patch 9.2.0841: [security]: heap overflow when adding > 65535 text properties

Problem:  [security]: heap overflow when adding > 65535 text properties
          (Wang1rrr).
Solution: Verify that the number of text properties falls within the
          limit (Yasuhiro Matsumoto).

Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-hm4g-pjfx-m27j

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/src/errors.h b/src/errors.h
index e1e7ada84dd6b1ae6f60ffc448e3cedb976493d5..143e7d7e6cc190a656cff97b2d3bd030fa1f42e8 100644 (file)
--- a/src/errors.h
+++ b/src/errors.h
@@ -3818,3 +3818,7 @@ EXTERN char e_too_many_postponed_prefixes_spell[]
 #endif
 EXTERN char e_completeopt_escape_cannot_be_used_with_nargs_underscore[]
        INIT(= N_("E1579: -completeopt=escape cannot be used with -nargs=_"));
+#ifdef FEAT_PROP_POPUP
+EXTERN char e_too_many_text_properties_on_a_single_line[]
+       INIT(= N_("E1580: Too many text properties on a single line"));
+#endif

diff --git a/src/po/vim.pot b/src/po/vim.pot
index 4996b205ff817171a9bdd139b51170550e300dbd..358f4bb614a67189b3746c4203289e0a9f8c38eb 100644 (file)
--- a/src/po/vim.pot
+++ b/src/po/vim.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Vim\n"
 "Report-Msgid-Bugs-To: vim-dev@vim.org\n"
-"POT-Creation-Date: 2026-06-27 08:41+0000\n"
+"POT-Creation-Date: 2026-07-23 20:13+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -8897,6 +8897,9 @@ msgstr ""
 msgid "E1579: -completeopt=escape cannot be used with -nargs=_"
 msgstr ""
 
+msgid "E1580: Too many text properties on a single line"
+msgstr ""
+
 #. type of cmdline window or 0
 #. result of cmdline window or 0
 #. buffer of cmdline window or NULL

diff --git a/src/testdir/test_textprop.vim b/src/testdir/test_textprop.vim
index 66f9edc8167d7197dbe4d143778704fb7a09d6fc..a566a47af8d6d09c7b2121f1363ca65fef940442 100644 (file)
--- a/src/testdir/test_textprop.vim
+++ b/src/testdir/test_textprop.vim
@@ -5027,4 +5027,22 @@ func Test_textprop_below_truncated_with_ellipsis()
   set ff&
 endfunc
 
+" Adding more than 65535 text properties to one line must be rejected instead
+" of wrapping the uint16_t property count and overflowing the allocation.
+func Test_prop_add_over_uint16_max()
+  CheckNotAsan
+  CheckNotValgrind
+  new
+  call setline(1, 'x')
+  call prop_type_add('overflow', {})
+  for _ in range(0xffff)
+    call prop_add(1, 1, {'type': 'overflow', 'length': 0})
+  endfor
+  call assert_equal(0xffff, prop_list(1)->len())
+  call assert_fails("call prop_add(1, 1, {'type': 'overflow', 'length': 0})", 'E1580:')
+  call assert_equal(0xffff, prop_list(1)->len())
+  call prop_type_delete('overflow')
+  bwipe!
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

diff --git a/src/textprop.c b/src/textprop.c
index 4d3c8d2d710b23e6748b471e9706c565dc35eeb8..02f987618490e9a7cafef626c2f26d27f60fb461 100644 (file)
--- a/src/textprop.c
+++ b/src/textprop.c
@@ -758,6 +758,13 @@ prop_add_one(
        proplen = get_text_props(buf, lnum, &props, TRUE);
        textlen = ml_get_buf_len(buf, lnum) + 1;
 
+       // prop_count is a uint16_t; stop before proplen + 1 wraps to zero.
+       if (proplen >= 0xffff)
+       {
+           emsg(_(e_too_many_text_properties_on_a_single_line));
+           goto theend;
+       }
+
        if (lnum == start_lnum)
            col = start_col;
        else

diff --git a/src/version.c b/src/version.c
index 75110ae0ab5ca7b4ff581fbde30d58166f3ebcbf..9afff74b32cce98f7d1f12eaf1c95b55c749336c 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -758,6 +758,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    841,
 /**/
     840,
 /**/