patch 9.2.0316: [security]: command injection in netbeans interface via defineAnnoType

Problem:  [security]: The netbeans defineAnnoType command passes typeName, fg and bg
          unsanitized to coloncmd(), allowing a malicious server to inject
          arbitrary Ex commands via '|'. Similarly, specialKeys does not
          validate key tokens before building a map command.
Solution: Validate typeName, fg and bg against an allowlist of safe
          characters before passing them to coloncmd()

Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-mr87-rhgv-7pw6

Supported by AI

Signed-off-by: Christian Brabandt <cb@256bit.org>

runtime/doc/channel.txt

@@ -674,7 +674,9 @@ ch_listen({address} [, {options}])		*E1573* *E1574* *ch_listen()*
 		Returns a Channel.  Use |ch_status()| to check for failure.
 
 		{address} is a String, see |channel-address| for the possible
-		accepted forms.  Note: IPv6 is not yet supported.
+		accepted forms, however binding to all interfaces is not
+		allowed for security reasons.
+		Note: IPv6 is not yet supported.
 
 		If {options} is given it must be a |Dictionary|.
 		See |channel-open-options|.

runtime/doc/netbeans.txt

@@ -1,4 +1,4 @@
-*netbeans.txt*	For Vim version 9.2.  Last change: 2026 Feb 14
+*netbeans.txt*	For Vim version 9.2.  Last change: 2026 Mar 07
 
 
 		  VIM REFERENCE MANUAL	  by Gordon Prieur et al.
@@ -849,7 +849,7 @@ REJECT		Not used.
 These errors occur when a message violates the protocol:
 *E627* *E628* *E629* *E632* *E633* *E634* *E635* *E636*
 *E637* *E638* *E639* *E640* *E641* *E642* *E643* *E644* *E645* *E646*
-*E647* *E648* *E650* *E651* *E652*
+*E647* *E648* *E649* *E650* *E651* *E652*
 
 
 ==============================================================================

runtime/doc/options.txt

@@ -1,4 +1,4 @@
-*options.txt*	For Vim version 9.2.  Last change: 2026 Apr 03
+*options.txt*	For Vim version 9.2.  Last change: 2026 Apr 06
 
 
 		  VIM REFERENCE MANUAL	  by Bram Moolenaar
@@ -5212,7 +5212,8 @@ A jump table for the options with a short description can be found at |Q_op|.
 	command line has no uppercase characters, the added character is
 	converted to lowercase.
 	CTRL-R CTRL-W can be used to add the word at the end of the current
-	match, excluding the characters that were already typed.
+	match, excluding the characters that were already typed (starting from
+	the beginning of the word).
 	NOTE: This option is reset when 'compatible' is set.
 
 						*'indentexpr'* *'inde'*

runtime/doc/tags

@@ -5298,6 +5298,7 @@ E645	netbeans.txt	/*E645*
 E646	netbeans.txt	/*E646*
 E647	netbeans.txt	/*E647*
 E648	netbeans.txt	/*E648*
+E649	netbeans.txt	/*E649*
 E65	pattern.txt	/*E65*
 E650	netbeans.txt	/*E650*
 E651	netbeans.txt	/*E651*

src/alloc.c

@@ -746,6 +746,8 @@ ga_grow_inner(garray_T *gap, int n)
     if (n < gap->ga_len / 2)
 	n = gap->ga_len / 2;
 
+    if (n > 0 && (size_t)(gap->ga_len + n) > SIZE_MAX / gap->ga_itemsize)
+	return FAIL;
     new_len = (size_t)gap->ga_itemsize * (gap->ga_len + n);
     pp = vim_realloc(gap->ga_data, new_len);
     if (pp == NULL)

src/channel.c

@@ -1513,6 +1513,12 @@ channel_listen(
     int			val = 1;
     channel_T		*channel;
 
+    if (hostname == NULL || *hostname == NUL)
+    {
+	ch_error(NULL, "Hostname/address not defined.");
+	return NULL;
+    }
+
 #ifdef MSWIN
     channel_init_winsock();
 #endif
@@ -1529,47 +1535,42 @@ channel_listen(
     vim_memset((char *)&server, 0, sizeof(server));
     server.sin_family = AF_INET;
     server.sin_port = htons(port_in);
-    if (hostname != NULL && *hostname != NUL)
-    {
+
 #ifdef FEAT_IPV6
-	struct addrinfo	hints;
-	struct addrinfo	*res = NULL;
-	int		err;
+    struct addrinfo	hints;
+    struct addrinfo	*res = NULL;
+    int		err;
 
-	CLEAR_FIELD(hints);
-	hints.ai_family = AF_INET;
-	hints.ai_socktype = SOCK_STREAM;
-	if ((err = getaddrinfo(hostname, NULL, &hints, &res)) != 0)
-	{
-	    ch_error(channel, "in getaddrinfo() in channel_listen()");
-	    PERROR(_(e_gethostbyname_in_channel_listen));
-	    channel_free(channel);
-	    return NULL;
-	}
-	memcpy(&server.sin_addr,
-		&((struct sockaddr_in *)res->ai_addr)->sin_addr,
-		sizeof(server.sin_addr));
-	freeaddrinfo(res);
-#else
-	if ((host = gethostbyname(hostname)) == NULL)
-	{
-	    ch_error(channel, "in gethostbyname() in channel_listen()");
-	    PERROR(_(e_gethostbyname_in_channel_listen));
-	    channel_free(channel);
-	    return NULL;
-	}
-	{
-	    char		*p;
-
-	    // When using host->h_addr_list[0] directly ubsan warns for it to
-	    // not be aligned.  First copy the pointer to avoid that.
-	    memcpy(&p, &host->h_addr_list[0], sizeof(p));
-	    memcpy((char *)&server.sin_addr, p, host->h_length);
-	}
-#endif
+    CLEAR_FIELD(hints);
+    hints.ai_family = AF_INET;
+    hints.ai_socktype = SOCK_STREAM;
+    if ((err = getaddrinfo(hostname, NULL, &hints, &res)) != 0)
+    {
+	ch_error(channel, "in getaddrinfo() in channel_listen()");
+	PERROR(_(e_gethostbyname_in_channel_listen));
+	channel_free(channel);
+	return NULL;
     }
-    else
-	server.sin_addr.s_addr = htonl(INADDR_ANY);
+    memcpy(&server.sin_addr,
+	&((struct sockaddr_in *)res->ai_addr)->sin_addr,
+	sizeof(server.sin_addr));
+    freeaddrinfo(res);
+#else
+    if ((host = gethostbyname(hostname)) == NULL)
+    {
+	ch_error(channel, "in gethostbyname() in channel_listen()");
+	PERROR(_(e_gethostbyname_in_channel_listen));
+	channel_free(channel);
+	return NULL;
+    }
+
+    char		*p;
+
+    // When using host->h_addr_list[0] directly ubsan warns for it to
+    // not be aligned.  First copy the pointer to avoid that.
+    memcpy(&p, &host->h_addr_list[0], sizeof(p));
+    memcpy((char *)&server.sin_addr, p, host->h_length);
+#endif
 
     sd = socket(AF_INET, SOCK_STREAM, 0);
     if (sd == -1)
@@ -1631,7 +1632,7 @@ channel_listen(
     channel->ch_listen = TRUE;
     channel->CH_SOCK_FD = (sock_T)sd;
     channel->ch_nb_close_cb = nb_close_cb;
-    channel->ch_hostname = (char *)vim_strsave((char_u *)(hostname != NULL ? hostname : ""));
+    channel->ch_hostname = (char *)vim_strsave((char_u *)hostname);
     channel->ch_port = port_in;
     channel->ch_to_be_closed |= (1U << PART_SOCK);
 
