From 33e17d66c616c6e50ed4826ff3e55aef55157e4d Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Mon, 30 Mar 2026 07:20:21 +0800 Subject: [PATCH] vim-patch:9.2.0271: buffer underflow in vim_fgets() (#38575) Problem: buffer underflow in vim_fgets() Solution: Ensure size is always greater than 1 (Koda Reef) https://github.com/vim/vim/commit/3c0f8000e152ceb02619249f5ebf06d6ffe9c8d8 This currently never happens in Nvim. Co-authored-by: Koda Reef --- src/nvim/fileio.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/nvim/fileio.c b/src/nvim/fileio.c index 57848107ec..9f6ed037c7 100644 --- a/src/nvim/fileio.c +++ b/src/nvim/fileio.c @@ -2498,7 +2498,14 @@ bool vim_fgets(char *buf, int size, FILE *fp) { char *retval; - assert(size > 0); + // safety check + if (size < 2) { + if (size == 1) { + buf[0] = NUL; + } + return true; + } + buf[size - 2] = NUL; do {