From 761e920280ccedb823a56b9da7f02aaf4e1051aa Mon Sep 17 00:00:00 2001
From: zeertzjq <zeertzjq@outlook.com>
Date: Thu, 6 Mar 2025 07:08:53 +0800
Subject: vim-patch:9.1.1172: [security]: overflow with 'nostartofline' and Ex
 command in tag file (#32739)

Problem:  heap-buffer-overflow with 'nostartofline' and Ex command in
          tag file.
Solution: Set cursor column when moving cursor to line 1 (zeertzjq).

closes: vim/vim#16796

https://github.com/vim/vim/commit/3ed6659549e447ff00def8edc841321e497f70a8
---
 src/nvim/tag.c | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'src')

diff --git a/src/nvim/tag.c b/src/nvim/tag.c
index 557d41a467..baa862f57a 100644
--- a/src/nvim/tag.c
+++ b/src/nvim/tag.c
@@ -2986,6 +2986,8 @@ static int jumpto_tag(const char *lbuf_arg, int forceit, bool keep_help)
       secure = 1;
       sandbox++;
       curwin->w_cursor.lnum = 1;  // start command in line 1
+      curwin->w_cursor.col = 0;
+      curwin->w_cursor.coladd = 0;
       do_cmdline_cmd(pbuf);
       retval = OK;
 
-- 
cgit