mirror of
https://git.yoctoproject.org/poky
synced 2026-09-12 06:49:32 +02:00
vim: Security Fix for CVE-2026-59857
Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-59857 [2] https://security-tracker.debian.org/tracker/CVE-2026-59857 (From OE-Core rev: 65c4b003cddf3a2489118a04c3caec37c8256df7) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Siddharth Doshi
committed by
Richard Purdie
Richard Purdie
parent
7d5a2907dd
commit
4d706214f7
110
meta/recipes-support/vim/files/CVE-2026-59857.patch
Normal file
110
meta/recipes-support/vim/files/CVE-2026-59857.patch
Normal file
@@ -0,0 +1,110 @@
|
||||
From 48287480f53acfb5e6f9172e571ed2f0508dfab2 Mon Sep 17 00:00:00 2001
|
||||
From: Hirohito Higashi <h.east.727@gmail.com>
|
||||
Date: Mon, 22 Jun 2026 13:00:36 +0900
|
||||
Subject: [PATCH 16/17] patch 9.2.0725: [security]: Stack out-of-bounds write
|
||||
in spell_soundfold_sal()
|
||||
|
||||
Problem: [security]: A crafted spell file with non-collapsing SAL rules
|
||||
can make soundfold() write one byte past the end of the
|
||||
MAXWLEN result buffer. This is the same class of
|
||||
out-of-bounds write as GHSA-q8mh-6qm3-25g4 (fixed in 9.2.0698
|
||||
for the SOFO branch), found while auditing the surrounding
|
||||
code.
|
||||
Solution: Bound the single-byte SAL result writes and the terminating
|
||||
NUL to MAXWLEN - 1, matching the SOFO branch.
|
||||
|
||||
The single-byte branch of spell_soundfold_sal() guarded its writes with
|
||||
"reslen < MAXWLEN", allowing reslen to reach MAXWLEN (254). The trailing
|
||||
"res[reslen] = NUL" then wrote at index 254 of the 254-byte stack buffer
|
||||
res[MAXWLEN], an off-by-one out-of-bounds write. Input is case-folded to
|
||||
about 253 characters, so a 253-character argument together with a SAL map
|
||||
that does not collapse (collapse_result false) reaches the boundary.
|
||||
|
||||
Related to previous issue
|
||||
[GHSA-q8mh-6qm3-25g4](https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4)
|
||||
(9.2.0698)
|
||||
|
||||
Github Security Advisory:
|
||||
https://github.com/vim/vim/security/advisories/GHSA-m3hf-xcm3-xhm2
|
||||
|
||||
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
||||
Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
|
||||
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
||||
|
||||
Upstream-Status: Backport [https://github.com/vim/vim/commit/d22ff1c955ff87e8273210eae125aab0e85b6c30]
|
||||
CVE: CVE-2026-59857
|
||||
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
|
||||
---
|
||||
src/spell.c | 6 +++---
|
||||
src/testdir/test_spellfile.vim | 24 ++++++++++++++++++++++++
|
||||
2 files changed, 27 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/src/spell.c b/src/spell.c
|
||||
index a7909ef46e..05d6f0159d 100644
|
||||
--- a/src/spell.c
|
||||
+++ b/src/spell.c
|
||||
@@ -3516,7 +3516,7 @@ spell_soundfold_sal(slang_T *slang, char_u *inword, char_u *res)
|
||||
// no '<' rule used
|
||||
i += k - 1;
|
||||
z = 0;
|
||||
- while (*s != NUL && s[1] != NUL && reslen < MAXWLEN)
|
||||
+ while (*s != NUL && s[1] != NUL && reslen < MAXWLEN - 1)
|
||||
{
|
||||
if (reslen == 0 || res[reslen - 1] != *s)
|
||||
res[reslen++] = *s;
|
||||
@@ -3526,7 +3526,7 @@ spell_soundfold_sal(slang_T *slang, char_u *inword, char_u *res)
|
||||
c = *s;
|
||||
if (strstr((char *)pf, "^^") != NULL)
|
||||
{
|
||||
- if (c != NUL)
|
||||
+ if (c != NUL && reslen < MAXWLEN - 1)
|
||||
res[reslen++] = c;
|
||||
STRMOVE(word, word + i + 1);
|
||||
i = 0;
|
||||
@@ -3545,7 +3545,7 @@ spell_soundfold_sal(slang_T *slang, char_u *inword, char_u *res)
|
||||
|
||||
if (z0 == 0)
|
||||
{
|
||||
- if (k && !p0 && reslen < MAXWLEN && c != NUL
|
||||
+ if (k && !p0 && reslen < MAXWLEN - 1 && c != NUL
|
||||
&& (!slang->sl_collapse || reslen == 0
|
||||
|| res[reslen - 1] != c))
|
||||
// condense only double letters
|
||||
diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim
|
||||
index d04d024911..c8c7ac2642 100644
|
||||
--- a/src/testdir/test_spellfile.vim
|
||||
+++ b/src/testdir/test_spellfile.vim
|
||||
@@ -383,6 +383,30 @@ func Test_spellfile_format_error()
|
||||
let &rtp = save_rtp
|
||||
endfunc
|
||||
|
||||
+" An over-length soundfold() argument must not overflow the MAXWLEN result
|
||||
+" buffer in the single-byte branch of spell_soundfold_sal().
|
||||
+func Test_spellfile_soundfold_sal_overflow()
|
||||
+ let save_enc = &encoding
|
||||
+ set encoding=latin1
|
||||
+ " A SAL map that appends without collapsing, so the result is not shorter
|
||||
+ " than the input.
|
||||
+ call writefile(['SET ISO8859-1', 'SAL collapse_result false',
|
||||
+ \ 'SAL a aaaa', 'SAL b bbbb'], 'Xsal.aff')
|
||||
+ call writefile(['2', 'hello', 'world'], 'Xsal.dic')
|
||||
+ mkspell! Xsal Xsal
|
||||
+ set spl=Xsal.latin1.spl spell
|
||||
+
|
||||
+ " 253 input characters hit the buffer boundary; the result must not exceed
|
||||
+ " MAXWLEN - 1.
|
||||
+ call assert_true(strlen(soundfold(repeat('a', 253))) <= 253)
|
||||
+
|
||||
+ set nospell spl& spelllang&
|
||||
+ call delete('Xsal.aff')
|
||||
+ call delete('Xsal.dic')
|
||||
+ call delete('Xsal.latin1.spl')
|
||||
+ let &encoding = save_enc
|
||||
+endfunc
|
||||
+
|
||||
" Test for format errors in suggest file
|
||||
func Test_sugfile_format_error()
|
||||
let save_rtp = &rtp
|
||||
--
|
||||
2.44.4
|
||||
|
||||
@@ -47,6 +47,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \
|
||||
file://CVE-2026-57452.patch \
|
||||
file://CVE-2026-57455.patch \
|
||||
file://CVE-2026-59856.patch \
|
||||
file://CVE-2026-59857.patch \
|
||||
"
|
||||
|
||||
PV .= ".1683"
|
||||
|
||||
Reference in New Issue
Block a user