rpms/vim
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import UBI vim-9.1.083-9.el10_2.12

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-07-30 09:15:49 -04:00
parent 111a6062a1
commit 3016cdccc8
7 changed files with 626 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

81
0001-patch-9.2.0653-security-out-of-bounds-write-in-tree_.patch Normal file
View File

@ -0,0 +1,81 @@
From 29dc27209d72a030cc3c0c21755dd00258c3e4e7 Mon Sep 17 00:00:00 2001
From: Christian Brabandt <cb@256bit.org>
Date: Mon, 15 Jun 2026 19:39:08 +0000
Subject: [PATCH] patch 9.2.0653: [security]: out-of-bounds write in
tree_count_words()
Problem: [security]: a crafted spell file can drive tree_count_words()
past the end of its MAXWLEN-sized depth arrays; the descent
loop has no depth bound.
Solution: only descend while depth < MAXWLEN - 1, as the sibling trie
walkers already do; apply the same guard to sug_filltree().
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq
Supported by AI.
Signed-off-by: Christian Brabandt <cb@256bit.org>
---
src/spellfile.c | 4 ++--
src/testdir/test_spellfile.vim | 27 +++++++++++++++++++++++++++
2 files changed, 29 insertions(+), 2 deletions(-)
diff --git a/src/spellfile.c b/src/spellfile.c
index 24df042b7..988bb56c0 100644
--- a/src/spellfile.c
+++ b/src/spellfile.c
@@ -645,7 +645,7 @@ tree_count_words(char_u *byts, idx_T *idxs)
++curi[depth];
}
}
- else
+ else if (depth < MAXWLEN - 1)
{
// Normal char, go one level deeper to count the words.
++depth;
@@ -5648,7 +5648,7 @@ sug_filltree(spellinfo_T *spin, slang_T *slang)
++curi[depth];
}
}
- else
+ else if (depth < MAXWLEN - 1)
{
// Normal char, go one level deeper.
tword[depth++] = c;
diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim
index 547748db2..2367f6c20 100644
--- a/src/testdir/test_spellfile.vim
+++ b/src/testdir/test_spellfile.vim
@@ -1174,3 +1174,31 @@ endfunc
endfunc
+
+func Test_spell_sug_tree_count_words_overflow()
+ " A crafted .spl/.sug pair with a BY_INDEX self-cycle in the fold word tree
+ " parses cleanly (shared refs aren't recursed, so read_tree_node()'s depth
+ " cap never trips), but drove tree_count_words() past its MAXWLEN-sized depth
+ " arrays -> stack out-of-bounds write. The walk only happens when
+ " spellsuggest() loads the matching .sug. Reaching the assert == no OOB.
+ call mkdir('Xrtp/spell', 'pR')
+ " VIMspell + v50, SN_SUGFILE(ts), SN_END, LWORDTREE{node:1,BY_INDEX->0,'A'},
+ " empty KWORDTREE/PREFIXTREE
+ let spl = eval('0z56494D7370656C6C320B0000000008000000001234'
+ \ .. '5678FF000000020101000000410000000000000000')
+ " VIMsug + v1, matching ts, SUGWORDTREE word "a", empty SUGTABLE
+ let sug = 0z56494D737567010000000012345678000000040161010000000000
+ call writefile(spl, 'Xrtp/spell/xx.utf-8.spl', 'b')
+ call writefile(sug, 'Xrtp/spell/xx.utf-8.sug', 'b')
+
+ new
+ set runtimepath+=./Xrtp
+ set spelllang=xx
+ set spell
+ " Unpatched: OOB write here (ASan abort, or crash). Patched: returns a list.
+ call assert_equal(v:t_list, type(spellsuggest('helloo')))
+
+ set spell& spelllang& runtimepath&
+ bwipe!
+endfunc
+
" vim: shiftwidth=2 sts=2 expandtab

65
0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch Normal file
View File

