From: Christian Brabandt <cb@256bit.org>
Date: Wed, 1 Apr 2026 15:03:58 +0000 (+0000)
Subject: patch 9.2.0278: viminfo: heap buffer overflow when reading viminfo file
X-Git-Tag: v9.2.0278^0
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b2e55ed1d6c9d9af0e1afa6deedf0fec7a49c8c8;p=thirdparty%2Fvim.git

patch 9.2.0278: viminfo: heap buffer overflow when reading viminfo file

Problem:  Reading a crafted viminfo file can cause a heap buffer
          overflow because the length value from getdigits() is cast to
          int, truncating large size_t values
Solution: Remove the (int) cast when calling alloc() (sentinel404)

Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/src/testdir/test_viminfo.vim b/src/testdir/test_viminfo.vim
index ff79265f8e..b3a8b91cb1 100644
--- a/src/testdir/test_viminfo.vim
+++ b/src/testdir/test_viminfo.vim
@@ -1371,4 +1371,24 @@ func Test_viminfo_len_one()
   let &viminfofile = _viminfofile
 endfunc
 
+func Test_viminfo_len_overflow()
+  let _viminfofile = &viminfofile
+  let &viminfofile=''
+  let viminfo_file = tempname()
+  defer delete(viminfo_file)
+
+  " Craft a viminfo entry with size_t length overflow
+  call writefile(['# Viminfo',
+        \ '|1,4', '|2,>4294967311',
+        \ '|<"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',
+        \ '|<BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB',
+        \ '|<CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC',
+        \ '|<DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD'], viminfo_file, 'b')
+
+  " Should not crash or cause memory errors
+  exe 'rviminfo! ' .. viminfo_file
+
+  let &viminfofile = _viminfofile
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 075253bfd7..009c332761 100644
--- a/src/version.c
+++ b/src/version.c
@@ -734,6 +734,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    278,
 /**/
     277,
 /**/
diff --git a/src/viminfo.c b/src/viminfo.c
index 9b60ec5945..8b6aa3e70a 100644
--- a/src/viminfo.c
+++ b/src/viminfo.c
@@ -1054,7 +1054,7 @@ barline_parse(vir_T *virp, char_u *text, garray_T *values)
 		// Length includes the quotes.
 		++p;
 		len = getdigits(&p);
-		buf = alloc((int)(len + 1));
+		buf = alloc(len + 1);
 		if (buf == NULL)
 		    return TRUE;
 		p = buf;