@@ -2289,6 +2290,8 @@ channel_consume(channel_T *channel, ch_part_T part, int len)
     readq_T *node = head->rq_next;
     char_u *buf = node->rq_buffer;
 
+    if (len < 0 || (long_u)len > node->rq_buflen)
+	return;
     mch_memmove(buf, buf + len, node->rq_buflen - len);
     node->rq_buflen -= len;
     node->rq_buffer[node->rq_buflen] = NUL;
@@ -4299,6 +4302,10 @@ channel_read(channel_T *channel, ch_part_T part, char *func)
 	    newchannel->CH_SOCK_FD = (sock_T)newfd;
 	    newchannel->ch_to_be_closed |= (1U << PART_SOCK);
 
+#ifdef FEAT_GUI
+	    channel_gui_register_one(newchannel, PART_SOCK);
+#endif
+
 	    if (client.ss_family == AF_INET)
 	    {
 #ifdef HAVE_INET_NTOP

src/drawline.c

@@ -1213,13 +1213,19 @@ win_line(
     int		save_did_emsg;
 #endif
 #ifdef FEAT_PROP_POPUP
+# define WIN_LINE_TEXT_PROP_STACK_LEN 32
     int		did_line = FALSE;	// set to TRUE when line text done
     int		text_prop_count;
     int		last_textprop_text_idx = -1;
     int		text_prop_next = 0;	// next text property to use
+    textprop_T	text_props_buf[WIN_LINE_TEXT_PROP_STACK_LEN];
+    int		text_prop_idxs_buf[WIN_LINE_TEXT_PROP_STACK_LEN];
+    char_u	text_prop_suffix_flags_buf[WIN_LINE_TEXT_PROP_STACK_LEN + 1];
     textprop_T	*text_props = NULL;
     int		*text_prop_idxs = NULL;
+    char_u	*text_prop_suffix_flags = NULL;
     int		text_props_active = 0;
+    int		text_props_need_sort = FALSE;
     proptype_T  *text_prop_type = NULL;
     int		text_prop_attr = 0;
     int		text_prop_attr_comb = 0;  // text_prop_attr combined with
@@ -1694,15 +1700,40 @@ win_line(
     {
 	// Make a copy of the properties, so that they are properly
 	// aligned.
-	text_props = ALLOC_MULT(textprop_T, text_prop_count);
+	if (text_prop_count <= WIN_LINE_TEXT_PROP_STACK_LEN)
+	    text_props = text_props_buf;
+	else
+	    text_props = ALLOC_MULT(textprop_T, text_prop_count);
 	if (text_props != NULL)
 	    mch_memmove(text_props, prop_start,
 				     text_prop_count * sizeof(textprop_T));
 
 	// Allocate an array for the indexes.
-	text_prop_idxs = ALLOC_MULT(int, text_prop_count);
+	if (text_prop_count <= WIN_LINE_TEXT_PROP_STACK_LEN)
+	    text_prop_idxs = text_prop_idxs_buf;
+	else
+	    text_prop_idxs = ALLOC_MULT(int, text_prop_count);
 	if (text_prop_idxs == NULL)
-	    VIM_CLEAR(text_props);
+	{
+	    if (text_props != text_props_buf)
+		VIM_CLEAR(text_props);
+	    else
+		text_props = NULL;
+	}
+	if (text_prop_count <= WIN_LINE_TEXT_PROP_STACK_LEN)
+	    text_prop_suffix_flags = text_prop_suffix_flags_buf;
+	else
+	    text_prop_suffix_flags = ALLOC_MULT(char_u, text_prop_count + 1);
+	if (text_prop_suffix_flags == NULL)
+	{
+	    if (text_prop_idxs != text_prop_idxs_buf)
+		vim_free(text_prop_idxs);
+	    text_prop_idxs = NULL;
+	    if (text_props != text_props_buf)
+		VIM_CLEAR(text_props);
+	    else
+		text_props = NULL;
+	}
 
 	if (text_props != NULL)
 	{
@@ -1736,6 +1767,20 @@ win_line(
 		    else
 			++wlv.text_prop_above_count;
 		}
+
+	    text_prop_suffix_flags[text_prop_count] = 0;
+	    for (int i = text_prop_count - 1; i >= 0; --i)
+	    {
+		int flags = text_prop_suffix_flags[i + 1];
+
+		if (text_props[i].tp_col == MAXCOL)
+		{
+		    flags |= 1;
+		    if (text_props[i].tp_flags & TP_FLAG_ALIGN_BELOW)
+			flags |= 2;
+		}
+		text_prop_suffix_flags[i] = flags;
+	    }
 	}
     }
 
@@ -1745,8 +1790,12 @@ win_line(
 	wlv.row += wlv.text_prop_above_count;
 	if (wlv.row >= endrow)
 	{
-	    vim_free(text_props);
-	    vim_free(text_prop_idxs);
+	    if (text_props != text_props_buf)
+		vim_free(text_props);
+	    if (text_prop_idxs != text_prop_idxs_buf)
+		vim_free(text_prop_idxs);
+	    if (text_prop_suffix_flags != text_prop_suffix_flags_buf)
+		vim_free(text_prop_suffix_flags);
 	    return wlv.row;
 	}
 	wlv.screen_row += wlv.text_prop_above_count;
@@ -2122,6 +2171,7 @@ win_line(
 					sizeof(int)
 					     * (text_props_active - (pi + 1)));
 			--text_props_active;
+			text_props_need_sort = TRUE;
 			--pi;
 # ifdef FEAT_LINEBREAK
 			// not exactly right but should work in most cases
@@ -2164,7 +2214,10 @@ win_line(
 		    }
 
 		    if (active)
+		    {
 			text_prop_idxs[text_props_active++] = text_prop_next;
+			text_props_need_sort = TRUE;
+		    }
 		    ++text_prop_next;
 		}
 
@@ -2190,10 +2243,14 @@ win_line(
 		    text_prop_above = FALSE;
 		    text_prop_follows = FALSE;
 
-		    // Sort the properties on priority and/or starting last.
-		    // Then combine the attributes, highest priority last.
-		    sort_text_props(wp->w_buffer, text_props,
-					    text_prop_idxs, text_props_active);
+		    if (text_props_need_sort)
+		    {
+			// The active set only changes when a property starts
+			// or ends, so avoid sorting again for every column.
+			sort_text_props(wp->w_buffer, text_props,
+					text_prop_idxs, text_props_active);
+			text_props_need_sort = FALSE;
+		    }
 
 		    for (pi = 0; pi < text_props_active; ++pi)
 		    {
@@ -2402,19 +2459,10 @@ win_line(
 		    // Or when not wrapping and at the rightmost column.
 
 		    int only_below_follows = !wp->w_p_wrap && wlv.col == wp->w_width - 1;
-		    // TODO: Store "after"/"right"/"below" text properties in order
-		    //       in the buffer so only `text_props[text_prop_count - 1]`
-		    //       needs to be checked for following "below" virtual text
-		    for (int i = text_prop_next; i < text_prop_count; ++i)
-		    {
-			if (text_props[i].tp_col == MAXCOL
-				&& (!only_below_follows
-				    || (text_props[i].tp_flags & TP_FLAG_ALIGN_BELOW)))
-			{
-			    text_prop_follows = TRUE;
-			    break;
-			}
-		    }
+		    int suffix_flags = text_prop_suffix_flags[text_prop_next];
+
+		    text_prop_follows = (suffix_flags
+					& (only_below_follows ? 2 : 1)) != 0;
 		}
 	    }
 