@ -0,0 +1,65 @@
From bd1baaff17cafc8bed6c3d376c1e2a5543317c4e Mon Sep 17 00:00:00 2001
From: Christian Brabandt <cb@256bit.org>
Date: Sun, 21 Jun 2026 19:20:03 +0000
Subject: [PATCH] patch 9.2.0698: [security]: Out-of-bounds write with
soundfold()
Problem: [security]: Out-of-bounds write with soundfold()
(cipher-creator)
Solution: Add an abort condition to the for loop to validate the buffer
size.
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4
Supported by AI
Signed-off-by: Christian Brabandt <cb@256bit.org>
---
src/spell.c | 2 +-
src/testdir/test_spellfile.vim | 21 +++++++++++++++++++++
2 files changed, 22 insertions(+), 1 deletion(-)
diff --git a/src/spell.c b/src/spell.c
index a1bbc9e23..428909eb4 100644
--- a/src/spell.c
+++ b/src/spell.c
@@ -3270,7 +3270,7 @@ spell_soundfold_sofo(slang_T *slang, char_u *inword, char_u *res)
else
{
// The sl_sal_first[] table contains the translation.
- for (s = inword; (c = *s) != NUL; ++s)
+ for (s = inword; (c = *s) != NUL && ri < MAXWLEN - 1; ++s)
{
if (VIM_ISWHITE(c))
c = ' ';
diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim
index d8d954b3b..547748db2 100644
--- a/src/testdir/test_spellfile.vim
+++ b/src/testdir/test_spellfile.vim
@@ -1153,4 +1153,25 @@ func Test_mkspell_empty_dic()
endfunc
+" A word longer than MAXWLEN must not overflow the soundfold result buffer in
+" the single-byte SOFO branch of spell_soundfold_sofo().
+func Test_soundfold_overflow()
+ let _enc=&enc
+ set enc=latin1
+ call writefile(['SOFOFROM ab', 'SOFOTO xy'], 'Xtest.aff', 'D')
+ call writefile(['1', 'foo'], 'Xtest.dic', 'D')
+ mkspell! Xtest Xtest
+ defer delete('Xtest.latin1.spl')
+ defer delete('Xtest.latin1.sug')
+ setl spelllang=Xtest.latin1.spl spell
+
+ " Before the fix the copy loop wrote one byte per input byte into a
+ " MAXWLEN (254) stack buffer with no upper bound, smashing the stack.
+ let sound = soundfold(repeat('ab', 300))
+ call assert_true(strlen(sound) < 254, 'soundfold result exceeds MAXWLEN')
+
+ set spell& spelllang&
+ let &enc = _enc
+endfunc
+
" vim: shiftwidth=2 sts=2 expandtab

173
0001-patch-9.2.0699-security-possible-code-execution-with.patch Normal file
View File

