mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-12 06:49:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

vim: Security Fix for CVE-2026-57456

Browse Source 
Picking patch as per [1], and same patch is mentioned in [2]

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-57456
[2] https://security-tracker.debian.org/tracker/CVE-2026-57456

(From OE-Core rev: 146c6244fdc0647f6c24b92cc8410da02645ee96)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Siddharth Doshi
2026-07-23 21:55:35 +05:30
committed by Richard Purdie
parent b3092dd954
commit dc97ef25ad
2 changed files with 91 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

90
meta/recipes-support/vim/files/CVE-2026-57456.patch Normal file
View File

@@ -0,0 +1,90 @@
From 911e10a2e8e677c3982d392e185b7d9b3e574401 Mon Sep 17 00:00:00 2001
From: Christian Brabandt <cb@256bit.org>
Date: Sun, 21 Jun 2026 19:50:56 +0000
Subject: [PATCH 14/17] patch 9.2.0699: [security]: possible code execution
with python complete
Problem: [security]: possible code execution with python complete
(morningbread)
Solution: Use repr() to quote the doc strings correctly
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3
Supported by AI
Signed-off-by: Christian Brabandt <cb@256bit.org>
Upstream-Status: Backport [https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8]
CVE: CVE-2026-57456
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
---
runtime/autoload/python3complete.vim | 6 +++---
runtime/autoload/pythoncomplete.vim | 6 +++---
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/runtime/autoload/python3complete.vim b/runtime/autoload/python3complete.vim
index 56ee636b8d..e7cd149cdd 100644
--- a/runtime/autoload/python3complete.vim
+++ b/runtime/autoload/python3complete.vim
@@ -326,7 +326,7 @@ class Scope(object):
def get_code(self):
str = ""
- if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += repr(self.docstr)+'\n'
str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n'
for sub in self.subscopes:
str += sub.get_code()
@@ -369,7 +369,7 @@ class Class(Scope):
if _DOTTED_NAME_RE.match(s.strip())]
if len(safe_supers) > 0: str += '(%s)' % ','.join(safe_supers)
str += ':\n'
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
if len(self.subscopes) > 0:
for s in self.subscopes: str += s.get_code()
else:
@@ -392,7 +392,7 @@ class Function(Scope):
safe_params = [p for p in safe_params if p]
str = "%sdef %s(%s):\n" % \
(self.currentindent(),self.name,','.join(safe_params))
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
str += "%spass\n" % self.childindent()
return str
diff --git a/runtime/autoload/pythoncomplete.vim b/runtime/autoload/pythoncomplete.vim
index 0f41405c0e..abef32faf2 100644
--- a/runtime/autoload/pythoncomplete.vim
+++ b/runtime/autoload/pythoncomplete.vim
@@ -341,7 +341,7 @@ class Scope(object):
def get_code(self):
str = ""
- if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += repr(self.docstr)+'\n'
str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n'
for sub in self.subscopes:
str += sub.get_code()
@@ -384,7 +384,7 @@ class Class(Scope):
if _DOTTED_NAME_RE.match(s.strip())]
if len(safe_supers) > 0: str += '(%s)' % ','.join(safe_supers)
str += ':\n'
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
if len(self.subscopes) > 0:
for s in self.subscopes: str += s.get_code()
else:
@@ -407,7 +407,7 @@ class Function(Scope):
safe_params = [p for p in safe_params if p]
str = "%sdef %s(%s):\n" % \
(self.currentindent(),self.name,','.join(safe_params))
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
str += "%spass\n" % self.childindent()
return str
--
2.44.4

1
meta/recipes-support/vim/vim.inc
View File

@@ -49,6 +49,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \
file://CVE-2026-59856.patch \
file://CVE-2026-59857.patch \
file://CVE-2026-59858.patch \
file://CVE-2026-57456.patch \
"
PV .= ".1683"