@@ -4500,8 +4548,12 @@ win_line(
 
     }	// for every character in the line
 #ifdef FEAT_PROP_POPUP
-    vim_free(text_props);
-    vim_free(text_prop_idxs);
+    if (text_props != text_props_buf)
+	vim_free(text_props);
+    if (text_prop_idxs != text_prop_idxs_buf)
+	vim_free(text_prop_idxs);
+    if (text_prop_suffix_flags != text_prop_suffix_flags_buf)
+	vim_free(text_prop_suffix_flags);
     vim_free(p_extra_free2);
 #endif
 

src/errors.h

@@ -1664,7 +1664,8 @@ EXTERN char e_invalid_buffer_identifier_in_setdot[]
 	INIT(= N_("E647: Invalid buffer identifier in setDot"));
 EXTERN char e_invalid_buffer_identifier_in_close[]
 	INIT(= N_("E648: Invalid buffer identifier in close"));
-// E649 unused
+EXTERN char e_invalid_identifier_in_defineannotype[]
+	INIT(= N_("E649: Invalid identifier name in defineAnnoType"));
 EXTERN char e_invalid_buffer_identifier_in_defineannotype[]
 	INIT(= N_("E650: Invalid buffer identifier in defineAnnoType"));
 EXTERN char e_invalid_buffer_identifier_in_addanno[]

src/globals.h

@@ -1737,17 +1737,17 @@ EXTERN win_T	*cmdwin_win INIT(= NULL); // window of cmdline window or NULL
 EXTERN char_u no_lines_msg[]	INIT(= N_("--No lines in buffer--"));
 
 EXTERN char typename_unknown[]	INIT(= N_("unknown"));
-EXTERN char typename_int[]	INIT(= N_("int"));
-EXTERN char typename_longint[]	INIT(= N_("long int"));
-EXTERN char typename_longlongint[]	INIT(= N_("long long int"));
-EXTERN char typename_unsignedint[]	INIT(= N_("unsigned int"));
-EXTERN char typename_unsignedlongint[]	INIT(= N_("unsigned long int"));
-EXTERN char typename_unsignedlonglongint[]	INIT(= N_("unsigned long long int"));
+EXTERN char typename_int[]	INIT(= "int");
+EXTERN char typename_longint[]	INIT(= "long int");
+EXTERN char typename_longlongint[]	INIT(= "long long int");
+EXTERN char typename_unsignedint[]	INIT(= "unsigned int");
+EXTERN char typename_unsignedlongint[]	INIT(= "unsigned long int");
+EXTERN char typename_unsignedlonglongint[]	INIT(= "unsigned long long int");
 EXTERN char typename_pointer[]	INIT(= N_("pointer"));
 EXTERN char typename_percent[]	INIT(= N_("percent"));
-EXTERN char typename_char[] INIT(= N_("char"));
+EXTERN char typename_char[] INIT(= "char");
 EXTERN char typename_string[]	INIT(= N_("string"));
-EXTERN char typename_float[]	INIT(= N_("float"));
+EXTERN char typename_float[]	INIT(= "float");
 
 /*
  * When ":global" is used to number of substitutions and changed lines is

src/insexpand.c

@@ -4538,6 +4538,8 @@ fuzzy_longest_match(void)
 	return;
     }
 
+    if ((size_t)compl_num_bests > SIZE_MAX / sizeof(compl_T *))
+	return;
     compl_best_matches = (compl_T **)alloc(compl_num_bests * sizeof(compl_T *));
     if (compl_best_matches == NULL)
 	return;

src/libvterm/src/vterm.c

@@ -181,18 +181,17 @@ INTERNAL void vterm_push_output_bytes(VTerm *vt, const char *bytes, size_t len)
 INTERNAL void vterm_push_output_vsprintf(VTerm *vt, const char *format, va_list args)
 {
   size_t len;
-#ifndef VSNPRINTF
-  // When vsnprintf() is not available (C90) fall back to vsprintf().
-  char buffer[1024]; // 1Kbyte is enough for everybody, right?
-#endif
-
 #ifdef VSNPRINTF
   len = VSNPRINTF(vt->tmpbuffer, vt->tmpbuffer_len, format, args);
-  vterm_push_output_bytes(vt, vt->tmpbuffer, len);
 #else
-  len = vsprintf(buffer, format, args);
-  vterm_push_output_bytes(vt, buffer, len);
+  // When vsnprintf() is not available (C90) fall back to vsprintf().
+  // Use the heap-allocated tmpbuffer (default 4096 bytes) instead of a small
+  // stack buffer to reduce the risk of overflow.
+  len = vsprintf(vt->tmpbuffer, format, args);
+  if (len >= vt->tmpbuffer_len)
+    len = vt->tmpbuffer_len - 1;
 #endif
+  vterm_push_output_bytes(vt, vt->tmpbuffer, len);
 }
 
 INTERNAL void vterm_push_output_sprintf(VTerm *vt, const char *format, ...)

src/list.c

@@ -118,6 +118,9 @@ list_alloc_with_items(int count)
 {
     list_T	*l;
 
+    if (count > 0
+	    && (size_t)count > (SIZE_MAX - sizeof(list_T)) / sizeof(listitem_T))
+	return NULL;
     l = (list_T *)alloc_clear(sizeof(list_T) + count * sizeof(listitem_T));
     if (l == NULL)
 	return NULL;

src/netbeans.c

@@ -40,6 +40,11 @@
 #define GUARDEDOFFSET 1000000 // base for "guarded" sign id's
 #define MAX_COLOR_LENGTH 32 // max length of color name in defineAnnoType
 
+// Characters valid in a sign/highlight group name
+#define VALID_CHARS         (char_u *)"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
+#define VALID_SIGNNAME_CHARS    VALID_CHARS "_"
+#define VALID_COLOR_CHARS       VALID_CHARS "#"
+
 // The first implementation (working only with Netbeans) returned "1.1".  The
 // protocol implemented here also supports A-A-P.
 static char *ExtEdProtocolVersion = "2.5";
@@ -77,6 +82,22 @@ static int dosetvisible = FALSE;
 static int needupdate = 0;
 static int inAtomic = 0;
 
+/*
+ * Return TRUE if "str" contains only characters from "allowed".
+ * Used to validate NetBeans-supplied strings before interpolating them
+ * into Ex commands via coloncmd().
+ */
+    static int
+nb_is_safe_string(char_u *str, char_u *allowed)
+{
+    if (str == NULL)
+	return FALSE;
+    for (char_u *p = str; *p != NUL; p++)
+	if (vim_strchr(allowed, *p) == NULL)
+	    return FALSE;
+    return TRUE;
+}
+
 /*
  * Callback invoked when the channel is closed.
  */
@@ -1949,6 +1970,15 @@ nb_do_cmd(
 		VIM_CLEAR(typeName);
 		parse_error = TRUE;
 	    }
+	    else if (!nb_is_safe_string(typeName, VALID_SIGNNAME_CHARS) ||
+		    (*fg != NUL && !nb_is_safe_string(fg, VALID_COLOR_CHARS)) ||
+		    (*bg != NUL && !nb_is_safe_string(bg, VALID_COLOR_CHARS)))
+	    {
+		nbdebug(("    invalid chars in typeName/fg/bg in defineAnnoType\n"));
+		emsg(_(e_invalid_identifier_in_defineannotype));
+		VIM_CLEAR(typeName);
+		parse_error = TRUE;
+	    }
 	    else if (typeName != NULL && tooltip != NULL && glyphFile != NULL)
 		addsigntype(buf, typeNum, typeName, tooltip, glyphFile, fg, bg);
 
