From 3016cdccc887e4621f6e9b0f4f486069bf071123 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Thu, 30 Jul 2026 09:15:49 -0400 Subject: [PATCH] import UBI vim-9.1.083-9.el10_2.12 --- ...ecurity-out-of-bounds-write-in-tree_.patch | 81 ++++++++ ...ecurity-Out-of-bounds-write-with-sou.patch | 65 +++++++ ...ecurity-possible-code-execution-with.patch | 173 ++++++++++++++++++ ...ecurity-arbitrary-Ex-command-executi.patch | 127 +++++++++++++ ...otential-command-execution-in-PHP-om.patch | 96 ++++++++++ ...me-ccomplete-fix-type-mismatch-error.patch | 30 +++ vim.spec | 55 +++++- 7 files changed, 626 insertions(+), 1 deletion(-) create mode 100644 0001-patch-9.2.0653-security-out-of-bounds-write-in-tree_.patch create mode 100644 0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch create mode 100644 0001-patch-9.2.0699-security-possible-code-execution-with.patch create mode 100644 0001-patch-9.2.0735-security-arbitrary-Ex-command-executi.patch create mode 100644 0001-patch-9.2.0736-potential-command-execution-in-PHP-om.patch create mode 100644 0001-runtime-ccomplete-fix-type-mismatch-error.patch diff --git a/0001-patch-9.2.0653-security-out-of-bounds-write-in-tree_.patch b/0001-patch-9.2.0653-security-out-of-bounds-write-in-tree_.patch new file mode 100644 index 00000000..e9d51a79 --- /dev/null +++ b/0001-patch-9.2.0653-security-out-of-bounds-write-in-tree_.patch @@ -0,0 +1,81 @@ +From 29dc27209d72a030cc3c0c21755dd00258c3e4e7 Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Mon, 15 Jun 2026 19:39:08 +0000 +Subject: [PATCH] patch 9.2.0653: [security]: out-of-bounds write in + tree_count_words() + +Problem: [security]: a crafted spell file can drive tree_count_words() + past the end of its MAXWLEN-sized depth arrays; the descent + loop has no depth bound. +Solution: only descend while depth < MAXWLEN - 1, as the sibling trie + walkers already do; apply the same guard to sug_filltree(). + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq + +Supported by AI. + +Signed-off-by: Christian Brabandt +--- + src/spellfile.c | 4 ++-- + src/testdir/test_spellfile.vim | 27 +++++++++++++++++++++++++++ + 2 files changed, 29 insertions(+), 2 deletions(-) + +diff --git a/src/spellfile.c b/src/spellfile.c +index 24df042b7..988bb56c0 100644 +--- a/src/spellfile.c ++++ b/src/spellfile.c +@@ -645,7 +645,7 @@ tree_count_words(char_u *byts, idx_T *idxs) + ++curi[depth]; + } + } +- else ++ else if (depth < MAXWLEN - 1) + { + // Normal char, go one level deeper to count the words. + ++depth; +@@ -5648,7 +5648,7 @@ sug_filltree(spellinfo_T *spin, slang_T *slang) + ++curi[depth]; + } + } +- else ++ else if (depth < MAXWLEN - 1) + { + // Normal char, go one level deeper. + tword[depth++] = c; +diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim +index 547748db2..2367f6c20 100644 +--- a/src/testdir/test_spellfile.vim ++++ b/src/testdir/test_spellfile.vim +@@ -1174,3 +1174,31 @@ endfunc + endfunc + ++ ++func Test_spell_sug_tree_count_words_overflow() ++ " A crafted .spl/.sug pair with a BY_INDEX self-cycle in the fold word tree ++ " parses cleanly (shared refs aren't recursed, so read_tree_node()'s depth ++ " cap never trips), but drove tree_count_words() past its MAXWLEN-sized depth ++ " arrays -> stack out-of-bounds write. The walk only happens when ++ " spellsuggest() loads the matching .sug. Reaching the assert == no OOB. ++ call mkdir('Xrtp/spell', 'pR') ++ " VIMspell + v50, SN_SUGFILE(ts), SN_END, LWORDTREE{node:1,BY_INDEX->0,'A'}, ++ " empty KWORDTREE/PREFIXTREE ++ let spl = eval('0z56494D7370656C6C320B0000000008000000001234' ++ \ .. '5678FF000000020101000000410000000000000000') ++ " VIMsug + v1, matching ts, SUGWORDTREE word "a", empty SUGTABLE ++ let sug = 0z56494D737567010000000012345678000000040161010000000000 ++ call writefile(spl, 'Xrtp/spell/xx.utf-8.spl', 'b') ++ call writefile(sug, 'Xrtp/spell/xx.utf-8.sug', 'b') ++ ++ new ++ set runtimepath+=./Xrtp ++ set spelllang=xx ++ set spell ++ " Unpatched: OOB write here (ASan abort, or crash). Patched: returns a list. ++ call assert_equal(v:t_list, type(spellsuggest('helloo'))) ++ ++ set spell& spelllang& runtimepath& ++ bwipe! ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab diff --git a/0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch b/0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch new file mode 100644 index 00000000..f74b1b24 --- /dev/null +++ b/0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch @@ -0,0 +1,65 @@ +From bd1baaff17cafc8bed6c3d376c1e2a5543317c4e Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Sun, 21 Jun 2026 19:20:03 +0000 +Subject: [PATCH] patch 9.2.0698: [security]: Out-of-bounds write with + soundfold() + +Problem: [security]: Out-of-bounds write with soundfold() + (cipher-creator) +Solution: Add an abort condition to the for loop to validate the buffer + size. + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4 + +Supported by AI + +Signed-off-by: Christian Brabandt +--- + src/spell.c | 2 +- + src/testdir/test_spellfile.vim | 21 +++++++++++++++++++++ + 2 files changed, 22 insertions(+), 1 deletion(-) + +diff --git a/src/spell.c b/src/spell.c +index a1bbc9e23..428909eb4 100644 +--- a/src/spell.c ++++ b/src/spell.c +@@ -3270,7 +3270,7 @@ spell_soundfold_sofo(slang_T *slang, char_u *inword, char_u *res) + else + { + // The sl_sal_first[] table contains the translation. +- for (s = inword; (c = *s) != NUL; ++s) ++ for (s = inword; (c = *s) != NUL && ri < MAXWLEN - 1; ++s) + { + if (VIM_ISWHITE(c)) + c = ' '; +diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim +index d8d954b3b..547748db2 100644 +--- a/src/testdir/test_spellfile.vim ++++ b/src/testdir/test_spellfile.vim +@@ -1153,4 +1153,25 @@ func Test_mkspell_empty_dic() + endfunc + + ++" A word longer than MAXWLEN must not overflow the soundfold result buffer in ++" the single-byte SOFO branch of spell_soundfold_sofo(). ++func Test_soundfold_overflow() ++ let _enc=&enc ++ set enc=latin1 ++ call writefile(['SOFOFROM ab', 'SOFOTO xy'], 'Xtest.aff', 'D') ++ call writefile(['1', 'foo'], 'Xtest.dic', 'D') ++ mkspell! Xtest Xtest ++ defer delete('Xtest.latin1.spl') ++ defer delete('Xtest.latin1.sug') ++ setl spelllang=Xtest.latin1.spl spell ++ ++ " Before the fix the copy loop wrote one byte per input byte into a ++ " MAXWLEN (254) stack buffer with no upper bound, smashing the stack. ++ let sound = soundfold(repeat('ab', 300)) ++ call assert_true(strlen(sound) < 254, 'soundfold result exceeds MAXWLEN') ++ ++ set spell& spelllang& ++ let &enc = _enc ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab diff --git a/0001-patch-9.2.0699-security-possible-code-execution-with.patch b/0001-patch-9.2.0699-security-possible-code-execution-with.patch new file mode 100644 index 00000000..2334f79d --- /dev/null +++ b/0001-patch-9.2.0699-security-possible-code-execution-with.patch @@ -0,0 +1,173 @@ +From af5e82a788d676b18384171fa6fe0600ce26b9cb Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Sun, 21 Jun 2026 19:50:56 +0000 +Subject: [PATCH] patch 9.2.0699: [security]: possible code execution with + python complete + +Problem: [security]: possible code execution with python complete + (morningbread) +Solution: Use repr() to quote the doc strings correctly + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3 + +Supported by AI + +Signed-off-by: Christian Brabandt +--- + runtime/autoload/python3complete.vim | 7 ++-- + runtime/autoload/pythoncomplete.vim | 7 ++-- + src/testdir/Make_all.mak | 2 + + src/testdir/test_plugin_python3complete.vim | 45 +++++++++++++++++++++ + 4 files changed, 55 insertions(+), 6 deletions(-) + create mode 100644 src/testdir/test_plugin_python3complete.vim + +diff --git a/runtime/autoload/python3complete.vim b/runtime/autoload/python3complete.vim +index 1c432f3c8..3aa590d97 100644 +--- a/runtime/autoload/python3complete.vim ++++ b/runtime/autoload/python3complete.vim +@@ -17,6 +17,7 @@ + " v 0.10 by Vim project + " * disables importing local modules, unless the global Vim variable + " g:pythoncomplete_allow_import is set to non-zero ++" * use repr() on doc strings to prevent code execution + " + " v 0.9 + " * Fixed docstring parsing for classes and functions +@@ -315,7 +316,7 @@ class Scope(object): + + def get_code(self): + str = "" +- if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n' ++ if len(self.docstr) > 0: str += repr(self.docstr)+'\n' + str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n' + for sub in self.subscopes: + str += sub.get_code() +@@ -352,7 +353,7 @@ class Class(Scope): + str = '%sclass %s' % (self.currentindent(),self.name) + if len(self.supers) > 0: str += '(%s)' % ','.join(self.supers) + str += ':\n' +- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n' ++ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n' + if len(self.subscopes) > 0: + for s in self.subscopes: str += s.get_code() + else: +@@ -369,7 +370,7 @@ class Function(Scope): + def get_code(self): + str = "%sdef %s(%s):\n" % \ + (self.currentindent(),self.name,','.join(self.params)) +- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n' ++ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n' + str += "%spass\n" % self.childindent() + return str + +diff --git a/runtime/autoload/pythoncomplete.vim b/runtime/autoload/pythoncomplete.vim +index b4340f7ae..1bc31d87e 100644 +--- a/runtime/autoload/pythoncomplete.vim ++++ b/runtime/autoload/pythoncomplete.vim +@@ -15,6 +15,7 @@ + " v 0.10 by Vim project + " * disables importing local modules, unless the global Vim variable + " g:pythoncomplete_allow_import is set to non-zero ++" * use repr() on doc strings to prevent code execution + " + " v 0.9 + " * Fixed docstring parsing for classes and functions +@@ -330,7 +331,7 @@ class Scope(object): + + def get_code(self): + str = "" +- if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n' ++ if len(self.docstr) > 0: str += repr(self.docstr)+'\n' + str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n' + for sub in self.subscopes: + str += sub.get_code() +@@ -367,7 +368,7 @@ class Class(Scope): + str = '%sclass %s' % (self.currentindent(),self.name) + if len(self.supers) > 0: str += '(%s)' % ','.join(self.supers) + str += ':\n' +- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n' ++ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n' + if len(self.subscopes) > 0: + for s in self.subscopes: str += s.get_code() + else: +@@ -384,7 +385,7 @@ class Function(Scope): + def get_code(self): + str = "%sdef %s(%s):\n" % \ + (self.currentindent(),self.name,','.join(self.params)) +- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n' ++ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n' + str += "%spass\n" % self.childindent() + return str + +diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak +index 2ed089f98..66e94c0a2 100644 +--- a/src/testdir/Make_all.mak ++++ b/src/testdir/Make_all.mak +@@ -228,6 +228,7 @@ NEW_TESTS = \ + test_paste \ + test_perl \ + test_plugin_netrw \ ++ test_plugin_python3complete \ + test_plugin_tar \ + test_plus_arg_edit \ + test_popup \ +@@ -479,6 +480,7 @@ NEW_TESTS_RES = \ + test_paste.res \ + test_perl.res \ + test_plugin_netrw.res \ ++ test_plugin_python3complete.res \ + test_plugin_tar.res \ + test_plus_arg_edit.res \ + test_popup.res \ +diff --git a/src/testdir/test_plugin_python3complete.vim b/src/testdir/test_plugin_python3complete.vim +new file mode 100644 +index 000000000..d83f65f3b +--- /dev/null ++++ b/src/testdir/test_plugin_python3complete.vim +@@ -0,0 +1,45 @@ ++" Tests for the Python omni-completion plugin (runtime/autoload/python3complete.vim). ++" ++source check.vim ++CheckFeature python3 ++ ++" Run omni-completion against the given buffer contents and assert that the ++" marker file was not created. Pre-patch behaviour exec()s reconstructed ++" def/class headers, which evaluates the buffer-supplied expression and ++" creates the marker file. Post-patch, the expressions are stripped. ++func s:CompleteAndExpectNoMarker(buffer_lines, marker_path, msg) ++ call delete(a:marker_path) ++ defer delete(a:marker_path) ++ let g:pythoncomplete_allow_import = 0 ++ new ++ setfiletype python ++ call setline(1, a:buffer_lines) ++ call cursor(line('$'), col([line('$'), '$'])) ++ ++ " The PoC trigger -- direct invocation of the omnifunc with an empty base. ++ " This is the same path Vim takes for CTRL-X CTRL-O. ++ silent! call python3complete#Complete(0, '') ++ ++ call assert_false(filereadable(a:marker_path), ++ \ a:msg . ' (marker ' . a:marker_path . ' was created)') ++ ++ bwipe! ++ unlet! g:pythoncomplete_allow_import ++endfunc ++ ++func Test_python3complete_no_exec_via_class_docstring() ++ " A class-body docstring is emitted verbatim between triple quotes by ++ " get_code() and runs at class-definition time during exec(). A single- ++ " quoted source docstring lets an embedded """ survive doc()'s leading/ ++ " trailing quote strip and break out of the generated literal. ++ let marker = tempname() ++ call s:CompleteAndExpectNoMarker([ ++ \ 'class Foo:', ++ \ ' ''x"""+open("' . marker . '", "w").close()+"""y''', ++ \ ' pass', ++ \ 'Foo.', ++ \ ], marker, ++ \ 'class docstring expression was evaluated during omni-completion') ++endfunc ++ ++" vim: shiftwidth=2 sts=2 expandtab diff --git a/0001-patch-9.2.0735-security-arbitrary-Ex-command-executi.patch b/0001-patch-9.2.0735-security-arbitrary-Ex-command-executi.patch new file mode 100644 index 00000000..c80906ec --- /dev/null +++ b/0001-patch-9.2.0735-security-arbitrary-Ex-command-executi.patch @@ -0,0 +1,127 @@ +From 6c3ee4e150433e9a19858e14308ba87560640d3f Mon Sep 17 00:00:00 2001 +From: Hirohito Higashi +Date: Fri, 26 Jun 2026 15:41:24 +0900 +Subject: [PATCH] patch 9.2.0735: [security]: arbitrary Ex command execution + during C omni-completion + +Problem: [security]: With C omni-completion, a crafted tags file can execute + arbitrary Ex commands when completing a struct/union member + (cipher-creator) +Solution: Escape the type field before inserting it into the :vimgrep + pattern so it cannot close the pattern and start a new command + (Hirohito Higashi). + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x + +Co-Authored-By: Claude Opus 4.8 (1M context) " +Signed-off-by: Hirohito Higashi +Signed-off-by: Christian Brabandt +--- + runtime/autoload/ccomplete.vim | 2 +- + src/testdir/Make_all.mak | 2 + + src/testdir/test_plugin_ccomplete.vim | 62 +++++++++++++++++++++++++++ + 3 files changed, 65 insertions(+), 1 deletion(-) + create mode 100644 src/testdir/test_plugin_ccomplete.vim + +diff --git a/runtime/autoload/ccomplete.vim b/runtime/autoload/ccomplete.vim +index 7096dcf4a..fa69f57eb 100644 +--- a/runtime/autoload/ccomplete.vim ++++ b/runtime/autoload/ccomplete.vim +@@ -560,7 +560,7 @@ def StructMembers( # {{{1 + if !cached + while 1 + execute 'silent! keepjumps noautocmd ' +- .. n .. 