zeertzjq 4f7b6083e5 vim-patch:9.2.0331: spellfile: stack buffer overflows in spell file generation (#38948)
Problem:  spell_read_aff() uses sprintf() into a fixed-size stack buffer
          without bounds checking. store_aff_word() uses STRCAT() to
          append attacker-controlled strings into newword[MAXWLEN] without
          checking remaining space. Both are reachable via :mkspell with
          crafted .aff/.dic files (xinyi234)
Solution: Replace sprintf() with vim_snprintf() in spell_read_aff().
          Replace STRCAT() with STRNCAT() with explicit remaining-space
          calculation in store_aff_word().

closes: vim/vim#19944

https://github.com/vim/vim/commit/07faa961a05bc5ea007ab70ff483ea1b32c3371d

Co-authored-by: Christian Brabandt <cb@256bit.org>
2026-04-10 23:39:54 +00:00
2026-04-02 15:19:07 +02:00
2026-03-20 23:30:09 +01:00
2025-12-30 01:44:52 -05:00
2026-01-05 16:34:51 -08:00
2026-03-13 12:29:44 +00:00
2026-03-12 11:12:56 +01:00
2026-04-03 13:42:03 -04:00
2026-04-03 13:42:03 -04:00
2026-03-16 14:52:03 +01:00
2026-03-11 18:00:18 +01:00
2026-03-11 18:00:18 +01:00
2026-03-20 23:30:09 +01:00

Neovim

Documentation | Chat

Coverity Scan analysis Packages Debian CI Downloads

Neovim is a project that seeks to aggressively refactor Vim in order to:

See the Introduction wiki page and Roadmap for more information.

Features

See :help nvim-features for the full list, and :help news for noteworthy changes in the latest version!

Install from package

Pre-built packages for Windows, macOS, and Linux are found on the Releases page.

Managed packages are in Homebrew, Debian, Ubuntu, Fedora, Arch Linux, Void Linux, Gentoo, and more!

Install from source

See BUILD.md and supported platforms for details.

The build is CMake-based, but a Makefile is provided as a convenience. After installing the dependencies, run the following command.

make CMAKE_BUILD_TYPE=RelWithDebInfo
sudo make install

To install to a non-default location:

make CMAKE_BUILD_TYPE=RelWithDebInfo CMAKE_INSTALL_PREFIX=/full/path/
make install

CMake hints for inspecting the build:

  • cmake --build build --target help lists all build targets.
  • build/CMakeCache.txt (or cmake -LAH build/) contains the resolved values of all CMake variables.
  • build/compile_commands.json shows the full compiler invocations for each translation unit.

Transitioning from Vim

See :help nvim-from-vim for instructions.

Project layout

├─ cmake/           CMake utils
├─ cmake.config/    CMake defines
├─ cmake.deps/      subproject to fetch and build dependencies (optional)
├─ runtime/         plugins and docs
├─ src/nvim/        application source code (see src/nvim/README.md)
│  ├─ api/          API subsystem
│  ├─ eval/         Vimscript subsystem
│  ├─ event/        event-loop subsystem
│  ├─ generators/   code generation (pre-compilation)
│  ├─ lib/          generic data structures
│  ├─ lua/          Lua subsystem
│  ├─ msgpack_rpc/  RPC subsystem
│  ├─ os/           low-level platform code
│  └─ tui/          built-in UI
└─ test/            tests (see test/README.md)

License

Neovim contributions since b17d96 are licensed under the Apache 2.0 license, except for contributions copied from Vim (identified by the vim-patch token). See LICENSE.txt for details.

S
Description
Vim-fork focused on extensibility and usability
Readme 443 MiB
Languages
Vim Script 40.3%
Lua 31.8%
C 27%
CMake 0.4%
Zig 0.2%
Other 0.1%