From 69a9a25fccd3e59f604888e2d9c29a822e14cca9 Mon Sep 17 00:00:00 2001
From: zeertzjq <zeertzjq@outlook.com>
Date: Thu, 2 Oct 2025 07:50:00 +0800
Subject: [PATCH] vim-patch:9.1.0689: [security]: buffer-overflow in
 do_search() with 'rightleft'

Problem:  buffer-overflow in do_search() with 'rightleft'
          (SuyueGuo)
Solution: after reversing the text (which allocates a new buffer),
          re-calculate the text length

Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-v2x2-cjcg-f9jm

https://github.com/vim/vim/commit/cacb6693c10bb19f28a50eca47bc4bc33eccbae3

Add missing change from patch 8.1.1270.
Omit `call delete('Untitled')`: moved again in patch 9.1.0695.

Co-authored-by: Christian Brabandt <cb@256bit.org>
---
 src/nvim/search.c                            |   3 ++-
 test/old/testdir/crash/reverse_text_overflow | Bin 0 -> 314 bytes
 test/old/testdir/test_crash.vim              |   8 ++++++++
 3 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100644 test/old/testdir/crash/reverse_text_overflow

diff --git a/src/nvim/search.c b/src/nvim/search.c
index d2cbbec4c9..fe0bceef62 100644
--- a/src/nvim/search.c
+++ b/src/nvim/search.c
@@ -1282,9 +1282,10 @@ int do_search(oparg_T *oap, int dirc, int search_delim, char *pat, size_t patlen
         // it would be blanked out again very soon.  Show it on the
         // left, but do reverse the text.
         if (curwin->w_p_rl && *curwin->w_p_rlc == 's') {
-          char *r = reverse_text(trunc != NULL ? trunc : msgbuf);
+          char *r = reverse_text(msgbuf);
           xfree(msgbuf);
           msgbuf = r;
+          msgbuflen = strlen(msgbuf);
           // move reversed text to beginning of buffer
           while (*r == ' ') {
             r++;
diff --git a/test/old/testdir/crash/reverse_text_overflow b/test/old/testdir/crash/reverse_text_overflow
new file mode 100644
index 0000000000000000000000000000000000000000..dfbfe2c9a611aad20c444aec335a11c9edf0ebf6
GIT binary patch
literal 314
zcmXry<>lqo)Xd>3{;yD+%$b^>#;EYWI3vG2-%!U;y7q4gr=gA^mjYK(q5?yczCKq2
zE@01<*TBHQz?GMmT3nKvq7o=3CiYTWOw3hGOstG6!Ek;-Lk?GQD#()m^$aXr^$cPP
zT*a9=sd*)edHF@T|4Z{q>vI@As*Q9E4dP-_{-^x+sCLjXG>nT$392^K(KQej78aHU
zIhW_}q~g?)uuPDEzCN$MzP>(#0?6#59Im|lqK5w}AQ{~FBX3SBucoGET6A=ANwO{{
tCud+_AZJ-pE|;Sl%oq7Zxhg8Q5a6d0$iT?JASM9zOlGm1A+LgPJph6URf+%r

literal 0
HcmV?d00001

diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim
index 9aef245026..834a0c014c 100644
--- a/test/old/testdir/test_crash.vim
+++ b/test/old/testdir/test_crash.vim
@@ -150,6 +150,13 @@ func Test_crash1_2()
     \ ' ; echo "crash 4: [OK]" >> '.. result .. "\<cr>")
   call TermWait(buf, 150)
 
+  let file = 'crash/reverse_text_overflow'
+  let cmn_args = "%s -u NONE -i NONE -n -X -m -n -e -s -S %s -c ':qa!'"
+  let args = printf(cmn_args, vim, file)
+  call term_sendkeys(buf, args ..
+    \ ' ; echo "crash 5: [OK]" >> '.. result .. "\<cr>")
+  call TermWait(buf, 150)
+
   " clean up
   exe buf .. "bw!"
   exe "sp " .. result
@@ -158,6 +165,7 @@ func Test_crash1_2()
       \ 'crash 2: [OK]',
       \ 'crash 3: [OK]',
       \ 'crash 4: [OK]',
+      \ 'crash 5: [OK]',
       \ ]
 
   call assert_equal(expected, getline(1, '$'))