From 4792c2996920f3a0720b226234b466cac4757101 Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Fri, 6 Feb 2026 07:40:51 +0800 Subject: [PATCH] vim-patch:9.1.2132: [security]: buffer-overflow in 'helpfile' option handling (#37735) Problem: [security]: buffer-overflow in 'helpfile' option handling by using strcpy without bound checks (Rahul Hoysala) Solution: Limit strncpy to the length of the buffer (MAXPATHL) Github Advisory: https://github.com/vim/vim/security/advisories/GHSA-5w93-4g67-mm43 https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9 Co-authored-by: Christian Brabandt (cherry picked from commit db133879b2a115cdf982b2899f154f1851d59a60) --- src/nvim/tag.c | 2 +- test/old/testdir/test_help.vim | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/src/nvim/tag.c b/src/nvim/tag.c index ee6b0863f3..ce8e75253d 100644 --- a/src/nvim/tag.c +++ b/src/nvim/tag.c @@ -2495,7 +2495,7 @@ int get_tagfname(tagname_T *tnp, int first, char *buf) return FAIL; } tnp->tn_hf_idx++; - STRCPY(buf, p_hf); + xstrlcpy(buf, p_hf, MAXPATHL); STRCPY(path_tail(buf), "tags"); #ifdef BACKSLASH_IN_FILENAME slash_adjust(buf); diff --git a/test/old/testdir/test_help.vim b/test/old/testdir/test_help.vim index 8b7f70a7d1..77f893a90f 100644 --- a/test/old/testdir/test_help.vim +++ b/test/old/testdir/test_help.vim @@ -232,4 +232,13 @@ func Test_help_using_visual_match() endfunc +" This caused a buffer overflow +func Test_helpfile_overflow() + let _helpfile = &helpfile + let &helpfile = repeat('A', 5000) + help + helpclose + let &helpfile = _helpfile +endfunc + " vim: shiftwidth=2 sts=2 expandtab