patch 9.1.0689: [security]: buffer-overflow in do_search() with 'rightleft' Commit: https://github.com/vim/vim/commit/cacb6693c10bb19f28a50eca47bc4bc33eccbae3 Author: Christian Brabandt <cb@256bit.org> Date: Thu Aug 22 21:40:14 2024 +0200 patch 9.1.0689: [security]: buffer-overflow in do_search() with 'rightleft' Problem: buffer-overflow in do_search() with 'rightleft' (SuyueGuo) Solution: after reversing the text (which allocates a new buffer), re-calculate the text length Github Advisory: https://github.com/vim/vim/security/advisories/GHSA-v2x2-cjcg-f9jm Signed-off-by: Christian Brabandt <cb@256bit.org>

--- a/src/search.c
+++ b/src/search.c
@@ -1548,6 +1548,7 @@ do_search(
 			{
 			    vim_free(msgbuf);
 			    msgbuf = r;
+			    msgbuflen = STRLEN(msgbuf);
 			    // move reversed text to beginning of buffer
 			    while (*r != NUL && *r == ' ')
 				r++;