From b2e55ed1d6c9d9af0e1afa6deedf0fec7a49c8c8 Mon Sep 17 00:00:00 2001 From: Christian Brabandt Date: Wed, 1 Apr 2026 15:03:58 +0000 Subject: patch 9.2.0278: viminfo: heap buffer overflow when reading viminfo file Problem: Reading a crafted viminfo file can cause a heap buffer overflow because the length value from getdigits() is cast to int, truncating large size_t values Solution: Remove the (int) cast when calling alloc() (sentinel404) Signed-off-by: Christian Brabandt --- src/version.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'src/version.c') diff --git a/src/version.c b/src/version.c index 075253bfd7..009c332761 100644 --- a/src/version.c +++ b/src/version.c @@ -734,6 +734,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 278, /**/ 277, /**/ -- cgit 0.0.5-2-1-g0f52