patch 9.2.0075: [security]: Buffer underflow with emacs tag file
Commit:
https://github.com/vim/vim/commit/9b7dfa2948c9e1e5e32a5812812d580c7879f4a0
Author: Christian Brabandt <[email protected]>
Date: Mon Feb 23 19:35:25 2026 +0000
patch 9.2.0075: [security]: Buffer underflow with emacs tag file
Problem: When parsing a malformed Emacs-style tags file, a 1-byte
heap-buffer-underflow read occurs if the 0x7f delimiter
appears at the very beginning of a line. This happens
because the code attempts to scan backward for a tag
name from the delimiter without checking if space exists.
(ehdgks0627, un3xploitable)
Solution: Add a check to ensure the delimiter (p_7f) is not at the
start of the buffer (lbuf) before attempting to isolate
the tag name.
GitHub Advisory:
https://github.com/vim/vim/security/advisories/GHSA-xcc8-r6c5-hvwv
Signed-off-by: Christian Brabandt <[email protected]>
diff --git a/src/tag.c b/src/tag.c
index 4e0cb9a6c..be64ea5ff 100644
--- a/src/tag.c
+++ b/src/tag.c
@@ -2022,6 +2022,9 @@ etag_fail:
}
else // second format: isolate tagname
{
+ if (p_7f == lbuf)
+ goto etag_fail;
+
// find end of tagname
for (p = p_7f - 1; !vim_iswordc(*p); --p)
if (p == lbuf)
diff --git a/src/testdir/test_taglist.vim b/src/testdir/test_taglist.vim
index 506e64f7a..42ecc4b76 100644
--- a/src/testdir/test_taglist.vim
+++ b/src/testdir/test_taglist.vim
@@ -316,4 +316,20 @@ func Test_evil_emacs_tagfile()
set tags&
endfunc
+" This used to crash Vim due to a heap-buffer-underflow
+func Test_emacs_tagfile_underflow()
+ CheckFeature emacs_tags
+ " The sequence from the crash artifact:
+ let lines = [
+ \ "\x0c\xff\xffT\x19\x8a",
+ \ "\x19\x19\x0dtags\x19\x19\x19\x00\xff\xff\xff",
+ \ "\x7f3\x0c"
+ \ ]
+ call writefile(lines, 'Xtags', 'D')
+ set tags=Xtags
+ call assert_fails(':tag a', 'E431:')
+
+ set tags&
+endfunc
+
" vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index c44e31e5f..f2809216a 100644
--- a/src/version.c
+++ b/src/version.c
@@ -734,6 +734,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 75,
/**/
74,
/**/
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/d/msgid/vim_dev/E1vw5Ax-00GEsI-08%40256bit.org.
