patch 9.1.1954: Setting a byte in a blob, accepts values outside 0-255

Problem:  Setting a byte in a blob, accepts values outside 0-255
Solution: When setting a byte in a blob, check for valid values
          (Yegappan Lakshmanan)

closes: #18870

Signed-off-by: Yegappan Lakshmanan <yegappan@yahoo.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/src/errors.h b/src/errors.h
index 0f5441a4ae4ad3cf2bebf1d0e3a07428d175d12b..8779c586b5a8a14a3eb2897151ad96cb088943fd 100644 (file)
--- a/src/errors.h
+++ b/src/errors.h
@@ -3181,7 +3181,7 @@ EXTERN char e_no_such_user_defined_command_in_current_buffer_str[]
 EXTERN char e_blob_required_for_argument_nr[]
        INIT(= N_("E1238: Blob required for argument %d"));
 EXTERN char e_invalid_value_for_blob_nr[]
-       INIT(= N_("E1239: Invalid value for blob: %d"));
+       INIT(= N_("E1239: Invalid value for blob: 0x%lX"));
 #endif
 EXTERN char e_resulting_text_too_long[]
        INIT(= N_("E1240: Resulting text too long"));

diff --git a/src/eval.c b/src/eval.c
index b3bf9d5931b702d727f0e48d4ebec27e01eb88f7..3f400c9755c6f7ad04ff324157d608fc659664c3 100644 (file)
--- a/src/eval.c
+++ b/src/eval.c
@@ -2363,7 +2363,7 @@ set_var_lval(
 
        if (lp->ll_blob != NULL)
        {
-           int     error = FALSE, val;
+           int     error = FALSE;
 
            if (op != NULL && *op != '=')
            {
@@ -2384,9 +2384,14 @@ set_var_lval(
            }
            else
            {
-               val = (int)tv_get_number_chk(rettv, &error);
+               varnumber_T     val = tv_get_number_chk(rettv, &error);
                if (!error)
-                   blob_set_append(lp->ll_blob, lp->ll_n1, val);
+               {
+                   if (val < 0 || val > 255)
+                       semsg(_(e_invalid_value_for_blob_nr), val);
+                   else
+                       blob_set_append(lp->ll_blob, lp->ll_n1, val);
+               }
            }
        }
        else if (op != NULL && *op != '=')

diff --git a/src/po/vim.pot b/src/po/vim.pot
index 09544a0c08d67b1a9357a0b63261afbf8ff7a218..f250fbd17ccd9a80440c4bc2ce7159d1bb38840a 100644 (file)
--- a/src/po/vim.pot
+++ b/src/po/vim.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Vim\n"
 "Report-Msgid-Bugs-To: vim-dev@vim.org\n"
-"POT-Creation-Date: 2025-11-27 21:26+0000\n"
+"POT-Creation-Date: 2025-12-06 10:11+0100\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -7906,7 +7906,7 @@ msgid "E1238: Blob required for argument %d"
 msgstr ""
 
 #, c-format
-msgid "E1239: Invalid value for blob: %d"
+msgid "E1239: Invalid value for blob: 0x%lX"
 msgstr ""
 
 msgid "E1240: Resulting text too long"

diff --git a/src/testdir/test_blob.vim b/src/testdir/test_blob.vim
index f4177a63ddf9dbff18f7f6c8894336de65179340..a70cdcf61d48dc454280964ace3eccc68085404f 100644 (file)
--- a/src/testdir/test_blob.vim
+++ b/src/testdir/test_blob.vim
@@ -876,4 +876,13 @@ func Test_blob_items()
   call v9.CheckSourceLegacyAndVim9Success(lines)
 endfunc
 
+" Test for setting a byte in a blob with invalid value
+func Test_blob_byte_set_invalid_value()
+  let lines =<< trim END
+    VAR b = 0zD0C3E4E18E1B
+    LET b[0] = 229539777187355
+  END
+  call v9.CheckSourceLegacyAndVim9Failure(lines, 'E1239: Invalid value for blob:')
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

diff --git a/src/version.c b/src/version.c
index ef8c96fa3837a73919d9eb6de66abc14ca670fc2..bb964b62a5aadd6228ec51674c90e527007bb1d0 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -729,6 +729,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1954,
 /**/
     1953,
 /**/

diff --git a/src/vim9execute.c b/src/vim9execute.c
index 87a3e9d66fb1a43101fc9e1c3118f21ddb8cba05..13334e58efd9a87543d75dd07f75ef05f7474d3e 100644 (file)
--- a/src/vim9execute.c
+++ b/src/vim9execute.c
@@ -2526,6 +2526,11 @@ execute_storeindex(isn_T *iptr, ectx_T *ectx)
            nr = tv_get_number_chk(tv, &error);
            if (error)
                return FAIL;
+           if (nr < 0 || nr > 255)
+           {
+               semsg(_(e_invalid_value_for_blob_nr), nr);
+               return FAIL;
+           }
            blob_set_append(blob, lidx, nr);
        }
        else if (dest_type == VAR_CLASS || dest_type == VAR_OBJECT)