@@ -2321,10 +2351,24 @@ special_keys(char_u *args)
 
 	if (strlen(tok) + i < KEYBUFLEN)
 	{
-	    vim_strncpy((char_u *)&keybuf[i], (char_u *)tok, KEYBUFLEN - i - 1);
-	    vim_snprintf(cmdbuf, sizeof(cmdbuf),
-				 "<silent><%s> :nbkey %s<CR>", keybuf, keybuf);
-	    do_map(MAPTYPE_MAP, (char_u *)cmdbuf, MODE_NORMAL, FALSE);
+	    // Only allow alphanumeric and function-key name characters.
+	    // Reject anything else to prevent map command injection.
+	    int safe = TRUE;
+	    for (char_u *tp = (char_u *)tok; *tp != NUL; tp++)
+	    {
+		if (!ASCII_ISALNUM(*tp) && *tp != '-')
+		{
+		    safe = FALSE;
+		    break;
+		}
+	    }
+	    if (safe)
+	    {
+		vim_strncpy((char_u *)&keybuf[i], (char_u *)tok, KEYBUFLEN - i - 1);
+		vim_snprintf(cmdbuf, sizeof(cmdbuf),
+				"<silent><%s> :nbkey %s<CR>", keybuf, keybuf);
+		do_map(MAPTYPE_MAP, (char_u *)cmdbuf, MODE_NORMAL, FALSE);
+	    }
 	}
 	tok = strtok(NULL, " ");
     }

src/po/de.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Vim\n"
 "Report-Msgid-Bugs-To: vim-dev@vim.org\n"
-"POT-Creation-Date: 2026-01-06 12:15+0000\n"
+"POT-Creation-Date: 2026-03-30 11:05+0900\n"
 "PO-Revision-Date: 2008-05-24 17:26+0200\n"
 "Last-Translator: Christian Brabandt <cb@256bit.org>\n"
 "Language-Team: German\n"
@@ -9427,39 +9427,15 @@ msgstr "E1571: Es muss mindestens ein Callback f
 msgid "--No lines in buffer--"
 msgstr "--Keine Zeilen im Buffer--"
 
-msgid "int"
-msgstr "int"
-
-msgid "long int"
-msgstr "long int"
-
-msgid "long long int"
-msgstr "long long int"
-
-msgid "unsigned int"
-msgstr "unsigned int"
-
-msgid "unsigned long int"
-msgstr "unsigned long int"
-
-msgid "unsigned long long int"
-msgstr "unsigned long long int"
-
 msgid "pointer"
 msgstr "pointer"
 
 msgid "percent"
 msgstr "Prozent"
 
-msgid "char"
-msgstr "char"
-
 msgid "string"
 msgstr "Zeichenkette"
 
-msgid "float"
-msgstr "Float"
-
 msgid "search hit TOP, continuing at BOTTOM"
 msgstr "Suche erreichte den ANFANG und wurde am ENDE fortgesetzt"
 

src/po/ga.po

@@ -8923,39 +8923,15 @@ msgstr "E1510: Luach r
 msgid "--No lines in buffer--"
 msgstr "--Tá an maolán folamh--"
 
-msgid "int"
-msgstr "int"
-
-msgid "long int"
-msgstr "long int"
-
-msgid "long long int"
-msgstr "long long int"
-
-msgid "unsigned int"
-msgstr "unsigned int"
-
-msgid "unsigned long int"
-msgstr "unsigned long int"
-
-msgid "unsigned long long int"
-msgstr "unsigned long long int"
-
 msgid "pointer"
 msgstr "pointeoir"
 
 msgid "percent"
 msgstr "céatadán"
 
-msgid "char"
-msgstr "char"
-
 msgid "string"
 msgstr "teaghrán"
 
-msgid "float"
-msgstr "snámhphointe"
-
 msgid "search hit TOP, continuing at BOTTOM"
 msgstr "Buaileadh an BARR le linn an chuardaigh, ag leanúint ag an mBUN"
 

src/po/hy.po

@@ -70,7 +70,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: vim_9.1_am\n"
 "Report-Msgid-Bugs-To: vim-dev@vim.org\n"
-"POT-Creation-Date: 2025-12-20 20:54+0400\n"
+"POT-Creation-Date: 2026-03-30 11:05+0900\n"
 "PO-Revision-Date: 2025-12-21 15:32+0400\n"
 "Last-Translator: Gagik Hakobyan <hakgagik@yahoo.com>\n"
 "Language-Team: Armenian\n"
@@ -9296,39 +9296,15 @@ msgstr "E1571: redraud_listener_add-ը պահանջում է առնվազն մե
 msgid "--No lines in buffer--"
 msgstr "-- Բուֆերում տողեր չկան --"
 
-msgid "int"
-msgstr "ամբողջ"
-
-msgid "long int"
-msgstr "երկար ինտ"
-
-msgid "long long int"
-msgstr "երկար երկար ինտ"
-
-msgid "unsigned int"
-msgstr "անստորագիր միջ"
-
-msgid "unsigned long int"
-msgstr "անստորագիր երկար միջ"
-
-msgid "unsigned long long int"
-msgstr "անստորագիր long long int"
-
 msgid "pointer"
 msgstr "ցուցիչ"
 
 msgid "percent"
 msgstr "տոկոս"
 
-msgid "char"
-msgstr "տառ"
-
 msgid "string"
 msgstr "տող"
 
-msgid "float"
-msgstr "սահող կետով թվանշան"
-
 msgid "search hit TOP, continuing at BOTTOM"
 msgstr "փնտրումն ավարտվել է, որոնումն սկսվելու է վերջից"
 

src/po/it.po

@@ -9328,39 +9328,15 @@ msgstr "E1575: Non posso create delle pipe"
 msgid "--No lines in buffer--"
 msgstr "--File vuoto--"
 
-msgid "int"
-msgstr "int"
-
-msgid "long int"
-msgstr "long int"
-
-msgid "long long int"
-msgstr "long long int"
-
-msgid "unsigned int"
-msgstr "unsigned int"
-
-msgid "unsigned long int"
-msgstr "unsigned long int"
-
-msgid "unsigned long long int"
-msgstr "unsigned long long int"
-
 msgid "pointer"
 msgstr "puntatore"
 
 msgid "percent"
 msgstr "percento"
 
-msgid "char"
-msgstr "carattere"
-
 msgid "string"
 msgstr "stringa"
 
-msgid "float"
-msgstr "numero a virgola mobile"
-
 #.
 #. * Some messages that can be shared are included here.
 #.

src/po/ja.euc-jp.po

@@ -14,7 +14,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Vim 9.2\n"
 "Report-Msgid-Bugs-To: vim-dev@vim.org\n"
-"POT-Creation-Date: 2026-01-06 14:41+0000\n"
+"POT-Creation-Date: 2026-03-30 11:05+0900\n"
 "PO-Revision-Date: 2026-01-19 23:15+0900\n"
 "Last-Translator: MURAOKA Taro <koron.kaoriya@gmail.com>\n"
 "Language-Team: Japanese <https://github.com/vim-jp/lang-ja>\n"
@@ -9115,39 +9115,15 @@ msgstr ""
 msgid "--No lines in buffer--"
 msgstr "--バッファに行がありません--"
 
