] != rex.input[i])

src/regexp_nfa.c

@@ -5666,7 +5666,12 @@ find_match_text(colnr_T *startcol, int regstart, char_u *match_text)
     for (;;)
     {
 	match = TRUE;
-	len2 = MB_CHAR2LEN(regstart); // skip regstart
+	// skip regstart
+	len2 = MB_CHAR2LEN(regstart);
+	if (enc_utf8 && len2 > 1 && MB_CHAR2LEN(PTR2CHAR(rex.line + col)) != len2)
+	    // because of case-folding of the previously matched text, we may need
+	    // to skip fewer bytes than mb_char2len(regstart)
+	    len2 = mb_char2len(utf_fold(regstart));
 	for (len1 = 0; match_text[len1] != NUL; len1 += MB_CHAR2LEN(c1))
 	{
 	    c1 = PTR2CHAR(match_text + len1);
@@ -7502,7 +7507,7 @@ nfa_regexec_both(
 
 	// If match_text is set it contains the full text that must match.
 	// Nothing else to try. Doesn't handle combining chars well.
-	if (prog->match_text != NULL && !rex.reg_icombine)
+	if (prog->match_text != NULL && *prog->match_text != NUL && !rex.reg_icombine)
 	{
 	    retval = find_match_text(&col, prog->regstart, prog->match_text);
 	    if (REG_MULTI)

src/testdir/test_regexp_utf8.vim

@@ -587,4 +587,32 @@ func Test_combining_chars_in_collection()
   bw!
 endfunc
 
+func Test_search_multibyte_match_ascii()
+  new
+  " Match single '鰱' and 's'
+  call setline(1,  'das abc heraus abc 鰱ich abc 鰱ind')
+  for i in range(0, 2)
+    exe "set re="..i
+    let ic_match = matchbufline('%', '\c\%u17f', 1, '$')->mapnew({idx, val -> val.text})
+    let noic_match = matchbufline('%', '\C\%u17f', 1, '$')->mapnew({idx, val -> val.text})
+    call assert_equal(['s', 's', '鰱','鰱'], ic_match, "Ignorecase Regex-engine: " .. &re)
+    call assert_equal(['鰱','鰱'], noic_match, "No-Ignorecase Regex-engine: " .. &re)
+  endfor
+  " Match several '鰱鰱' and 'ss'
+  call setline(1,  'das abc herauss abc 鰱鰱ich abc 鰱ind')
+  for i in range(0, 2)
+    exe "set re="..i
+    let ic_match = matchbufline('%', '\c\%u17f\%u17f', 1, '$')->mapnew({idx, val -> val.text})
+    let noic_match = matchbufline('%', '\C\%u17f\%u17f', 1, '$')->mapnew({idx, val -> val.text})
+    let ic_match2 = matchbufline('%', '\c\%u17f\+', 1, '$')->mapnew({idx, val -> val.text})
+    let noic_match2 = matchbufline('%', '\C\%u17f\+', 1, '$')->mapnew({idx, val -> val.text})
+
+    call assert_equal(['ss', '鰱鰱'], ic_match, "Ignorecase Regex-engine: " .. &re)
+    call assert_equal(['鰱鰱'], noic_match, "No-Ignorecase Regex-engine: " .. &re)
+    call assert_equal(['s', 'ss', '鰱鰱', '鰱'], ic_match2, "Ignorecase Regex-engine: " .. &re)
+    call assert_equal(['鰱鰱','鰱'], noic_match2, "No-Ignorecase Regex-engine: " .. &re)
+  endfor
+  bw!
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

src/vim.h

@@ -1769,6 +1769,7 @@ void *vim_memset(void *, int, size_t);
 
 # define MB_STRICMP(d, s)	mb_strnicmp((char_u *)(d), (char_u *)(s), (int)MAXCOL)
 # define MB_STRNICMP(d, s, n)	mb_strnicmp((char_u *)(d), (char_u *)(s), (int)(n))
+# define MB_STRNICMP2(d, s, n1, n2)	mb_strnicmp2((char_u *)(d), (char_u *)(s), (n1), (n2))
 
 #define STRCAT(d, s)	    strcat((char *)(d), (char *)(s))
 #define STRNCAT(d, s, n)    strncat((char *)(d), (char *)(s), (size_t)(n))