From: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Date: Thu, 23 Jul 2026 20:14:13 +0000 (+0000)
Subject: patch 9.2.0841: [security]: heap overflow when adding > 65535 text properties
X-Git-Tag: v9.2.0841^0
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a9336b476fd1a182e3f79b5f83c0ffb04f8a922b;p=thirdparty%2Fvim.git

patch 9.2.0841: [security]: heap overflow when adding > 65535 text properties

Problem:  [security]: heap overflow when adding > 65535 text properties
          (Wang1rrr).
Solution: Verify that the number of text properties falls within the
          limit (Yasuhiro Matsumoto).

Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-hm4g-pjfx-m27j

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/src/errors.h b/src/errors.h
index e1e7ada84d..143e7d7e6c 100644
--- a/src/errors.h
+++ b/src/errors.h
@@ -3818,3 +3818,7 @@ EXTERN char e_too_many_postponed_prefixes_spell[]
 #endif
 EXTERN char e_completeopt_escape_cannot_be_used_with_nargs_underscore[]
 	INIT(= N_("E1579: -completeopt=escape cannot be used with -nargs=_"));
+#ifdef FEAT_PROP_POPUP
+EXTERN char e_too_many_text_properties_on_a_single_line[]
+	INIT(= N_("E1580: Too many text properties on a single line"));
+#endif
diff --git a/src/po/vim.pot b/src/po/vim.pot
index 4996b205ff..358f4bb614 100644
--- a/src/po/vim.pot
+++ b/src/po/vim.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Vim\n"
 "Report-Msgid-Bugs-To: vim-dev@vim.org\n"
-"POT-Creation-Date: 2026-06-27 08:41+0000\n"
+"POT-Creation-Date: 2026-07-23 20:13+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -8897,6 +8897,9 @@ msgstr ""
 msgid "E1579: -completeopt=escape cannot be used with -nargs=_"
 msgstr ""
 
+msgid "E1580: Too many text properties on a single line"
+msgstr ""
+
 #. type of cmdline window or 0
 #. result of cmdline window or 0
 #. buffer of cmdline window or NULL
diff --git a/src/testdir/test_textprop.vim b/src/testdir/test_textprop.vim
index 66f9edc816..a566a47af8 100644
--- a/src/testdir/test_textprop.vim
+++ b/src/testdir/test_textprop.vim
@@ -5027,4 +5027,22 @@ func Test_textprop_below_truncated_with_ellipsis()
   set ff&
 endfunc
 
+" Adding more than 65535 text properties to one line must be rejected instead
+" of wrapping the uint16_t property count and overflowing the allocation.
+func Test_prop_add_over_uint16_max()
+  CheckNotAsan
+  CheckNotValgrind
+  new
+  call setline(1, 'x')
+  call prop_type_add('overflow', {})
+  for _ in range(0xffff)
+    call prop_add(1, 1, {'type': 'overflow', 'length': 0})
+  endfor
+  call assert_equal(0xffff, prop_list(1)->len())
+  call assert_fails("call prop_add(1, 1, {'type': 'overflow', 'length': 0})", 'E1580:')
+  call assert_equal(0xffff, prop_list(1)->len())
+  call prop_type_delete('overflow')
+  bwipe!
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/textprop.c b/src/textprop.c
index 4d3c8d2d71..02f9876184 100644
--- a/src/textprop.c
+++ b/src/textprop.c
@@ -758,6 +758,13 @@ prop_add_one(
 	proplen = get_text_props(buf, lnum, &props, TRUE);
 	textlen = ml_get_buf_len(buf, lnum) + 1;
 
+	// prop_count is a uint16_t; stop before proplen + 1 wraps to zero.
+	if (proplen >= 0xffff)
+	{
+	    emsg(_(e_too_many_text_properties_on_a_single_line));
+	    goto theend;
+	}
+
 	if (lnum == start_lnum)
 	    col = start_col;
 	else
diff --git a/src/version.c b/src/version.c
index 75110ae0ab..9afff74b32 100644
--- a/src/version.c
+++ b/src/version.c
@@ -758,6 +758,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    841,
 /**/
     840,
 /**/