patch 9.2.0271: buffer underflow in vim_fgets()
Commit:
https://github.com/vim/vim/commit/3c0f8000e152ceb02619249f5ebf06d6ffe9c8d8
Author: Koda Reef <[email protected]>
Date: Sun Mar 29 15:19:49 2026 +0000
patch 9.2.0271: buffer underflow in vim_fgets()
Problem: buffer underflow in vim_fgets()
Solution: Ensure size is always greater than 1
(Koda Reef)
Signed-off-by: Koda Reef <[email protected]>
Signed-off-by: Christian Brabandt <[email protected]>
diff --git a/src/fileio.c b/src/fileio.c
index e057b78ad..975dc310e 100644
--- a/src/fileio.c
+++ b/src/fileio.c
@@ -3833,6 +3833,14 @@ vim_fgets(char_u *buf, int size, FILE *fp)
#define FGETS_SIZE 200
char tbuf[FGETS_SIZE];
+ // safety check
+ if (size < 2)
+ {
+ if (size == 1)
+ buf[0] = NUL;
+ return TRUE;
+ }
+
buf[size - 2] = NUL;
eof = fgets((char *)buf, size, fp);
if (buf[size - 2] != NUL && buf[size - 2] != '
')
diff --git a/src/testdir/test_viminfo.vim b/src/testdir/test_viminfo.vim
index e3767e9a2..ff79265f8 100644
--- a/src/testdir/test_viminfo.vim
+++ b/src/testdir/test_viminfo.vim
@@ -1351,4 +1351,24 @@ func Test_viminfo_global_var()
let &viminfo = _viminfo
endfunc
+func Test_viminfo_len_one()
+ let _viminfofile = &viminfofile
+ let &viminfofile=''
+ let viminfo_file = tempname()
+ call histadd('cmd', '" TEST')
+ defer delete(viminfo_file)
+
+ " Craft a viminfo entry with ^V1 length prefix (len == 1)
+ call writefile([
+ \ '*encoding=utf-8',
+ \ ':' .. "\x161" .. 'X',
+ \ ], viminfo_file, 'b')
+
+ " Should not crash or cause memory errors
+ exe 'rviminfo! ' .. viminfo_file
+ call assert_equal('" TEST', histget(':', -1))
+
+ let &viminfofile = _viminfofile
+endfunc
+
" vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 24341528f..6c60c9dc2 100644
--- a/src/version.c
+++ b/src/version.c
@@ -734,6 +734,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 271,
/**/
270,
/**/
diff --git a/src/viminfo.c b/src/viminfo.c
index 7de591f1b..9b60ec594 100644
--- a/src/viminfo.c
+++ b/src/viminfo.c
@@ -265,7 +265,7 @@ viminfo_readstring(
if (virp->vir_line[off] == Ctrl_V && vim_isdigit(virp->vir_line[off + 1]))
{
len = atol((char *)virp->vir_line + off + 1);
- if (len > 0 && len < 1000000)
+ if (len > 1 && len < 1000000)
retval = lalloc(len, TRUE);
if (retval == NULL)
{
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/d/msgid/vim_dev/E1w6sJz-00Bryc-N6%40256bit.org.
