From: Yegappan Lakshmanan <yegappan@yahoo.com>
Date: Sat, 6 Dec 2025 09:13:00 +0000 (+0100)
Subject: patch 9.1.1954: Setting a byte in a blob, accepts values outside 0-255
X-Git-Tag: v9.1.1954^0
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f4a299700e211a728f0f7398eb8fceaf44165711;p=thirdparty%2Fvim.git

patch 9.1.1954: Setting a byte in a blob, accepts values outside 0-255

Problem:  Setting a byte in a blob, accepts values outside 0-255
Solution: When setting a byte in a blob, check for valid values
          (Yegappan Lakshmanan)

closes: #18870

Signed-off-by: Yegappan Lakshmanan <yegappan@yahoo.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/src/errors.h b/src/errors.h
index 0f5441a4ae..8779c586b5 100644
--- a/src/errors.h
+++ b/src/errors.h
@@ -3181,7 +3181,7 @@ EXTERN char e_no_such_user_defined_command_in_current_buffer_str[]
 EXTERN char e_blob_required_for_argument_nr[]
 	INIT(= N_("E1238: Blob required for argument %d"));
 EXTERN char e_invalid_value_for_blob_nr[]
-	INIT(= N_("E1239: Invalid value for blob: %d"));
+	INIT(= N_("E1239: Invalid value for blob: 0x%lX"));
 #endif
 EXTERN char e_resulting_text_too_long[]
 	INIT(= N_("E1240: Resulting text too long"));
diff --git a/src/eval.c b/src/eval.c
index b3bf9d5931..3f400c9755 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -2363,7 +2363,7 @@ set_var_lval(
 
 	if (lp->ll_blob != NULL)
 	{
-	    int	    error = FALSE, val;
+	    int	    error = FALSE;
 
 	    if (op != NULL && *op != '=')
 	    {
@@ -2384,9 +2384,14 @@ set_var_lval(
 	    }
 	    else
 	    {
-		val = (int)tv_get_number_chk(rettv, &error);
+		varnumber_T	val = tv_get_number_chk(rettv, &error);
 		if (!error)
-		    blob_set_append(lp->ll_blob, lp->ll_n1, val);
+		{
+		    if (val < 0 || val > 255)
+			semsg(_(e_invalid_value_for_blob_nr), val);
+		    else
+			blob_set_append(lp->ll_blob, lp->ll_n1, val);
+		}
 	    }
 	}
 	else if (op != NULL && *op != '=')
diff --git a/src/po/vim.pot b/src/po/vim.pot
index 09544a0c08..f250fbd17c 100644
--- a/src/po/vim.pot
+++ b/src/po/vim.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Vim\n"
 "Report-Msgid-Bugs-To: vim-dev@vim.org\n"
-"POT-Creation-Date: 2025-11-27 21:26+0000\n"
+"POT-Creation-Date: 2025-12-06 10:11+0100\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -7906,7 +7906,7 @@ msgid "E1238: Blob required for argument %d"
 msgstr ""
 
 #, c-format
-msgid "E1239: Invalid value for blob: %d"
+msgid "E1239: Invalid value for blob: 0x%lX"
 msgstr ""
 
 msgid "E1240: Resulting text too long"
diff --git a/src/testdir/test_blob.vim b/src/testdir/test_blob.vim
index f4177a63dd..a70cdcf61d 100644
--- a/src/testdir/test_blob.vim
+++ b/src/testdir/test_blob.vim
@@ -876,4 +876,13 @@ func Test_blob_items()
   call v9.CheckSourceLegacyAndVim9Success(lines)
 endfunc
 
+" Test for setting a byte in a blob with invalid value
+func Test_blob_byte_set_invalid_value()
+  let lines =<< trim END
+    VAR b = 0zD0C3E4E18E1B
+    LET b[0] = 229539777187355
+  END
+  call v9.CheckSourceLegacyAndVim9Failure(lines, 'E1239: Invalid value for blob:')
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index ef8c96fa38..bb964b62a5 100644
--- a/src/version.c
+++ b/src/version.c
@@ -729,6 +729,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1954,
 /**/
     1953,
 /**/
diff --git a/src/vim9execute.c b/src/vim9execute.c
index 87a3e9d66f..13334e58ef 100644
--- a/src/vim9execute.c
+++ b/src/vim9execute.c
@@ -2526,6 +2526,11 @@ execute_storeindex(isn_T *iptr, ectx_T *ectx)
 	    nr = tv_get_number_chk(tv, &error);
 	    if (error)
 		return FAIL;
+	    if (nr < 0 || nr > 255)
+	    {
+		semsg(_(e_invalid_value_for_blob_nr), nr);
+		return FAIL;
+	    }
 	    blob_set_append(blob, lidx, nr);
 	}
 	else if (dest_type == VAR_CLASS || dest_type == VAR_OBJECT)