Files
neovim/src/nvim
zeertzjq 0e69a38026 vim-patch:9.2.0436: Buffer overflow when parsing overlong errorformat lines (#39578)
Problem:  When an error line in a file passed to :cfile / :cgetfile is
          longer than IOSIZE, qf_parse_file_pfx() copies the tail
          into the fixed-size IObuff with STRMOVE(), overflowing the heap buffer.
          The same code path can also loop indefinitely because
          qf_parse_file_pfx() always returns QF_MULTISCAN when a
          tail is present, and qf_init_ext() unconditionally goes
          to "restofline" without bounding the tail length (Nabih).
Solution: Remove the STRMOVE() into IObuff.  In the QF_MULTISCAN
          branch, alias linebuf into the tail directly and update
          linelen, requiring strict progress (new length less than
          the previous length) before retrying; otherwise ignore
          the line.

closes: vim/vim#20126

Supported by AI

77677c33de

Co-authored-by: Christian Brabandt <cb@256bit.org>
2026-05-04 07:20:16 +08:00
..
2026-04-26 20:25:49 +02:00
2026-04-14 18:39:38 +02:00
2026-04-10 11:08:26 -05:00
2024-01-11 21:37:23 +01:00
2026-03-11 18:00:18 +01:00
2024-01-11 21:37:23 +01:00
2025-12-15 13:55:15 -05:00
2023-11-28 22:23:56 +01:00
2026-04-12 14:17:50 +02:00
2024-01-11 21:37:23 +01:00
2026-04-14 18:39:38 +02:00
2026-04-14 18:39:38 +02:00
2026-04-20 07:09:37 -04:00
2026-04-14 18:39:38 +02:00
2026-02-12 13:46:45 +01:00
2026-04-14 18:39:38 +02:00
2025-11-16 20:36:07 -08:00
2024-01-11 21:37:23 +01:00
2024-01-11 21:37:23 +01:00
2026-03-29 11:56:37 -04:00
2025-09-13 22:49:50 -04:00
2024-01-11 21:37:23 +01:00
2025-12-06 20:33:02 -05:00
2026-05-01 10:01:40 -04:00
2025-11-19 20:43:15 -08:00
2026-04-29 17:37:47 -04:00