@ -0,0 +1,173 @@
From af5e82a788d676b18384171fa6fe0600ce26b9cb Mon Sep 17 00:00:00 2001
From: Christian Brabandt <cb@256bit.org>
Date: Sun, 21 Jun 2026 19:50:56 +0000
Subject: [PATCH] patch 9.2.0699: [security]: possible code execution with
python complete
Problem: [security]: possible code execution with python complete
(morningbread)
Solution: Use repr() to quote the doc strings correctly
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3
Supported by AI
Signed-off-by: Christian Brabandt <cb@256bit.org>
---
runtime/autoload/python3complete.vim | 7 ++--
runtime/autoload/pythoncomplete.vim | 7 ++--
src/testdir/Make_all.mak | 2 +
src/testdir/test_plugin_python3complete.vim | 45 +++++++++++++++++++++
4 files changed, 55 insertions(+), 6 deletions(-)
create mode 100644 src/testdir/test_plugin_python3complete.vim
diff --git a/runtime/autoload/python3complete.vim b/runtime/autoload/python3complete.vim
index 1c432f3c8..3aa590d97 100644
--- a/runtime/autoload/python3complete.vim
+++ b/runtime/autoload/python3complete.vim
@@ -17,6 +17,7 @@
" v 0.10 by Vim project
" * disables importing local modules, unless the global Vim variable
" g:pythoncomplete_allow_import is set to non-zero
+" * use repr() on doc strings to prevent code execution
"
" v 0.9
" * Fixed docstring parsing for classes and functions
@@ -315,7 +316,7 @@ class Scope(object):
def get_code(self):
str = ""
- if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += repr(self.docstr)+'\n'
str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n'
for sub in self.subscopes:
str += sub.get_code()
@@ -352,7 +353,7 @@ class Class(Scope):
str = '%sclass %s' % (self.currentindent(),self.name)
if len(self.supers) > 0: str += '(%s)' % ','.join(self.supers)
str += ':\n'
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
if len(self.subscopes) > 0:
for s in self.subscopes: str += s.get_code()
else:
@@ -369,7 +370,7 @@ class Function(Scope):
def get_code(self):
str = "%sdef %s(%s):\n" % \
(self.currentindent(),self.name,','.join(self.params))
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
str += "%spass\n" % self.childindent()
return str
diff --git a/runtime/autoload/pythoncomplete.vim b/runtime/autoload/pythoncomplete.vim
index b4340f7ae..1bc31d87e 100644
--- a/runtime/autoload/pythoncomplete.vim
+++ b/runtime/autoload/pythoncomplete.vim
@@ -15,6 +15,7 @@
" v 0.10 by Vim project
" * disables importing local modules, unless the global Vim variable
" g:pythoncomplete_allow_import is set to non-zero
+" * use repr() on doc strings to prevent code execution
"
" v 0.9
" * Fixed docstring parsing for classes and functions
@@ -330,7 +331,7 @@ class Scope(object):
def get_code(self):
str = ""
- if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += repr(self.docstr)+'\n'
str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n'
for sub in self.subscopes:
str += sub.get_code()
@@ -367,7 +368,7 @@ class Class(Scope):