-msgid "int"
-msgstr "int"
-
-msgid "long int"
-msgstr "long int"
-
-msgid "long long int"
-msgstr "long long int"
-
-msgid "unsigned int"
-msgstr "unsigned int"
-
-msgid "unsigned long int"
-msgstr "unsigned long int"
-
-msgid "unsigned long long int"
-msgstr "unsigned long long int"
-
 msgid "pointer"
 msgstr "pointer"
 
 msgid "percent"
 msgstr "percent"
 
-msgid "char"
-msgstr "char"
-
 msgid "string"
 msgstr "string"
 
-msgid "float"
-msgstr "float"
-
 msgid "search hit TOP, continuing at BOTTOM"
 msgstr "上まで検索したので下に戻ります"
 

src/po/ja.po

@@ -14,7 +14,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Vim 9.2\n"
 "Report-Msgid-Bugs-To: vim-dev@vim.org\n"
-"POT-Creation-Date: 2026-01-06 14:41+0000\n"
+"POT-Creation-Date: 2026-03-30 11:05+0900\n"
 "PO-Revision-Date: 2026-01-19 23:15+0900\n"
 "Last-Translator: MURAOKA Taro <koron.kaoriya@gmail.com>\n"
 "Language-Team: Japanese <https://github.com/vim-jp/lang-ja>\n"
@@ -9115,39 +9115,15 @@ msgstr ""
 msgid "--No lines in buffer--"
 msgstr "--バッファに行がありません--"
 
-msgid "int"
-msgstr "int"
-
-msgid "long int"
-msgstr "long int"
-
-msgid "long long int"
-msgstr "long long int"
-
-msgid "unsigned int"
-msgstr "unsigned int"
-
-msgid "unsigned long int"
-msgstr "unsigned long int"
-
-msgid "unsigned long long int"
-msgstr "unsigned long long int"
-
 msgid "pointer"
 msgstr "pointer"
 
 msgid "percent"
 msgstr "percent"
 
-msgid "char"
-msgstr "char"
-
 msgid "string"
 msgstr "string"
 
-msgid "float"
-msgstr "float"
-
 msgid "search hit TOP, continuing at BOTTOM"
 msgstr "上まで検索したので下に戻ります"
 

src/po/ja.sjis.po

@@ -14,7 +14,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Vim 9.2\n"
 "Report-Msgid-Bugs-To: vim-dev@vim.org\n"
-"POT-Creation-Date: 2026-01-06 14:41+0000\n"
+"POT-Creation-Date: 2026-03-30 11:05+0900\n"
 "PO-Revision-Date: 2026-01-19 23:15+0900\n"
 "Last-Translator: MURAOKA Taro <koron.kaoriya@gmail.com>\n"
 "Language-Team: Japanese <https://github.com/vim-jp/lang-ja>\n"
@@ -9115,39 +9115,15 @@ msgstr ""
 msgid "--No lines in buffer--"
 msgstr "--バッファに行がありません--"
 
-msgid "int"
-msgstr "int"
-
-msgid "long int"
-msgstr "long int"
-
-msgid "long long int"
-msgstr "long long int"
-
-msgid "unsigned int"
-msgstr "unsigned int"
-
-msgid "unsigned long int"
-msgstr "unsigned long int"
-
-msgid "unsigned long long int"
-msgstr "unsigned long long int"
-
 msgid "pointer"
 msgstr "pointer"
 
 msgid "percent"
 msgstr "percent"
 
-msgid "char"
-msgstr "char"
-
 msgid "string"
 msgstr "string"
 
-msgid "float"
-msgstr "float"
-
 msgid "search hit TOP, continuing at BOTTOM"
 msgstr "上まで検索したので下に戻ります"
 

src/po/sr.po

@@ -10,7 +10,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Vim(Serbian)\n"
 "Report-Msgid-Bugs-To: vim-dev@vim.org\n"
-"POT-Creation-Date: 2026-02-19 17:55+0000\n"
+"POT-Creation-Date: 2026-03-30 11:05+0900\n"
 "PO-Revision-Date: 2026-02-20 09:34+0400\n"
 "Last-Translator: Ivan Pešić <ivan.pesic@gmail.com>\n"
 "Language-Team: Serbian\n"
@@ -9196,39 +9196,15 @@ msgstr ""
 msgid "--No lines in buffer--"
 msgstr "--У баферу нема линија--"
 
-msgid "int"
-msgstr "целобројни"
-
-msgid "long int"
-msgstr "дуги целобројни"
-
-msgid "long long int"
-msgstr "дуги дуги целобројни"
-
-msgid "unsigned int"
-msgstr "неозначени целобројни"
-
-msgid "unsigned long int"
-msgstr "неозначени дуги целобројни"
-
-msgid "unsigned long long int"
-msgstr "неозначени дуги дуги целобројни"
-
 msgid "pointer"
 msgstr "показивач"
 
 msgid "percent"
 msgstr "проценат"
 
-msgid "char"
-msgstr "карактер"
-
 msgid "string"
 msgstr "стринг"
 
-msgid "float"
-msgstr "покретни"
-
 msgid "search hit TOP, continuing at BOTTOM"
 msgstr "претрага је достигла ВРХ, наставља се од ДНА"
 

src/po/sv.po

@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Vim 9.1\n"
 "Report-Msgid-Bugs-To: vim-dev@vim.org\n"
-"POT-Creation-Date: 2026-01-06 14:41+0000\n"
+"POT-Creation-Date: 2026-03-30 11:05+0900\n"
 "PO-Revision-Date: 2026-01-11 14:27+0100\n"
 "Last-Translator: Daniel Nylander <po@danielnylander.se>\n"
 "Language-Team: Swedish <tp-sv@listor.tp-sv.se>\n"
@@ -9294,39 +9294,15 @@ msgstr "E1571: Måste ange minst ett återanrop för redraw_listener_add"
 msgid "--No lines in buffer--"
 msgstr "--Inga rader i buffert--"
 
-msgid "int"
-msgstr "int"
-
-msgid "long int"
-msgstr "long int"
-
-msgid "long long int"
-msgstr "long long int"
-
-msgid "unsigned int"
-msgstr "osignerad int"
-
-msgid "unsigned long int"
-msgstr "osignerad long int"
-
-msgid "unsigned long long int"
-msgstr "osignerad long long int"
-
 msgid "pointer"
 msgstr "pekare"
 
 msgid "percent"
 msgstr "procent"
 
-msgid "char"
-msgstr "tecken"
-
 msgid "string"
 msgstr "sträng"
 
-msgid "float"
-msgstr "float"
-
 #.
 #. * Some messages that can be shared are included here.
 #.

src/po/ta.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Vim 9.2\n"
 "Report-Msgid-Bugs-To: vim-dev@vim.org\n"
-"POT-Creation-Date: 2026-01-06 14:41+0000\n"
+"POT-Creation-Date: 2026-03-30 11:05+0900\n"
 "PO-Revision-Date: 2026-02-16 22:09+0530\n"
 "Last-Translator: தமிழ்நேரம் <TamilNeram247@gmail.com>\n"
 "Language-Team: தமிழ்நேரம் <TamilNeram247@gmail.com>\n"
@@ -9024,39 +9024,15 @@ msgstr "E1571: redraw_listener_add க்கு குறைந்தது ஒ
 msgid "--No lines in buffer--"
 msgstr "--பஃபரில் கோடுகள் இல்லை--"
 
