On Tue, 21 Apr 2026 12:19:43 +0200, [email protected] wrote: > ex_cmd() in usr.bin/vi/ex/ex.c computes the remaining command > length with unsigned arithmetic that underflows when the +cmd > inner loop consumes every byte and "discard" (escape pairs) > reaches save_cmd - cp: > > ecp->clen = ((ecp->save_cmd - ecp->cp) - 1) - discard; > > The resulting (size_t)-1 flows into argv_exp2() -> argv_fexp() > at ex_argv.c:305 which loops until cmd walks off mapped memory. > > Minimum reproducer (7 bytes, \x16 = literal-next): > > $ printf 'x\n' > t > $ printf 'e+"p\x16o\n' | MALLOC_OPTIONS=S vi -e t > Segmentation fault (core dumped) > > Reproduced on OpenBSD 7.9 arm64, amd64 and i386. Found by > AFL++ fuzzing of ex(1).
OK millert@ - todd