str = '%sclass %s' % (self.currentindent(),self.name)
if len(self.supers) > 0: str += '(%s)' % ','.join(self.supers)
str += ':\n'
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
if len(self.subscopes) > 0:
for s in self.subscopes: str += s.get_code()
else:
@@ -384,7 +385,7 @@ class Function(Scope):
def get_code(self):
str = "%sdef %s(%s):\n" % \
(self.currentindent(),self.name,','.join(self.params))
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
str += "%spass\n" % self.childindent()
return str
diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
index 2ed089f98..66e94c0a2 100644
--- a/src/testdir/Make_all.mak
+++ b/src/testdir/Make_all.mak
@@ -228,6 +228,7 @@ NEW_TESTS = \
test_paste \
test_perl \
test_plugin_netrw \
+ test_plugin_python3complete \
test_plugin_tar \
test_plus_arg_edit \
test_popup \
@@ -479,6 +480,7 @@ NEW_TESTS_RES = \
test_paste.res \
test_perl.res \
test_plugin_netrw.res \
+ test_plugin_python3complete.res \
test_plugin_tar.res \
test_plus_arg_edit.res \
test_popup.res \
diff --git a/src/testdir/test_plugin_python3complete.vim b/src/testdir/test_plugin_python3complete.vim
new file mode 100644
index 000000000..d83f65f3b
--- /dev/null
+++ b/src/testdir/test_plugin_python3complete.vim
@@ -0,0 +1,45 @@
+" Tests for the Python omni-completion plugin (runtime/autoload/python3complete.vim).
+"
+source check.vim
+CheckFeature python3
+
+" Run omni-completion against the given buffer contents and assert that the
+" marker file was not created. Pre-patch behaviour exec()s reconstructed
+" def/class headers, which evaluates the buffer-supplied expression and
+" creates the marker file. Post-patch, the expressions are stripped.
+func s:CompleteAndExpectNoMarker(buffer_lines, marker_path, msg)
+ call delete(a:marker_path)
+ defer delete(a:marker_path)
+ let g:pythoncomplete_allow_import = 0
+ new
+ setfiletype python
+ call setline(1, a:buffer_lines)
+ call cursor(line('$'), col([line('$'), '$']))
+
+ " The PoC trigger -- direct invocation of the omnifunc with an empty base.
+ " This is the same path Vim takes for CTRL-X CTRL-O.
+ silent! call python3complete#Complete(0, '')
+
+ call assert_false(filereadable(a:marker_path),
+ \ a:msg . ' (marker ' . a:marker_path . ' was created)')
+
+ bwipe!
+ unlet! g:pythoncomplete_allow_import
+endfunc
+
+func Test_python3complete_no_exec_via_class_docstring()
+ " A class-body docstring is emitted verbatim between triple quotes by
+ " get_code() and runs at class-definition time during exec(). A single-
+ " quoted source docstring lets an embedded """ survive doc()'s leading/
+ " trailing quote strip and break out of the generated literal.
+ let marker = tempname()
+ call s:CompleteAndExpectNoMarker([
+ \ 'class Foo:',
+ \ ' ''x"""+open("' . marker . '", "w").close()+"""y''',
+ \ ' pass',
+ \ 'Foo.',
+ \ ], marker,
+ \ 'class docstring expression was evaluated during omni-completion')
+endfunc
+
+" vim: shiftwidth=2 sts=2 expandtab