'vimgrep ' .. '/\t' .. typename .. '\(\t\|$\)/j ' ++ .. n .. 'vimgrep ' .. '/\t' .. escape(typename, '/\') .. '\(\t\|$\)/j ' + .. fnames + + qflist = getqflist() +diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak +index 66e94c0a2..49c034fb3 100644 +--- a/src/testdir/Make_all.mak ++++ b/src/testdir/Make_all.mak +@@ -227,6 +227,7 @@ NEW_TESTS = \ + test_partial \ + test_paste \ + test_perl \ ++ test_plugin_ccomplete \ + test_plugin_netrw \ + test_plugin_python3complete \ + test_plugin_tar \ +@@ -479,6 +480,7 @@ NEW_TESTS_RES = \ + test_partial.res \ + test_paste.res \ + test_perl.res \ ++ test_plugin_ccomplete.res \ + test_plugin_netrw.res \ + test_plugin_python3complete.res \ + test_plugin_tar.res \ +diff --git a/src/testdir/test_plugin_ccomplete.vim b/src/testdir/test_plugin_ccomplete.vim +new file mode 100644 +index 000000000..a635bd50b +--- /dev/null ++++ b/src/testdir/test_plugin_ccomplete.vim +@@ -0,0 +1,62 @@ ++" Tests for the C omni-completion plugin (runtime/autoload/ccomplete.vim). ++ ++func s:WriteTags(lines) ++ " Mark unsorted so lookup is a linear scan regardless of entry order. ++ let tagsfile = tempname() ++ call writefile(["!_TAG_FILE_SORTED\t0\t/0/"] + a:lines, tagsfile) ++ return tagsfile ++endfunc ++ ++" A crafted typeref field is interpolated into the :vimgrep pattern in ++" StructMembers(). Without escaping, "/" closes the pattern and "|" starts a ++" new Ex command, so the field runs as an Ex command during completion. ++func Test_ccomplete_no_exec_via_typeref() ++ unlet! g:ccomplete_injected ++ let tagsfile = s:WriteTags([ ++ \ "myvar\tmain.c\t/^x$/;\"\tv\ttyperef:x/|let g:ccomplete_injected = 1|\"", ++ \ ]) ++ ++ let save_tags = &tags ++ let &tags = tagsfile ++ ++ new ++ call ccomplete#Complete(1, '') ++ call ccomplete#Complete(0, 'myvar.x') ++ ++ call assert_false(exists('g:ccomplete_injected'), ++ \ 'typeref field was executed as an Ex command during omni-completion') ++ ++ bwipe! ++ let &tags = save_tags ++ unlet! g:ccomplete_injected ++endfunc ++ ++" A legitimate typeref must still drive struct-member completion: escaping the ++" field value must not break the normal path. ++func Test_ccomplete_typeref_completion_still_works() ++ let tagsfile = s:WriteTags([ ++ \ "myvar\tmain.c\t/^x$/;\"\tv\ttyperef:struct:mystruct", ++ \ "alpha\tmain.c\t/^x$/;\"\tm\tstruct:mystruct", ++ \ "beta\tmain.c\t/^x$/;\"\tm\tstruct:mystruct", ++ \ ]) ++ ++ let save_tags = &tags ++ let &tags = tagsfile ++ ++ new ++ call ccomplete#Complete(1, '') ++ let items = ccomplete#Complete(0, 'myvar.') ++ ++ call assert_equal(type([]), type(items), ++ \ 'ccomplete#Complete did not return a list') ++ let names = map(copy(items), 'v:val.word') ++ call assert_true(index(names, 'alpha') >= 0, ++ \ 'struct member "alpha" missing from completion: ' . string(names)) ++ call assert_true(index(names, 'beta') >= 0, ++ \ 'struct member "beta" missing from completion: ' . string(names)) ++ ++ bwipe! ++ let &tags = save_tags ++endfunc ++ ++" vim: shiftwidth=2 sts=2 expandtab diff --git a/0001-patch-9.2.0736-potential-command-execution-in-PHP-om.patch b/0001-patch-9.2.0736-potential-command-execution-in-PHP-om.patch new file mode 100644 index 00000000..a24743f9 --- /dev/null +++ b/0001-patch-9.2.0736-potential-command-execution-in-PHP-om.patch @@ -0,0 +1,96 @@ +From 5f4ed6bb9cfc951993d9c5ca2e944e657957f9f1 Mon Sep 17 00:00:00 2001 +From: Hirohito Higashi +Date: Fri, 26 Jun 2026 20:07:01 +0900 +Subject: [PATCH] patch 9.2.0736: potential command execution in PHP + omni-completion + +Problem: With PHP omni-completion, a crafted file can potentially + execute arbitrary commands when completing a class member. +Solution: Quote the class name before inserting it