[vim/vim] Win32 gui_mch_draw_string: DBCS (euc-jp) path can pass byte length > Columns into ExtTextOut with padding sized only Columns (Issue #20821)

2 views

Skip to first unread message

Shixin Tan

unread,

Jul 23, 2026, 5:49:48 AM (yesterday) Jul 23

to vim/vim, Subscribed

tsx543 created an issue (vim/vim#20821)

Steps to reproduce

Build Windows GUI Vim (gvim / gui_w32.c).
Set encoding to a DBCS_JPNU encoding such as euc-jp (so mb_ptr2cells and mb_ptr2len diverge for half-width kana lead byte 0x8e).
Display a long run of euc-jp half-width kana (or other 2-byte / 1-cell sequences) that approaches or exceeds the screen width — e.g. via GUI redraw of external command output (:!cmd / :r !cmd) or a buffer full of such bytes.
The GUI draw path allocates padding with only Columns ints, but gui_outstr() can accumulate a byte length roughly up to ~2× remaining cells for 0x8e xx sequences, then passes that length to ExtTextOut / RevOut together with padding.

Relevant code in current master.

src/gui.c — gui_outstr() accumulates byte length via mb_ptr2len while capping on cells via mb_ptr2cells:

cells = 0;
for (this_len = 0; this_len < len; )
{
    cells += (*mb_ptr2cells)(s + this_len);
    if (gui.col + cells > Columns)
        break;
    this_len += (*mb_ptr2len)(s + this_len);
}
...
(void)gui_outstr_nowrap(s, this_len, ...);

src/gui_w32.c — gui_mch_draw_string() sizes padding to Columns, then passes byte len to ExtTextOut:

pad_size = Columns;
padding = LALLOC_MULT(int, pad_size);
...
ExtTextOut(s_hdc, TEXT_X(col), TEXT_Y(row),
           foptions, pcliprect, (char *)text, len, padding);

For euc-jp half-width kana (0x8e xx), each character can add 2 bytes but only 1 cell, so len can exceed Columns and ExtTextOut reads past the padding heap allocation.

Expected behaviour

padding must be sized for the number of advances ExtTextOut will consume (matching the byte/len argument on this path), or len must be clamped so it cannot exceed the allocated padding element count. A DBCS string that fits in Columns cells must not cause an out-of-bounds read of padding.

Version of Vim

9.2.0838

Environment

Terminal: n/a (GUI)
Value of $TERM: n/a
Shell: n/a

Logs and stack traces

—
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today!
You are receiving this because you are subscribed to this thread.

K.Takata

unread,

Jul 23, 2026, 6:10:59 AM (yesterday) Jul 23

to vim/vim, Subscribed

k-takata left a comment (vim/vim#20821)

DBCS_JPNU is for (old) Japanese Unix environments. Setting 'encoding' to it on Windows is not intended.