127
0001-patch-9.2.0735-security-arbitrary-Ex-command-executi.patch Normal file
View File

@ -0,0 +1,127 @@
From 6c3ee4e150433e9a19858e14308ba87560640d3f Mon Sep 17 00:00:00 2001
From: Hirohito Higashi <h.east.727@gmail.com>
Date: Fri, 26 Jun 2026 15:41:24 +0900
Subject: [PATCH] patch 9.2.0735: [security]: arbitrary Ex command execution
during C omni-completion
Problem: [security]: With C omni-completion, a crafted tags file can execute
arbitrary Ex commands when completing a struct/union member
(cipher-creator)
Solution: Escape the type field before inserting it into the :vimgrep
pattern so it cannot close the pattern and start a new command
(Hirohito Higashi).
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>"
Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---
runtime/autoload/ccomplete.vim | 2 +-
src/testdir/Make_all.mak | 2 +
src/testdir/test_plugin_ccomplete.vim | 62 +++++++++++++++++++++++++++
3 files changed, 65 insertions(+), 1 deletion(-)
create mode 100644 src/testdir/test_plugin_ccomplete.vim
diff --git a/runtime/autoload/ccomplete.vim b/runtime/autoload/ccomplete.vim
index 7096dcf4a..fa69f57eb 100644
--- a/runtime/autoload/ccomplete.vim
+++ b/runtime/autoload/ccomplete.vim
@@ -560,7 +560,7 @@ def StructMembers( # {{{1
if !cached
while 1
execute 'silent! keepjumps noautocmd '
- .. n .. 'vimgrep ' .. '/\t' .. typename .. '\(\t\|$\)/j '
+ .. n .. 'vimgrep ' .. '/\t' .. escape(typename, '/\') .. '\(\t\|$\)/j '
.. fnames
qflist = getqflist()
diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
index 66e94c0a2..49c034fb3 100644
--- a/src/testdir/Make_all.mak
+++ b/src/testdir/Make_all.mak
@@ -227,6 +227,7 @@ NEW_TESTS = \
test_partial \
test_paste \
test_perl \
+ test_plugin_ccomplete \
test_plugin_netrw \
test_plugin_python3complete \
test_plugin_tar \
@@ -479,6 +480,7 @@ NEW_TESTS_RES = \
test_partial.res \
test_paste.res \
test_perl.res \
+ test_plugin_ccomplete.res \
test_plugin_netrw.res \
test_plugin_python3complete.res \
test_plugin_tar.res \
diff --git a/src/testdir/test_plugin_ccomplete.vim b/src/testdir/test_plugin_ccomplete.vim
new file mode 100644
index 000000000..a635bd50b
--- /dev/null
+++ b/src/testdir/test_plugin_ccomplete.vim
@@ -0,0 +1,62 @@
+" Tests for the C omni-completion plugin (runtime/autoload/ccomplete.vim).
+
+func s:WriteTags(lines)
+ " Mark unsorted so lookup is a linear scan regardless of entry order.
+ let tagsfile = tempname()
+ call writefile(["!_TAG_FILE_SORTED\t0\t/0/"] + a:lines, tagsfile)
+ return tagsfile
+endfunc
+
+" A crafted typeref field is interpolated into the :vimgrep pattern in
+" StructMembers(). Without escaping, "/" closes the pattern and "|" starts a
+" new Ex command, so the field runs as an Ex command during completion.
+func Test_ccomplete_no_exec_via_typeref()
+ unlet! g:ccomplete_injected
+ let tagsfile = s:WriteTags([
+ \ "myvar\tmain.c\t/^x$/;\"\tv\ttyperef:x/|let g:ccomplete_injected = 1|\"",
+ \ ])
+
+ let save_tags = &tags
+ let &tags = tagsfile
+
+ new
+ call ccomplete#Complete(1, '')
+ call ccomplete#Complete(0, 'myvar.x')
+
+ call assert_false(exists('g:ccomplete_injected'),
+ \ 'typeref field was executed as an Ex command during omni-completion')
+
+ bwipe!
+ let &tags = save_tags
+ unlet! g:ccomplete_injected
+endfunc
+
+" A legitimate typeref must still drive struct-member completion: escaping the
+" field value must not break the normal path.
+func Test_ccomplete_typeref_completion_still_works()
+ let tagsfile = s:WriteTags([
+ \ "myvar\tmain.c\t/^x$/;\"\tv\ttyperef:struct:mystruct",
+ \ "alpha\tmain.c\t/^x$/;\"\tm\tstruct:mystruct",
+ \ "beta\tmain.c\t/^x$/;\"\tm\tstruct:mystruct",
+ \ ])
+
+ let save_tags = &tags
+ let &tags = tagsfile
+
+ new
+ call ccomplete#Complete(1, '')
+ let items = ccomplete#Complete(0, 'myvar.')
+
+ call assert_equal(type([]), type(items),
+ \ 'ccomplete#Complete did not return a list')
+ let names = map(copy(items), 'v:val.word')
+ call assert_true(index(names, 'alpha') >= 0,
+ \ 'struct member "alpha" missing from completion: ' . string(names))
+ call assert_true(index(names, 'beta') >= 0,
+ \ 'struct member "beta" missing from completion: ' . string(names))
+
+ bwipe!
+ let &tags = save_tags
+endfunc
+
+" vim: shiftwidth=2 sts=2 expandtab

