From 3ed6659549e447ff00def8edc841321e497f70a8 Mon Sep 17 00:00:00 2001
From: zeertzjq <zeertzjq@outlook.com>
Date: Wed, 5 Mar 2025 20:05:18 +0100
Subject: [PATCH] patch 9.1.1172: [security]: overflow with 'nostartofline' and
 Ex command in tag file

Problem:  heap-buffer-overflow with 'nostartofline' and Ex command in
          tag file.
Solution: Set cursor column when moving cursor to line 1 (zeertzjq).

closes: #16796

Signed-off-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---
 src/tag.c                    |  2 ++
 src/testdir/test_tagjump.vim | 17 +++++++++++++++++
 src/version.c                |  2 ++
 3 files changed, 21 insertions(+)

diff --git a/src/tag.c b/src/tag.c
index 21ff5636ac..f61f116744 100644
--- a/src/tag.c
+++ b/src/tag.c
@@ -3997,6 +3997,8 @@ jumpto_tag(
 	    ++sandbox;
 #endif
 	    curwin->w_cursor.lnum = 1;		// start command in line 1
+	    curwin->w_cursor.col = 0;
+	    curwin->w_cursor.coladd = 0;
 	    do_cmdline_cmd(pbuf);
 	    retval = OK;
 
diff --git a/src/testdir/test_tagjump.vim b/src/testdir/test_tagjump.vim
index 67bd95fe11..e4b258c57a 100644
--- a/src/testdir/test_tagjump.vim
+++ b/src/testdir/test_tagjump.vim
@@ -1633,4 +1633,21 @@ func Test_tag_guess_short()
   set tags& cpoptions-=t
 endfunc
 
+func Test_tag_excmd_with_nostartofline()
+  call writefile(["!_TAG_FILE_ENCODING\tutf-8\t//",
+        \ "f\tXfile\tascii"],
+        \ 'Xtags', 'D')
+  call writefile(['f', 'foobar'], 'Xfile', 'D')
+
+  set nostartofline
+  new Xfile
+  setlocal tags=Xtags
+  normal! G$
+  " This used to cause heap-buffer-overflow
+  tag f
+
+  bwipe!
+  set startofline&
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index aac7ed1aeb..cfb661e706 100644
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1172,
 /**/
     1171,
 /**/