Commit: patch 9.2.0841: [security]: heap overflow when adding > 65535 text properties

[Christian Brabandt]

patch 9.2.0841: [security]: heap overflow when adding > 65535 text properties

Commit: https://github.com/vim/vim/commit/a9336b476fd1a182e3f79b5f83c0ffb04f8a922b
Author: Yasuhiro Matsumoto <matt...@gmail.com>
Date: Thu Jul 23 20:14:13 2026 +0000

patch 9.2.0841: [security]: heap overflow when adding > 65535 text properties

Problem: [security]: heap overflow when adding > 65535 text properties
(Wang1rrr).
Solution: Verify that the number of text properties falls within the
limit (Yasuhiro Matsumoto).

Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-hm4g-pjfx-m27j

Signed-off-by: Yasuhiro Matsumoto <matt...@gmail.com>
Signed-off-by: Christian Brabandt <c...@256bit.org>

diff --git a/src/errors.h b/src/errors.h
index e1e7ada84..143e7d7e6 100644
--- a/src/errors.h
+++ b/src/errors.h
@@ -3818,3 +3818,7 @@ EXTERN char e_too_many_postponed_prefixes_spell[]
#endif
EXTERN char e_completeopt_escape_cannot_be_used_with_nargs_underscore[]
INIT(= N_("E1579: -completeopt=escape cannot be used with -nargs=_"));
+#ifdef FEAT_PROP_POPUP
+EXTERN char e_too_many_text_properties_on_a_single_line[]
+ INIT(= N_("E1580: Too many text properties on a single line"));
+#endif
diff --git a/src/po/vim.pot b/src/po/vim.pot
index 4996b205f..358f4bb61 100644
--- a/src/po/vim.pot
+++ b/src/po/vim.pot
@@ -8,7 +8,7 @@ msgid ""
msgstr ""
"Project-Id-Version: Vim
"
"Report-Msgid-Bugs-To: vim...@vim.org
"
-"POT-Creation-Date: 2026-06-27 08:41+0000
"
+"POT-Creation-Date: 2026-07-23 20:13+0000
"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE
"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>
"
"Language-Team: LANGUAGE <L...@li.org>
"
@@ -8897,6 +8897,9 @@ msgstr ""
msgid "E1579: -completeopt=escape cannot be used with -nargs=_"
msgstr ""

+msgid "E1580: Too many text properties on a single line"
+msgstr ""
+
#. type of cmdline window or 0
#. result of cmdline window or 0
#. buffer of cmdline window or NULL
diff --git a/src/testdir/test_textprop.vim b/src/testdir/test_textprop.vim
index 66f9edc81..a566a47af 100644
--- a/src/testdir/test_textprop.vim
+++ b/src/testdir/test_textprop.vim
@@ -5027,4 +5027,22 @@ func Test_textprop_below_truncated_with_ellipsis()
set ff&
endfunc

+" Adding more than 65535 text properties to one line must be rejected instead
+" of wrapping the uint16_t property count and overflowing the allocation.
+func Test_prop_add_over_uint16_max()
+ CheckNotAsan
+ CheckNotValgrind
+ new
+ call setline(1, 'x')
+ call prop_type_add('overflow', {})
+ for _ in range(0xffff)
+ call prop_add(1, 1, {'type': 'overflow', 'length': 0})
+ endfor
+ call assert_equal(0xffff, prop_list(1)->len())
+ call assert_fails("call prop_add(1, 1, {'type': 'overflow', 'length': 0})", 'E1580:')
+ call assert_equal(0xffff, prop_list(1)->len())
+ call prop_type_delete('overflow')
+ bwipe!
+endfunc
+
" vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/textprop.c b/src/textprop.c
index 4d3c8d2d7..02f987618 100644
--- a/src/textprop.c
+++ b/src/textprop.c
@@ -758,6 +758,13 @@ prop_add_one(
proplen = get_text_props(buf, lnum, &props, TRUE);
textlen = ml_get_buf_len(buf, lnum) + 1;

+ // prop_count is a uint16_t; stop before proplen + 1 wraps to zero.
+ if (proplen >= 0xffff)
+ {
+ emsg(_(e_too_many_text_properties_on_a_single_line));
+ goto theend;
+ }
+
if (lnum == start_lnum)
col = start_col;
else
diff --git a/src/version.c b/src/version.c
index 75110ae0a..9afff74b3 100644
--- a/src/version.c
+++ b/src/version.c
@@ -758,6 +758,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 841,
/**/
840,
/**/