-msgid "int"
-msgstr "முழு எண்ணாக"
-
-msgid "long int"
-msgstr "நீண்ட எண்ணாக"
-
-msgid "long long int"
-msgstr "நீண்ட நீண்ட எண்ணாக"
-
-msgid "unsigned int"
-msgstr "கையொப்பமிடப்படாத முழு எண்ணாக"
-
-msgid "unsigned long int"
-msgstr "கையொப்பமிடப்படாத நீண்ட எண்ணாக"
-
-msgid "unsigned long long int"
-msgstr "கையொப்பமிடப்படாத நீண்ட நீண்ட எண்ணாக"
-
 msgid "pointer"
 msgstr "சுட்டி"
 
 msgid "percent"
 msgstr "விழுக்காடு"
 
-msgid "char"
-msgstr "கரி"
-
 msgid "string"
 msgstr "சரம்"
 
-msgid "float"
-msgstr "மிதவை"
-
 #.
 #. * Some messages that can be shared are included here.
 #.

src/po/tr.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Vim Turkish Localization Project\n"
 "Report-Msgid-Bugs-To: vim-dev@vim.org\n"
-"POT-Creation-Date: 2026-01-06 14:41+0000\n"
+"POT-Creation-Date: 2026-03-30 11:05+0900\n"
 "PO-Revision-Date: 2026-02-04 20:00+0300\n"
 "Last-Translator: Emir SARI <emir_sari@icloud.com>\n"
 "Language-Team: Turkish <https://github.com/bitigchi/vim>\n"
@@ -9134,39 +9134,15 @@ msgstr "E1571: redraw_listener_add için en az bir geri çağrı belirtilmelidir
 msgid "--No lines in buffer--"
 msgstr "--Arabellek içinde satır yok--"
 
-msgid "int"
-msgstr "tamsayı"
-
-msgid "long int"
-msgstr "uzun tamsayı"
-
-msgid "long long int"
-msgstr "uzun uzun tamsayı"
-
-msgid "unsigned int"
-msgstr "imzalanmamış tamsayı"
-
-msgid "unsigned long int"
-msgstr "imzalanmamış uzun tamsayı"
-
-msgid "unsigned long long int"
-msgstr "imzalanmamış uzun uzun tamsayı"
-
 msgid "pointer"
 msgstr "işaretçi"
 
 msgid "percent"
 msgstr "yüzde"
 
-msgid "char"
-msgstr "karakter"
-
 msgid "string"
 msgstr "dizi"
 
-msgid "float"
-msgstr "kayan noktalı değer"
-
 msgid "search hit TOP, continuing at BOTTOM"
 msgstr "Arama dosyanın BAŞINI geçti, dosyanın SONUNDAN sürüyor"
 

src/po/uk.cp1251.po

@@ -14,7 +14,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Vim Ukrainian\n"
 "Report-Msgid-Bugs-To: vim-dev@vim.org\n"
-"POT-Creation-Date: 2026-01-05 17:56+0200\n"
+"POT-Creation-Date: 2026-03-30 11:05+0900\n"
 "PO-Revision-Date: 2023-12-24 17:01+0200\n"
 "Last-Translator: Àíàòîë³é Ñàõí³ê <sakhnik@gmail.com>\n"
 "Language-Team: Ukrainian\n"
@@ -9448,39 +9448,15 @@ msgstr "E1571:
 msgid "--No lines in buffer--"
 msgstr "--Æîäíîãî ðÿäêà--"
 
-msgid "int"
-msgstr "int"
-
-msgid "long int"
-msgstr "long int"
-
-msgid "long long int"
-msgstr "long long int"
-
-msgid "unsigned int"
-msgstr "unsigned int"
-
-msgid "unsigned long int"
-msgstr "unsigned long int"
-
-msgid "unsigned long long int"
-msgstr "unsigned long long int"
-
 msgid "pointer"
 msgstr "pointer"
 
 msgid "percent"
 msgstr "percent"
 
-msgid "char"
-msgstr "char"
-
 msgid "string"
 msgstr "string"
 
-msgid "float"
-msgstr "float"
-
 msgid "search hit TOP, continuing at BOTTOM"
 msgstr "Ïîøóê ä³éøîâ äî ÏÎ×ÀÒÊÓ, ïðîäîâæóºòüñÿ ç ʲÍÖß"
 

src/po/uk.po

@@ -14,7 +14,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Vim Ukrainian\n"
 "Report-Msgid-Bugs-To: vim-dev@vim.org\n"
-"POT-Creation-Date: 2026-01-05 17:56+0200\n"
+"POT-Creation-Date: 2026-03-30 11:05+0900\n"
 "PO-Revision-Date: 2023-12-24 17:01+0200\n"
 "Last-Translator: Анатолій Сахнік <sakhnik@gmail.com>\n"
 "Language-Team: Ukrainian\n"
@@ -9448,39 +9448,15 @@ msgstr "E1571: Потрібно задати принаймні однин зв
 msgid "--No lines in buffer--"
 msgstr "--Жодного рядка--"
 
-msgid "int"
-msgstr "int"
-
-msgid "long int"
-msgstr "long int"
-
-msgid "long long int"
-msgstr "long long int"
-
-msgid "unsigned int"
-msgstr "unsigned int"
-
-msgid "unsigned long int"
-msgstr "unsigned long int"
-
-msgid "unsigned long long int"
-msgstr "unsigned long long int"
-
 msgid "pointer"
 msgstr "pointer"
 
 msgid "percent"
 msgstr "percent"
 
-msgid "char"
-msgstr "char"
-
 msgid "string"
 msgstr "string"
 
-msgid "float"
-msgstr "float"
-
 msgid "search hit TOP, continuing at BOTTOM"
 msgstr "Пошук дійшов до ПОЧАТКУ, продовжується з КІНЦЯ"
 

src/po/vim.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Vim\n"
 "Report-Msgid-Bugs-To: vim-dev@vim.org\n"
-"POT-Creation-Date: 2026-04-05 23:26+0800\n"
+"POT-Creation-Date: 2026-04-07 18:24+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -5867,6 +5867,9 @@ msgstr ""
 msgid "E648: Invalid buffer identifier in close"
 msgstr ""
 
+msgid "E649: Invalid identifier name in defineAnnoType"
+msgstr ""
+
 msgid "E650: Invalid buffer identifier in defineAnnoType"
 msgstr ""
 
@@ -8863,39 +8866,15 @@ msgstr ""
 msgid "--No lines in buffer--"
 msgstr ""
 
-msgid "int"
-msgstr ""
-
-msgid "long int"
-msgstr ""
-
-msgid "long long int"
-msgstr ""
-
-msgid "unsigned int"
-msgstr ""
-
-msgid "unsigned long int"
-msgstr ""
-
-msgid "unsigned long long int"
-msgstr ""
-
 msgid "pointer"
 msgstr ""
 
 msgid "percent"
 msgstr ""
 
-msgid "char"
-msgstr ""
-
 msgid "string"
 msgstr ""
 
-msgid "float"
-msgstr ""
-
 #.
 #. * Some messages that can be shared are included here.
 #.

