From: Christian Brabandt <cb@256bit.org>
Date: Tue, 31 Mar 2026 16:13:25 +0000 (+0000)
Subject: patch 9.2.0273: tabpanel: undefined behaviour with large tabpanelop columns
X-Git-Tag: v9.2.0273^0
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ac18dff65aa055dfdfb5b7c36870c84f742e7ead;p=thirdparty%2Fvim.git

patch 9.2.0273: tabpanel: undefined behaviour with large tabpanelop columns

Problem:  tabpanel: undefined behaviour with large tabpanelop columns
          (Michał Majchrowicz)
Solution: Error out for too large column values

Co-authored-by: Michał Majchrowicz <mmajchrowicz@afine.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/src/tabpanel.c b/src/tabpanel.c
index 12d6446832..c47b6b6e47 100644
--- a/src/tabpanel.c
+++ b/src/tabpanel.c
@@ -57,7 +57,7 @@ tabpanelopt_changed(void)
 {
     char_u	*p;
     int		new_align = ALIGN_LEFT;
-    int		new_columns = 20;
+    long	new_columns = 20;
     int		new_is_vert = FALSE;
 
     p = p_tplo;
@@ -83,6 +83,8 @@ tabpanelopt_changed(void)
 	{
 	    p += 8;
 	    new_columns = getdigits(&p);
+	    if (new_columns < 1 || new_columns > 1000)
+		return FAIL;
 	}
 	else if (STRNCMP(p, "vert", 4) == 0)
 	{
diff --git a/src/testdir/test_tabpanel.vim b/src/testdir/test_tabpanel.vim
index 4837a643d5..0329dd7a4c 100644
--- a/src/testdir/test_tabpanel.vim
+++ b/src/testdir/test_tabpanel.vim
@@ -887,4 +887,9 @@ func Test_tabpanel_no_modeline()
   bw!
 endfunc
 
+func Test_tabpanel_large_columns()
+  call assert_fails(':set tabpanelopt=columns:10001', 'E474:')
+  call assert_fails(':set tabpanelopt=columns:-1', 'E474:')
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 7ea6b064f6..35702fe0c6 100644
--- a/src/version.c
+++ b/src/version.c
@@ -734,6 +734,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    273,
 /**/
     272,
 /**/