96
0001-patch-9.2.0736-potential-command-execution-in-PHP-om.patch Normal file
View File

@ -0,0 +1,96 @@
From 5f4ed6bb9cfc951993d9c5ca2e944e657957f9f1 Mon Sep 17 00:00:00 2001
From: Hirohito Higashi <h.east.727@gmail.com>
Date: Fri, 26 Jun 2026 20:07:01 +0900
Subject: [PATCH] patch 9.2.0736: potential command execution in PHP
omni-completion
Problem: With PHP omni-completion, a crafted file can potentially
execute arbitrary commands when completing a class member.
Solution: Quote the class name before inserting it into the search()
pattern run via win_execute().
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---
runtime/autoload/phpcomplete.vim | 3 ++-
src/testdir/Make_all.mak | 2 ++
src/testdir/test_plugin_phpcomplete.vim | 35 +++++++++++++++++++++++++
3 files changed, 39 insertions(+), 1 deletion(-)
create mode 100644 src/testdir/test_plugin_phpcomplete.vim
diff --git a/runtime/autoload/phpcomplete.vim b/runtime/autoload/phpcomplete.vim
index 5b4263ae4..93f7d8b45 100644
--- a/runtime/autoload/phpcomplete.vim
+++ b/runtime/autoload/phpcomplete.vim
@@ -2082,7 +2082,8 @@ function! phpcomplete#GetClassContentsStructure(file_path, file_lines, class_nam
let result = []
let popup_id = popup_create(a:file_lines, {'hidden': v:true})
- call win_execute(popup_id, 'call search(''\c\(class\|interface\|trait\)\_s\+'.a:class_name.'\(\>\|$\)'')')
+ call win_execute(popup_id, 'call search('
+ \ . string('\c\(class\|interface\|trait\)\_s\+' . a:class_name . '\(\>\|$\)') . ')')
call win_execute(popup_id, "let cfline = line('.')")
call win_execute(popup_id, "call search('{')")
call win_execute(popup_id, "let endline = line('.')")
diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
index 49c034fb3..b362bbbfb 100644
--- a/src/testdir/Make_all.mak
+++ b/src/testdir/Make_all.mak
@@ -229,6 +229,7 @@ NEW_TESTS = \
test_perl \
test_plugin_ccomplete \
test_plugin_netrw \
+ test_plugin_phpcomplete \
test_plugin_python3complete \
test_plugin_tar \
test_plus_arg_edit \
@@ -482,6 +483,7 @@ NEW_TESTS_RES = \
test_perl.res \
test_plugin_ccomplete.res \
test_plugin_netrw.res \
+ test_plugin_phpcomplete.res \
test_plugin_python3complete.res \
test_plugin_tar.res \
test_plus_arg_edit.res \
diff --git a/src/testdir/test_plugin_phpcomplete.vim b/src/testdir/test_plugin_phpcomplete.vim
new file mode 100644
index 000000000..7f66be47b
--- /dev/null
+++ b/src/testdir/test_plugin_phpcomplete.vim
@@ -0,0 +1,35 @@
+" Tests for the PHP omni-completion plugin (runtime/autoload/phpcomplete.vim).
+
+" A buffer class name is interpolated into a search() pattern run via
+" win_execute(). Without escaping, "'" closes the string and "|" starts a new
+" Ex command, so the name runs as an Ex command during completion.
+func Test_phpcomplete_no_exec_via_class_name()
+ unlet! g:phpcomplete_injected
+ let lines = ['<?php', 'class x {}', '']
+ let payload = "x')|let g:phpcomplete_injected = 1|call search('"
+
+ try
+ call phpcomplete#GetClassContentsStructure('x.php', lines, payload)
+ catch
+ endtry
+
+ call assert_false(exists('g:phpcomplete_injected'),
+ \ 'class name was executed as an Ex command during completion')
+
+ unlet! g:phpcomplete_injected
+endfunc
+
+func Test_phpcomplete_class_lookup_still_works()
+ let lines = ['<?php', 'class Foo {', ' public $bar;', '}', '']
+ let result = phpcomplete#GetClassContentsStructure('Foo.php', lines, 'Foo')
+
+ call assert_equal(type([]), type(result),
+ \ 'GetClassContentsStructure did not return a list')
+ call assert_true(len(result) > 0, 'no class structure returned')
+ call assert_match('class Foo', result[0].content,
+ \ 'class body missing from returned content')
+ call assert_match('bar', result[0].content,
+ \ 'class member missing from returned content')
+endfunc
+
+" vim: shiftwidth=2 sts=2 expandtab

30
0001-runtime-ccomplete-fix-type-mismatch-error.patch Normal file
View File

@ -0,0 +1,30 @@
From d9ec67691170cd3764cbf767636305e47987340f Mon Sep 17 00:00:00 2001
From: "Lars T. Kyllingstad" <lars.kyllingstad@sintef.no>
Date: Thu, 6 Jun 2024 18:37:08 +0200
Subject: [PATCH] runtime(ccomplete): fix type mismatch error
fixes: #14927
closes: #14928
Signed-off-by: Lars T. Kyllingstad <lars.kyllingstad@sintef.no>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---
runtime/autoload/ccomplete.vim | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/runtime/autoload/ccomplete.vim b/runtime/autoload/ccomplete.vim
index 7096dcf4a..355f724d0 100644
--- a/runtime/autoload/ccomplete.vim
+++ b/runtime/autoload/ccomplete.vim
@@ -210,7 +210,7 @@ export def Complete(findstart: bool, abase: string): any # {{{1
# Find the variable in the tags file(s)
var diclist: list<dict<any>> = taglist('^' .. items[0] .. '$')
# Remove members, these can't appear without something in front.
- ->filter((_, v: dict<string>): bool =>
+ ->filter((_, v: dict<any>): bool =>
v->has_key('kind') ? v.kind != 'm' : true)
res = []
--
2.55.0

