Commit: patch 9.2.0841: [security]: heap overflow when adding > 65535 text properties

patch 9.2.0841: [security]: heap overflow when adding > 65535 text properties

Commit: https://github.com/vim/vim/commit/a9336b476fd1a182e3f79b5f83c0ffb04f8a922b
Author: Yasuhiro Matsumoto <[email protected]>
Date:   Thu Jul 23 20:14:13 2026 +0000

    patch 9.2.0841: [security]: heap overflow when adding > 65535 text properties
    
    Problem:  [security]: heap overflow when adding > 65535 text properties
              (Wang1rrr).
    Solution: Verify that the number of text properties falls within the
              limit (Yasuhiro Matsumoto).
    
    Github Security Advisory:
    https://github.com/vim/vim/security/advisories/GHSA-hm4g-pjfx-m27j
    
    Signed-off-by: Yasuhiro Matsumoto <[email protected]>
    Signed-off-by: Christian Brabandt <[email protected]>

diff --git a/src/errors.h b/src/errors.h
index e1e7ada84..143e7d7e6 100644
--- a/src/errors.h
+++ b/src/errors.h
@@ -3818,3 +3818,7 @@ EXTERN char e_too_many_postponed_prefixes_spell[]
 #endif
 EXTERN char e_completeopt_escape_cannot_be_used_with_nargs_underscore[]
 	INIT(= N_("E1579: -completeopt=escape cannot be used with -nargs=_"));
+#ifdef FEAT_PROP_POPUP
+EXTERN char e_too_many_text_properties_on_a_single_line[]
+	INIT(= N_("E1580: Too many text properties on a single line"));
+#endif
diff --git a/src/po/vim.pot b/src/po/vim.pot
index 4996b205f..358f4bb61 100644
--- a/src/po/vim.pot
+++ b/src/po/vim.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Vim
"
 "Report-Msgid-Bugs-To: [email protected]
"
-"POT-Creation-Date: 2026-06-27 08:41+0000
"
+"POT-Creation-Date: 2026-07-23 20:13+0000
"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE
"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>
"
 "Language-Team: LANGUAGE <[email protected]>
"
@@ -8897,6 +8897,9 @@ msgstr ""
 msgid "E1579: -completeopt=escape cannot be used with -nargs=_"
 msgstr ""
 
+msgid "E1580: Too many text properties on a single line"
+msgstr ""
+
 #. type of cmdline window or 0
 #. result of cmdline window or 0
 #. buffer of cmdline window or NULL
diff --git a/src/testdir/test_textprop.vim b/src/testdir/test_textprop.vim
index 66f9edc81..a566a47af 100644
--- a/src/testdir/test_textprop.vim
+++ b/src/testdir/test_textprop.vim
@@ -5027,4 +5027,22 @@ func Test_textprop_below_truncated_with_ellipsis()
   set ff&
 endfunc
 
+" Adding more than 65535 text properties to one line must be rejected instead
+" of wrapping the uint16_t property count and overflowing the allocation.
+func Test_prop_add_over_uint16_max()
+  CheckNotAsan
+  CheckNotValgrind
+  new
+  call setline(1, 'x')
+  call prop_type_add('overflow', {})
+  for _ in range(0xffff)
+    call prop_add(1, 1, {'type': 'overflow', 'length': 0})
+  endfor
+  call assert_equal(0xffff, prop_list(1)->len())
+  call assert_fails("call prop_add(1, 1, {'type': 'overflow', 'length': 0})", 'E1580:')
+  call assert_equal(0xffff, prop_list(1)->len())
+  call prop_type_delete('overflow')
+  bwipe!
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/textprop.c b/src/textprop.c
index 4d3c8d2d7..02f987618 100644
--- a/src/textprop.c
+++ b/src/textprop.c
@@ -758,6 +758,13 @@ prop_add_one(
 	proplen = get_text_props(buf, lnum, &props, TRUE);
 	textlen = ml_get_buf_len(buf, lnum) + 1;
 
+	// prop_count is a uint16_t; stop before proplen + 1 wraps to zero.
+	if (proplen >= 0xffff)
+	{
+	    emsg(_(e_too_many_text_properties_on_a_single_line));
+	    goto theend;
+	}
+
 	if (lnum == start_lnum)
 	    col = start_col;
 	else
diff --git a/src/version.c b/src/version.c
index 75110ae0a..9afff74b3 100644
--- a/src/version.c
+++ b/src/version.c
@@ -758,6 +758,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    841,
 /**/
     840,
 /**/

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups "vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/d/msgid/vim_dev/E1wn03P-00AQZG-TQ%40256bit.org.