into the search() + pattern run via win_execute(). + +Co-Authored-By: Claude Opus 4.8 (1M context) +Signed-off-by: Hirohito Higashi +Signed-off-by: Christian Brabandt +--- + runtime/autoload/phpcomplete.vim | 3 ++- + src/testdir/Make_all.mak | 2 ++ + src/testdir/test_plugin_phpcomplete.vim | 35 +++++++++++++++++++++++++ + 3 files changed, 39 insertions(+), 1 deletion(-) + create mode 100644 src/testdir/test_plugin_phpcomplete.vim + +diff --git a/runtime/autoload/phpcomplete.vim b/runtime/autoload/phpcomplete.vim +index 5b4263ae4..93f7d8b45 100644 +--- a/runtime/autoload/phpcomplete.vim ++++ b/runtime/autoload/phpcomplete.vim +@@ -2082,7 +2082,8 @@ function! phpcomplete#GetClassContentsStructure(file_path, file_lines, class_nam + let result = [] + let popup_id = popup_create(a:file_lines, {'hidden': v:true}) + +- call win_execute(popup_id, 'call search(''\c\(class\|interface\|trait\)\_s\+'.a:class_name.'\(\>\|$\)'')') ++ call win_execute(popup_id, 'call search(' ++ \ . string('\c\(class\|interface\|trait\)\_s\+' . a:class_name . '\(\>\|$\)') . ')') + call win_execute(popup_id, "let cfline = line('.')") + call win_execute(popup_id, "call search('{')") + call win_execute(popup_id, "let endline = line('.')") +diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak +index 49c034fb3..b362bbbfb 100644 +--- a/src/testdir/Make_all.mak ++++ b/src/testdir/Make_all.mak +@@ -229,6 +229,7 @@ NEW_TESTS = \ + test_perl \ + test_plugin_ccomplete \ + test_plugin_netrw \ ++ test_plugin_phpcomplete \ + test_plugin_python3complete \ + test_plugin_tar \ + test_plus_arg_edit \ +@@ -482,6 +483,7 @@ NEW_TESTS_RES = \ + test_perl.res \ + test_plugin_ccomplete.res \ + test_plugin_netrw.res \ ++ test_plugin_phpcomplete.res \ + test_plugin_python3complete.res \ + test_plugin_tar.res \ + test_plus_arg_edit.res \ +diff --git a/src/testdir/test_plugin_phpcomplete.vim b/src/testdir/test_plugin_phpcomplete.vim +new file mode 100644 +index 000000000..7f66be47b +--- /dev/null ++++ b/src/testdir/test_plugin_phpcomplete.vim +@@ -0,0 +1,35 @@ ++" Tests for the PHP omni-completion plugin (runtime/autoload/phpcomplete.vim). ++ ++" A buffer class name is interpolated into a search() pattern run via ++" win_execute(). Without escaping, "'" closes the string and "|" starts a new ++" Ex command, so the name runs as an Ex command during completion. ++func Test_phpcomplete_no_exec_via_class_name() ++ unlet! g:phpcomplete_injected ++ let lines = [' 0, 'no class structure returned') ++ call assert_match('class Foo', result[0].content, ++ \ 'class body missing from returned content') ++ call assert_match('bar', result[0].content, ++ \ 'class member missing from returned content') ++endfunc ++ ++" vim: shiftwidth=2 sts=2 expandtab diff --git a/0001-runtime-ccomplete-fix-type-mismatch-error.patch b/0001-runtime-ccomplete-fix-type-mismatch-error.patch new file mode 100644 index 00000000..b76b9c5a --- /dev/null +++ b/0001-runtime-ccomplete-fix-type-mismatch-error.patch @@ -0,0 +1,30 @@ +From d9ec67691170cd3764cbf767636305e47987340f Mon Sep 17 00:00:00 2001 +From: "Lars T. Kyllingstad" +Date: Thu, 6 Jun 2024 18:37:08 +0200 +Subject: [PATCH] runtime(ccomplete): fix type mismatch error + +fixes: #14927 +closes: #14928 + +Signed-off-by: Lars T. Kyllingstad +Signed-off-by: Christian Brabandt +--- + runtime/autoload/ccomplete.vim | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/runtime/autoload/ccomplete.vim b/runtime/autoload/ccomplete.vim +index 7096dcf4a..355f724d0 100644 +--- a/runtime/autoload/ccomplete.vim ++++ b/runtime/autoload/ccomplete.vim +@@ -210,7 +210,7 @@ export def Complete(findstart: bool, abase: string): any # {{{1 + # Find the variable in the tags file(s) + var diclist: list> = taglist('^' .. items[0] .. '$') + # Remove members, these can't appear without something in front. +- ->filter((_, v: dict): bool => ++ ->filter((_, v: dict): bool => + v->has_key('kind') ? v.kind != 'm' : true) + + res = [] +-- +2.55.0 + diff --git a/vim.spec b/vim.spec index 8ed7e9a6..ba9e1d06 100644 --- a/vim.spec +++ b/vim.spec @@ -51,7 +51,7 @@ Summary: The VIM editor URL: http://www.vim.org/ Name: vim Version: %{baseversion}.