From 4a1a222f73cadad33db4d36a233734963d386e35 Mon Sep 17 00:00:00 2001
From: Lily Ballard <lily@ballards.net>
Date: Sat, 4 Apr 2026 19:54:12 -0700
Subject: [PATCH] vim: enable fortify when using clang

Our vim derivations have been disabling fortify for 10 years, due to a
crash at the time that had yet to be fixed upstream. The vim configure
script tries to strip out any `_FORTIFY_SOURCE` definition provided by
the caller in favor of setting `-D_FORTIFY_SOURCE=1` itself and cites a
crash introduced in gcc 4.0 as the reason, but our MacVim package has
been running with fortify enabled without any known issues. After
testing it seems that compiling vim with clang works just fine with
fortify, but compiling it with gcc detects a buffer overflow and aborts.

We do still need to disable `strictflexarrays1` though, as vim's
`ufunc_S` struct ends with a `uf_name[4]` field that is treated as a
flexible array with a minimum length of 4.
---
 pkgs/applications/editors/vim/common.nix  | 8 ++++++--
 pkgs/applications/editors/vim/default.nix | 2 +-
 pkgs/applications/editors/vim/full.nix    | 2 +-
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index afce0284b722..1f487157eafa 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,4 +1,8 @@
-{ lib, fetchFromGitHub }:
+{
+  lib,
+  fetchFromGitHub,
+  stdenv,
+}:
 rec {
   version = "9.2.0106";
 
@@ -17,7 +21,7 @@ rec {
   enableParallelBuilding = true;
   enableParallelInstalling = false;
 
-  hardeningDisable = [ "fortify" ];
+  hardeningDisable = if stdenv.cc.isClang then [ "strictflexarrays1" ] else [ "fortify" ];
 
   # Use man from $PATH; escape sequences are still problematic.
   postPatch = ''
diff --git a/pkgs/applications/editors/vim/default.nix b/pkgs/applications/editors/vim/default.nix
index 809e9808b1be..ec3e7c9a6253 100644
--- a/pkgs/applications/editors/vim/default.nix
+++ b/pkgs/applications/editors/vim/default.nix
@@ -17,7 +17,7 @@
 }:
 
 let
-  common = callPackage ./common.nix { };
+  common = callPackage ./common.nix { inherit stdenv; };
 in
 stdenv.mkDerivation {
   pname = "vim";
diff --git a/pkgs/applications/editors/vim/full.nix b/pkgs/applications/editors/vim/full.nix
index e2d251d93b99..a2a105e3182c 100644
--- a/pkgs/applications/editors/vim/full.nix
+++ b/pkgs/applications/editors/vim/full.nix
@@ -81,7 +81,7 @@ let
     endif
   '';
 
-  common = callPackage ./common.nix { };
+  common = callPackage ./common.nix { inherit stdenv; };
 
 in
 stdenv.mkDerivation {