55
vim.spec
View File

@ -51,7 +51,7 @@ Summary: The VIM editor
URL: http://www.vim.org/
Name: vim
Version: %{baseversion}.%{patchlevel}
Release: 9%{?dist}.7
Release: 9%{?dist}.12
Epoch: 2
# swift.vim contains Apache 2.0 with runtime library exception:
# which is taken as Apache-2.0 WITH Swift-exception - reported to legal as https://gitlab.com/fedora/legal/fedora-license-data/-/issues/188
@ -176,6 +176,36 @@ Patch3025: 0001-patch-9.2.0495-security-runtime-netrw-code-injectio.patch
Patch3026: 0001-patch-9.2.0561-security-possible-code-execution-with.patch
# https://github.com/vim/vim/commit/868ad62cb8bf8038322eab2badd31bd98b02b9df
Patch3027: 0001-patch-9.2.0568-pythoncomplete-g-pythoncomplete_allow.patch
# RHEL-192105 CVE-2026-57456 vim: possible code execution with python complete
# https://redhat.atlassian.net/browse/RHEL-192105
# https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8
# Stripped src/version.c hunk, omitted 'Last Updated' comment changes,
# created test file with only necessary parts (new test + helper function),
# added Make_all.mak entries for the new test file
Patch3028: 0001-patch-9.2.0699-security-possible-code-execution-with.patch
# RHEL-191359 CVE-2026-57455 vim: Out-of-bounds write with soundfold()
# https://redhat.atlassian.net/browse/RHEL-191359
# https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b
Patch3029: 0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch
# RHEL-194059 CVE-2026-55693 vim: out-of-bounds write in tree_count_words()
# https://redhat.atlassian.net/browse/RHEL-194059
# https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7
# Stripped src/version.c hunk (downstream patchlevel is managed separately)
Patch3030: 0001-patch-9.2.0653-security-out-of-bounds-write-in-tree_.patch
# RHEL-203857 CVE-2026-59858 arbitrary Ex command execution during C omni-completion
# https://redhat.atlassian.net/browse/RHEL-203857
# https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e
# Stripped src/version.c hunk (downstream patchlevel is managed separately)
# Resolved Make_all.mak conflicts (added only new test_plugin_ccomplete entries)
Patch3031: 0001-patch-9.2.0735-security-arbitrary-Ex-command-executi.patch
# Fix type mismatch in ccomplete.vim (fixes testsuite failure)
# https://github.com/vim/vim/commit/d9ec67691170cd3764cbf767636305e47987340f
Patch3032: 0001-runtime-ccomplete-fix-type-mismatch-error.patch
# RHEL-201113 CVE-2026-59856 potential command execution in PHP omni-completion
# https://redhat.atlassian.net/browse/RHEL-201113
# https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24
# Stripped src/version.c hunk (downstream patchlevel is managed separately)
Patch3033: 0001-patch-9.2.0736-potential-command-execution-in-PHP-om.patch
# uses autoconf in spec file
@ -521,6 +551,12 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
%patch -P 3025 -p1 -b .netrw-hist-inject
%patch -P 3026 -p1 -b .python3complete-cve
%patch -P 3027 -p1 -b .pythoncomplete-import-fix
%patch -P 3028 -p1 -b .python-docstr-repr
%patch -P 3029 -p1 -b .soundfold-overflow
%patch -P 3030 -p1 -b .tree-count-words-oob
%patch -P 3031 -p1 -b .ccomplete-ex-cmd-inject
%patch -P 3032 -p1 -b .ccomplete-type-mismatch
%patch -P 3033 -p1 -b .phpcomplete-cmd-exec
%build
cd src
@ -1151,6 +1187,23 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
%changelog
* Tue Jul 14 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:9.1.083-9.12
- RHEL-201113 CVE-2026-59856 vim: potential command execution in PHP
omni-completion
* Tue Jul 14 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:9.1.083-9.11
- RHEL-203857 CVE-2026-59858 vim: arbitrary Ex command execution
during C omni-completion
* Mon Jul 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:9.1.083-9.10
- RHEL-194059 CVE-2026-55693 vim: out-of-bounds write in tree_count_words()
* Mon Jul 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:9.1.083-9.9
- RHEL-191359 CVE-2026-57455 vim: Out-of-bounds write with soundfold()
* Sat Jul 04 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:9.1.083-9.8
- RHEL-192105 CVE-2026-57456 vim: possible code execution with python complete
* Wed Jul 01 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:9.1.083-9.7
- RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave()
- RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete