]> git.ipfire.org Git - thirdparty/vim.git/commit
patch 9.2.0487: viminfo: possible signed int overflow in register array v9.2.0487
authorYasuhiro Matsumoto <mattn.jp@gmail.com>
Fri, 15 May 2026 16:44:46 +0000 (16:44 +0000)
committerChristian Brabandt <cb@256bit.org>
Fri, 15 May 2026 16:44:46 +0000 (16:44 +0000)
commitee49669e8f3b5ecdcfd2fdd08aeaac0e3de26ea8
treee2b49d6bdffa97940372497ae5723455c26442a2
parentde7a5b5425811169f589a7a3492696e8dedf8d68
patch 9.2.0487: viminfo: possible signed int overflow in register array

Problem:  viminfo: possible signed int overflow in register array growth
Solution: Cast to size_t (Yasuhiro Matsumoto)

The expression `limit * 2 * sizeof(string_T)` in read_viminfo_register()
multiplies in int and overflows once limit exceeds INT_MAX/2. Cast to
size_t first so the size computation stays unsigned. Defensive only;
reaching this path requires registers consuming many gigabytes.

closes: #20207

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
src/version.c
src/viminfo.c