src/po/zh_CN.UTF-8.po

@@ -19,6 +19,7 @@ msgstr ""
 "Project-Id-Version: Vim(Simplified Chinese)\n"
 "Report-Msgid-Bugs-To: vim-dev@vim.org\n"
 "POT-Creation-Date: 2026-04-05 23:26+0800\n"
+"POT-Creation-Date: 2026-03-30 11:05+0900\n"
 "PO-Revision-Date: 2025-12-28 14:27+0800\n"
 "Last-Translator: Mao-Yining\n"
 "Language-Team: Simplified Chinese\n"
@@ -9027,39 +9028,15 @@ msgstr "E1575: 无法建立管道"
 msgid "--No lines in buffer--"
 msgstr "--缓冲区无内容--"
 
-msgid "int"
-msgstr "int"
-
-msgid "long int"
-msgstr "long int"
-
-msgid "long long int"
-msgstr "long long int"
-
-msgid "unsigned int"
-msgstr "unsigned int"
-
-msgid "unsigned long int"
-msgstr "unsigned long int"
-
-msgid "unsigned long long int"
-msgstr "unsigned long long int"
-
 msgid "pointer"
 msgstr "pointer"
 
 msgid "percent"
 msgstr "percent"
 
-msgid "char"
-msgstr "char"
-
 msgid "string"
 msgstr "string"
 
-msgid "float"
-msgstr "float"
-
 msgid "search hit TOP, continuing at BOTTOM"
 msgstr "已查找到文件开头，再从结尾继续查找"
 

src/po/zh_CN.cp936.po

@@ -19,6 +19,7 @@ msgstr ""
 "Project-Id-Version: Vim(Simplified Chinese)\n"
 "Report-Msgid-Bugs-To: vim-dev@vim.org\n"
 "POT-Creation-Date: 2026-04-05 23:26+0800\n"
+"POT-Creation-Date: 2026-03-30 11:05+0900\n"
 "PO-Revision-Date: 2025-12-28 14:27+0800\n"
 "Last-Translator: Mao-Yining\n"
 "Language-Team: Simplified Chinese\n"
@@ -9027,39 +9028,15 @@ msgstr "E1575:
 msgid "--No lines in buffer--"
 msgstr "--缓冲区无内容--"
 
-msgid "int"
-msgstr "int"
-
-msgid "long int"
-msgstr "long int"
-
-msgid "long long int"
-msgstr "long long int"
-
-msgid "unsigned int"
-msgstr "unsigned int"
-
-msgid "unsigned long int"
-msgstr "unsigned long int"
-
-msgid "unsigned long long int"
-msgstr "unsigned long long int"
-
 msgid "pointer"
 msgstr "pointer"
 
 msgid "percent"
 msgstr "percent"
 
-msgid "char"
-msgstr "char"
-
 msgid "string"
 msgstr "string"
 
-msgid "float"
-msgstr "float"
-
 msgid "search hit TOP, continuing at BOTTOM"
 msgstr "已查找到文件开头，再从结尾继续查找"
 

src/po/zh_CN.po

@@ -9027,39 +9027,15 @@ msgstr "E1575:
 msgid "--No lines in buffer--"
 msgstr "--缓冲区无内容--"
 
-msgid "int"
-msgstr "int"
-
-msgid "long int"
-msgstr "long int"
-
-msgid "long long int"
-msgstr "long long int"
-
-msgid "unsigned int"
-msgstr "unsigned int"
-
-msgid "unsigned long int"
-msgstr "unsigned long int"
-
-msgid "unsigned long long int"
-msgstr "unsigned long long int"
-
 msgid "pointer"
 msgstr "pointer"
 
 msgid "percent"
 msgstr "percent"
 
-msgid "char"
-msgstr "char"
-
 msgid "string"
 msgstr "string"
 
-msgid "float"
-msgstr "float"
-
 msgid "search hit TOP, continuing at BOTTOM"
 msgstr "已查找到文件开头，再从结尾继续查找"
 

src/popupwin.c

@@ -4103,6 +4103,11 @@ popup_update_mask(win_T *wp, int width, int height)
 	return;  // cache is still valid
 
     vim_free(wp->w_popup_mask_cells);
+    if (width > 0 && (size_t)height > SIZE_MAX / (size_t)width)
+    {
+	wp->w_popup_mask_cells = NULL;
+	return;
+    }
     wp->w_popup_mask_cells = alloc_clear((size_t)width * height);
     if (wp->w_popup_mask_cells == NULL)
 	return;

src/regexp_bt.c

@@ -5525,7 +5525,7 @@ regprop(char_u *op)
       case MOPEN + 7:
       case MOPEN + 8:
       case MOPEN + 9:
-	buflen += sprintf(buf + buflen, "MOPEN%d", OP(op) - MOPEN);
+	buflen += vim_snprintf(buf + buflen, sizeof(buf) - buflen, "MOPEN%d", OP(op) - MOPEN);
 	p = NULL;
 	break;
       case MCLOSE + 0:
@@ -5540,7 +5540,7 @@ regprop(char_u *op)
       case MCLOSE + 7:
       case MCLOSE + 8:
       case MCLOSE + 9:
-	buflen += sprintf(buf + buflen, "MCLOSE%d", OP(op) - MCLOSE);
+	buflen += vim_snprintf(buf + buflen, sizeof(buf) - buflen, "MCLOSE%d", OP(op) - MCLOSE);
 	p = NULL;
 	break;
       case BACKREF + 1:
@@ -5552,7 +5552,7 @@ regprop(char_u *op)
       case BACKREF + 7:
       case BACKREF + 8:
       case BACKREF + 9:
-	buflen += sprintf(buf + buflen, "BACKREF%d", OP(op) - BACKREF);
+	buflen += vim_snprintf(buf + buflen, sizeof(buf) - buflen, "BACKREF%d", OP(op) - BACKREF);
 	p = NULL;
 	break;
       case NOPEN:
@@ -5571,7 +5571,7 @@ regprop(char_u *op)
       case ZOPEN + 7:
       case ZOPEN + 8:
       case ZOPEN + 9:
-	buflen += sprintf(buf + buflen, "ZOPEN%d", OP(op) - ZOPEN);
+	buflen += vim_snprintf(buf + buflen, sizeof(buf) - buflen, "ZOPEN%d", OP(op) - ZOPEN);
 	p = NULL;
 	break;
       case ZCLOSE + 1:
@@ -5583,7 +5583,7 @@ regprop(char_u *op)
       case ZCLOSE + 7:
       case ZCLOSE + 8:
       case ZCLOSE + 9:
-	buflen += sprintf(buf + buflen, "ZCLOSE%d", OP(op) - ZCLOSE);
+	buflen += vim_snprintf(buf + buflen, sizeof(buf) - buflen, "ZCLOSE%d", OP(op) - ZCLOSE);
 	p = NULL;
 	break;
       case ZREF + 1:
@@ -5595,7 +5595,7 @@ regprop(char_u *op)
       case ZREF + 7:
       case ZREF + 8:
       case ZREF + 9:
-	buflen += sprintf(buf + buflen, "ZREF%d", OP(op) - ZREF);
+	buflen += vim_snprintf(buf + buflen, sizeof(buf) - buflen, "ZREF%d", OP(op) - ZREF);
 	p = NULL;
 	break;
 # endif
@@ -5636,7 +5636,7 @@ regprop(char_u *op)
       case BRACE_COMPLEX + 7:
       case BRACE_COMPLEX + 8:
       case BRACE_COMPLEX + 9:
-	buflen += sprintf(buf + buflen, "BRACE_COMPLEX%d", OP(op) - BRACE_COMPLEX);
+	buflen += vim_snprintf(buf + buflen, sizeof(buf) - buflen, "BRACE_COMPLEX%d", OP(op) - BRACE_COMPLEX);
 	p = NULL;
 	break;
       case MULTIBYTECODE:
@@ -5646,12 +5646,12 @@ regprop(char_u *op)
 	p = "NEWL";
 	break;
       default:
-	buflen += sprintf(buf + buflen, "corrupt %d", OP(op));
+	buflen += vim_snprintf(buf + buflen, sizeof(buf) - buflen, "corrupt %d", OP(op));
 	p = NULL;
 	break;
     }
     if (p != NULL)
-	STRCPY(buf + buflen, p);
+	vim_strncpy((char_u *)buf + buflen, (char_u *)p, sizeof(buf) - buflen - 1);
     return (char_u *)buf;
 }
 #endif	    // DEBUG

