Commit: patch 9.1.1954: Setting a byte in a blob, accepts values outside 0-255

[Christian Brabandt]

patch 9.1.1954: Setting a byte in a blob, accepts values outside 0-255

Commit: https://github.com/vim/vim/commit/f4a299700e211a728f0f7398eb8fceaf44165711
Author: Yegappan Lakshmanan <yega...@yahoo.com>
Date: Sat Dec 6 10:13:00 2025 +0100

patch 9.1.1954: Setting a byte in a blob, accepts values outside 0-255

Problem: Setting a byte in a blob, accepts values outside 0-255
Solution: When setting a byte in a blob, check for valid values
(Yegappan Lakshmanan)

closes: #18870

Signed-off-by: Yegappan Lakshmanan <yega...@yahoo.com>
Signed-off-by: Christian Brabandt <c...@256bit.org>

diff --git a/src/errors.h b/src/errors.h
index 0f5441a4a..8779c586b 100644
--- a/src/errors.h
+++ b/src/errors.h
@@ -3181,7 +3181,7 @@ EXTERN char e_no_such_user_defined_command_in_current_buffer_str[]
EXTERN char e_blob_required_for_argument_nr[]
INIT(= N_("E1238: Blob required for argument %d"));
EXTERN char e_invalid_value_for_blob_nr[]
- INIT(= N_("E1239: Invalid value for blob: %d"));
+ INIT(= N_("E1239: Invalid value for blob: 0x%lX"));
#endif
EXTERN char e_resulting_text_too_long[]
INIT(= N_("E1240: Resulting text too long"));
diff --git a/src/eval.c b/src/eval.c
index b3bf9d593..3f400c975 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -2363,7 +2363,7 @@ set_var_lval(

if (lp->ll_blob != NULL)
{
- int error = FALSE, val;
+ int error = FALSE;

if (op != NULL && *op != '=')
{
@@ -2384,9 +2384,14 @@ set_var_lval(
}
else
{
- val = (int)tv_get_number_chk(rettv, &error);
+ varnumber_T val = tv_get_number_chk(rettv, &error);
if (!error)
- blob_set_append(lp->ll_blob, lp->ll_n1, val);
+ {
+ if (val < 0 || val > 255)
+ semsg(_(e_invalid_value_for_blob_nr), val);
+ else
+ blob_set_append(lp->ll_blob, lp->ll_n1, val);
+ }
}
}
else if (op != NULL && *op != '=')
diff --git a/src/po/vim.pot b/src/po/vim.pot
index 09544a0c0..f250fbd17 100644
--- a/src/po/vim.pot
+++ b/src/po/vim.pot
@@ -8,7 +8,7 @@ msgid ""
msgstr ""
"Project-Id-Version: Vim
"
"Report-Msgid-Bugs-To: vim...@vim.org
"
-"POT-Creation-Date: 2025-11-27 21:26+0000
"
+"POT-Creation-Date: 2025-12-06 10:11+0100
"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE
"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>
"
"Language-Team: LANGUAGE <L...@li.org>
"
@@ -7906,7 +7906,7 @@ msgid "E1238: Blob required for argument %d"
msgstr ""

#, c-format
-msgid "E1239: Invalid value for blob: %d"
+msgid "E1239: Invalid value for blob: 0x%lX"
msgstr ""

msgid "E1240: Resulting text too long"
diff --git a/src/testdir/test_blob.vim b/src/testdir/test_blob.vim
index f4177a63d..a70cdcf61 100644
--- a/src/testdir/test_blob.vim
+++ b/src/testdir/test_blob.vim
@@ -876,4 +876,13 @@ func Test_blob_items()
call v9.CheckSourceLegacyAndVim9Success(lines)
endfunc

+" Test for setting a byte in a blob with invalid value
+func Test_blob_byte_set_invalid_value()
+ let lines =<< trim END
+ VAR b = 0zD0C3E4E18E1B
+ LET b[0] = 229539777187355
+ END
+ call v9.CheckSourceLegacyAndVim9Failure(lines, 'E1239: Invalid value for blob:')
+endfunc
+
" vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index ef8c96fa3..bb964b62a 100644
--- a/src/version.c
+++ b/src/version.c
@@ -729,6 +729,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 1954,
/**/
1953,
/**/
diff --git a/src/vim9execute.c b/src/vim9execute.c
index 87a3e9d66..13334e58e 100644
--- a/src/vim9execute.c
+++ b/src/vim9execute.c
@@ -2526,6 +2526,11 @@ execute_storeindex(isn_T *iptr, ectx_T *ectx)
nr = tv_get_number_chk(tv, &error);
if (error)
return FAIL;
+ if (nr < 0 || nr > 255)
+ {
+ semsg(_(e_invalid_value_for_blob_nr), nr);
+ return FAIL;
+ }
blob_set_append(blob, lidx, nr);
}
else if (dest_type == VAR_CLASS || dest_type == VAR_OBJECT)