mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-21 03:32:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

vim: fix CVE-2021-3872 and CVE-2021-3903

Browse Source 
Backport 2 patches to fix below CVEs:
 - CVE-2021-3872
 - CVE-2021-3903

(From OE-Core rev: baa351293ed036e63d0e3253f58ad4f2e448852c)

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Mingli Yu
2021-11-17 17:18:23 +08:00
committed by Richard Purdie
parent 097c86071e
commit 4c5d607649
3 changed files with 97 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

57
meta/recipes-support/vim/files/CVE-2021-3872.patch Normal file
View File

@@ -0,0 +1,57 @@
From 132d060ffbb9651f0d79bd0b6d80cab460235a99 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Fri, 12 Nov 2021 02:56:51 +0000
Subject: [PATCH] patch 8.2.3487: illegal memory access if buffer name is very
long
Problem: Illegal memory access if buffer name is very long.
Solution: Make sure not to go over the end of the buffer.
CVE: CVE-2021-3872
Upstream-Status: Backport [https://github.com/vim/vim/commit/826bfe4bbd7594188e3d74d2539d9707b1c6a14b]
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
---
src/drawscreen.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/src/drawscreen.c b/src/drawscreen.c
index 3a88ee979..9acb70552 100644
--- a/src/drawscreen.c
+++ b/src/drawscreen.c
@@ -446,13 +446,13 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED)
*(p + len++) = ' ';
if (bt_help(wp->w_buffer))
{
- STRCPY(p + len, _("[Help]"));
+ vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[Help]"));
len += (int)STRLEN(p + len);
}
#ifdef FEAT_QUICKFIX
if (wp->w_p_pvw)
{
- STRCPY(p + len, _("[Preview]"));
+ vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[Preview]"));
len += (int)STRLEN(p + len);
}
#endif
@@ -462,12 +462,12 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED)
#endif
)
{
- STRCPY(p + len, "[+]");
- len += 3;
+ vim_snprintf((char *)p + len, MAXPATHL - len, "%s", "[+]");
+ len += (int)STRLEN(p + len);
}
if (wp->w_buffer->b_p_ro)
{
- STRCPY(p + len, _("[RO]"));
+ vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[RO]"));
len += (int)STRLEN(p + len);
}
--
2.31.1

38
meta/recipes-support/vim/files/CVE-2021-3903.patch Normal file
View File

@@ -0,0 +1,38 @@
From a366598006f4d7bf9b4fbcd334a2e5078dcb6ad8 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Fri, 12 Nov 2021 02:23:38 +0000
Subject: [PATCH] =?UTF-8?q?patch=208.2.3564:=20invalid=20memory=20access?=
=?UTF-8?q?=20when=20scrolling=20without=20valid=20sc=E2=80=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
…reen
Problem: Invalid memory access when scrolling without a valid screen.
Solution: Do not set VALID_BOTLINE in w_valid.
CVE: CVE-2021-3903
Upstream-Status: Backport [https://github.com/vim/vim/commit/777e7c21b7627be80961848ac560cb0a9978ff43]
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
---
src/move.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/src/move.c b/src/move.c
index 8e53d8bcb..10165ef4d 100644
--- a/src/move.c
+++ b/src/move.c
@@ -198,7 +198,6 @@ update_topline(void)
{
curwin->w_topline = curwin->w_cursor.lnum;
curwin->w_botline = curwin->w_topline;
- curwin->w_valid |= VALID_BOTLINE|VALID_BOTLINE_AP;
curwin->w_scbind_pos = 1;
return;
}
--
2.31.1

2
meta/recipes-support/vim/vim.inc
View File

@@ -20,6 +20,8 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \
file://CVE-2021-3778.patch \
file://CVE-2021-3796.patch \
file://b7081e135a16091c93f6f5f7525a5c58fb7ca9f9.patch \
file://CVE-2021-3903.patch \
file://CVE-2021-3872.patch \
"
SRCREV = "98056533b96b6b5d8849641de93185dd7bcadc44"