Files
neovim/src/nvim
zeertzjq f9f2596288 vim-patch:9.2.0436: Buffer overflow when parsing overlong errorformat lines (#39578)
Problem:  When an error line in a file passed to :cfile / :cgetfile is
          longer than IOSIZE, qf_parse_file_pfx() copies the tail
          into the fixed-size IObuff with STRMOVE(), overflowing the heap buffer.
          The same code path can also loop indefinitely because
          qf_parse_file_pfx() always returns QF_MULTISCAN when a
          tail is present, and qf_init_ext() unconditionally goes
          to "restofline" without bounding the tail length (Nabih).
Solution: Remove the STRMOVE() into IObuff.  In the QF_MULTISCAN
          branch, alias linebuf into the tail directly and update
          linelen, requiring strict progress (new length less than
          the previous length) before retrying; otherwise ignore
          the line.

closes: vim/vim#20126

Supported by AI

77677c33de

Co-authored-by: Christian Brabandt <cb@256bit.org>
(cherry picked from commit 0e69a38026)
2026-05-03 23:34:55 +00:00
..
2026-04-26 22:02:34 +02:00
2026-04-20 11:46:26 +00:00
2026-03-05 10:48:25 +01:00
2026-04-25 13:51:22 -04:00
2024-01-11 21:37:23 +01:00
2026-03-11 18:00:18 +01:00
2024-01-11 21:37:23 +01:00
2025-12-15 13:55:15 -05:00
2023-11-28 22:23:56 +01:00
2026-04-12 15:56:12 +02:00
2024-01-11 21:37:23 +01:00
2026-04-20 11:46:26 +00:00
2026-02-12 13:46:45 +01:00
2026-03-20 23:30:09 +01:00
2025-11-16 20:36:07 -08:00
2024-01-11 21:37:23 +01:00
2024-01-11 21:37:23 +01:00
2026-03-29 11:56:37 -04:00
2025-09-13 22:49:50 -04:00
2024-01-11 21:37:23 +01:00
2025-12-06 20:33:02 -05:00
2026-03-26 05:49:02 -04:00
2025-11-19 20:43:15 -08:00
2026-04-30 02:08:19 +02:00