src/spell.c

@@ -2965,7 +2965,7 @@ ex_spellrepall(exarg_T *eap UNUSED)
     }
     size_t	repl_from_len = STRLEN(repl_from);
     size_t	repl_to_len = STRLEN(repl_to);
-    int		addlen = (int)(repl_to_len - repl_from_len);
+    long	addlen = (long)repl_to_len - (long)repl_from_len;
 
     frompat = alloc(repl_from_len + 7);
     if (frompat == NULL)
@@ -2999,7 +2999,7 @@ ex_spellrepall(exarg_T *eap UNUSED)
 #if defined(FEAT_PROP_POPUP)
 	    if (curbuf->b_has_textprop && addlen != 0)
 		adjust_prop_columns(curwin->w_cursor.lnum,
-				 curwin->w_cursor.col, addlen, APC_SUBSTITUTE);
+				 curwin->w_cursor.col, (int)addlen, APC_SUBSTITUTE);
 #endif
 
 	    if (curwin->w_cursor.lnum != prev_lnum)

src/spellfile.c

@@ -1589,7 +1589,7 @@ spell_read_tree(
     len = get4c(fd);
     if (len < 0)
 	return SP_TRUNCERROR;
-    if (len >= LONG_MAX / (long)sizeof(int))
+    if ((size_t)len > SIZE_MAX / sizeof(int))
 	// Invalid length, multiply with sizeof(int) would overflow.
 	return SP_FORMERROR;
     if (len <= 0)

src/strings.c

@@ -3014,22 +3014,22 @@ format_typename(
     switch (format_typeof(type))
     {
 	case TYPE_INT:
-	    return _(typename_int);
+	    return typename_int;
 
 	case TYPE_LONGINT:
-	    return _(typename_longint);
+	    return typename_longint;
 
 	case TYPE_LONGLONGINT:
-	    return _(typename_longlongint);
+	    return typename_longlongint;
 
 	case TYPE_UNSIGNEDINT:
-	    return _(typename_unsignedint);
+	    return typename_unsignedint;
 
 	case TYPE_UNSIGNEDLONGINT:
-	    return _(typename_unsignedlongint);
+	    return typename_unsignedlongint;
 
 	case TYPE_UNSIGNEDLONGLONGINT:
-	    return _(typename_unsignedlonglongint);
+	    return typename_unsignedlonglongint;
 
 	case TYPE_POINTER:
 	    return _(typename_pointer);
@@ -3038,13 +3038,13 @@ format_typename(
 	    return _(typename_percent);
 
 	case TYPE_CHAR:
-	    return _(typename_char);
+	    return typename_char;
 
 	case TYPE_STRING:
 	    return _(typename_string);
 
 	case TYPE_FLOAT:
-	    return _(typename_float);
+	    return typename_float;
     }
 
     return _(typename_unknown);

src/testdir/test_channel.vim

@@ -2763,10 +2763,17 @@ endfunc
 
 let g:server_received_addr = ''
 let g:server_received_msg = ''
+let g:server_received_input = ''
+
+func s:test_listen_input(ch, msg)
+    let g:server_received_input = a:msg
+endfunc
 
 func s:test_listen_accept(ch, addr)
     let g:server_received_addr = a:addr
     let g:server_received_msg = ch_readraw(a:ch)
+
+    call ch_setoptions(a:ch, #{mode: "raw", callback: function('s:test_listen_input')})
 endfunction
 
 func Test_listen()
@@ -2782,7 +2789,10 @@ func Test_listen()
         return
     endif
     call ch_sendraw(handle, 'hello')
-    call WaitFor('"" != g:server_received_msg')
+    call WaitFor('"hello" == g:server_received_msg')
+    call ch_sendraw(handle, 'notify')
+    call WaitFor('"notify" == g:server_received_input')
+
     call ch_close(handle)
     call ch_close(server)
     call assert_equal('hello', g:server_received_msg)

src/testdir/test_netbeans.py

@@ -113,8 +113,8 @@ class ThreadedTCPRequestHandler(socketserver.BaseRequestHandler):
                   'endAtomic_Test' : '0:endAtomic!95\n',
                   'AnnoScale_Test' : "".join(['2:defineAnnoType!60 ' + str(i) + ' "s' + str(i) + '" "x" "=>" blue none\n' for i in range(2, 26)]),
                   'detach_Test' : '2:close!96\n1:close!97\nDETACH\n',
-                  'specialKeys_overflow_Test' : '0:specialKeys!200 "' + 'A'*80 + '-X"\n'
-
+                  'specialKeys_overflow_Test' : '0:specialKeys!200 "' + 'A'*80 + '-X"\n',
+                  'defineAnnoType_injection_Test': '1:defineAnnoType!1 "MySign guifg=red|call writefile([\'inject\'],\'Xinject\')|" "tooltip" "glyphFile" 1 2\n'
                 }
                 # execute the specified test
                 if cmd not in testmap:

src/testdir/test_netbeans.vim

@@ -1024,4 +1024,42 @@ func Test_nb_specialKeys_overflow()
   call s:run_server('Nb_specialKeys_overflow')
 endfunc
 
+func Nb_defineAnnoType_injection(port)
+  call writefile([], "Xnetbeans", 'D')
+  let g:last = 0
+
+  exe 'nbstart :localhost:' .. a:port .. ':bunny'
+  call assert_true(has("netbeans_enabled"))
+  call WaitFor('len(ReadXnetbeans()) > (g:last + 2)')
+  let g:last += 3
+
+  split Xcmdbuf
+  let cmdbufnr = bufnr()
+  call WaitFor('len(ReadXnetbeans()) > (g:last + 2)')
+  let g:last += 3
+  hide
+
+  sleep 1m
+
+  call delete('Xinject')
+  call appendbufline(cmdbufnr, '$', 'defineAnnoType_injection_Test')
+  " E475 from :sign is expected — catch it before RunServer sees it.
+  " give it a bit of time to process it
+  try
+    sleep 500m
+  catch /E475/
+  catch /E649/
+  endtry
+
+  " Injected call must not have created this file
+  call assert_false(filereadable('Xinject'))
+  call delete('Xinject')
+  bwipe! Xcmdbuf
+  nbclose
+endfunc
+
+func Test_nb_defineAnnoType_injection()
+  call ch_log('Test_nb_defineAnnoType_injection')
+  call s:run_server('Nb_defineAnnoType_injection')
+endfunc
 " vim: shiftwidth=2 sts=2 expandtab

src/version.c

@@ -734,6 +734,18 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    316,
+/**/
+    315,
+/**/
+    314,
+/**/
+    313,
+/**/
+    312,
+/**/
+    311,
 /**/
     310,
 /**/