Files
neovim/src/nvim
zeertzjq 03af1ec931 vim-patch:9.2.0450: [security]: heap buffer overflow in spellfile.c read_compound() (#39660)
Problem:  read_compound() in spellfile.c computes the size of the regex
          pattern buffer using signed-int arithmetic on the attacker
          controlled SN_COMPOUND sectionlen.  With sectionlen=0x40000008
          and UTF-8 encoding active the multiplication wraps to 27 while
          the per-byte loop writes up to ~1B bytes, overflowing the heap.
          Reachable when loading a crafted .spl file (e.g. via 'set spell'
          after a modeline sets 'spelllang').  The cp/ap/crp allocations
          have the same int + 1 overflow class (Daniel Cervera)
Solution: Use type size_t as buffer size and reject values larger than
          COMPOUND_MAX_LEN (100000).  Apply the same size_t treatment to
          the cp/ap/crp allocations.

Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-q4jv-r9gj-6cwv

9299332917

Co-authored-by: Christian Brabandt <cb@256bit.org>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
(cherry picked from commit 0976ce255b)
2026-05-08 00:16:08 +00:00
..
2026-05-07 12:03:02 +02:00
2026-04-20 11:46:26 +00:00
2026-05-07 12:03:02 +02:00
2024-01-11 21:37:23 +01:00
2026-03-11 18:00:18 +01:00
2024-01-11 21:37:23 +01:00
2025-12-15 13:55:15 -05:00
2023-11-28 22:23:56 +01:00
2026-04-12 15:56:12 +02:00
2024-01-11 21:37:23 +01:00
2026-04-20 11:46:26 +00:00
2026-02-12 13:46:45 +01:00
2026-05-07 12:03:02 +02:00
2025-11-16 20:36:07 -08:00
2024-01-11 21:37:23 +01:00
2024-01-11 21:37:23 +01:00
2026-03-29 11:56:37 -04:00
2025-09-13 22:49:50 -04:00
2024-01-11 21:37:23 +01:00
2025-12-06 20:33:02 -05:00
2026-03-26 05:49:02 -04:00
2025-11-19 20:43:15 -08:00
2026-04-30 02:08:19 +02:00