%{patchlevel} -Release: 9%{?dist}.7 +Release: 9%{?dist}.12 Epoch: 2 # swift.vim contains Apache 2.0 with runtime library exception: # which is taken as Apache-2.0 WITH Swift-exception - reported to legal as https://gitlab.com/fedora/legal/fedora-license-data/-/issues/188 @@ -176,6 +176,36 @@ Patch3025: 0001-patch-9.2.0495-security-runtime-netrw-code-injectio.patch Patch3026: 0001-patch-9.2.0561-security-possible-code-execution-with.patch # https://github.com/vim/vim/commit/868ad62cb8bf8038322eab2badd31bd98b02b9df Patch3027: 0001-patch-9.2.0568-pythoncomplete-g-pythoncomplete_allow.patch +# RHEL-192105 CVE-2026-57456 vim: possible code execution with python complete +# https://redhat.atlassian.net/browse/RHEL-192105 +# https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8 +# Stripped src/version.c hunk, omitted 'Last Updated' comment changes, +# created test file with only necessary parts (new test + helper function), +# added Make_all.mak entries for the new test file +Patch3028: 0001-patch-9.2.0699-security-possible-code-execution-with.patch +# RHEL-191359 CVE-2026-57455 vim: Out-of-bounds write with soundfold() +# https://redhat.atlassian.net/browse/RHEL-191359 +# https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b +Patch3029: 0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch +# RHEL-194059 CVE-2026-55693 vim: out-of-bounds write in tree_count_words() +# https://redhat.atlassian.net/browse/RHEL-194059 +# https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7 +# Stripped src/version.c hunk (downstream patchlevel is managed separately) +Patch3030: 0001-patch-9.2.0653-security-out-of-bounds-write-in-tree_.patch +# RHEL-203857 CVE-2026-59858 arbitrary Ex command execution during C omni-completion +# https://redhat.atlassian.net/browse/RHEL-203857 +# https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e +# Stripped src/version.c hunk (downstream patchlevel is managed separately) +# Resolved Make_all.mak conflicts (added only new test_plugin_ccomplete entries) +Patch3031: 0001-patch-9.2.0735-security-arbitrary-Ex-command-executi.patch +# Fix type mismatch in ccomplete.vim (fixes testsuite failure) +# https://github.com/vim/vim/commit/d9ec67691170cd3764cbf767636305e47987340f +Patch3032: 0001-runtime-ccomplete-fix-type-mismatch-error.patch +# RHEL-201113 CVE-2026-59856 potential command execution in PHP omni-completion +# https://redhat.atlassian.net/browse/RHEL-201113 +# https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24 +# Stripped src/version.c hunk (downstream patchlevel is managed separately) +Patch3033: 0001-patch-9.2.0736-potential-command-execution-in-PHP-om.patch # uses autoconf in spec file @@ -521,6 +551,12 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk %patch -P 3025 -p1 -b .netrw-hist-inject %patch -P 3026 -p1 -b .python3complete-cve %patch -P 3027 -p1 -b .pythoncomplete-import-fix +%patch -P 3028 -p1 -b .python-docstr-repr +%patch -P 3029 -p1 -b .soundfold-overflow +%patch -P 3030 -p1 -b .tree-count-words-oob +%patch -P 3031 -p1 -b .ccomplete-ex-cmd-inject +%patch -P 3032 -p1 -b .ccomplete-type-mismatch +%patch -P 3033 -p1 -b .phpcomplete-cmd-exec %build cd src @@ -1151,6 +1187,23 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags %changelog +* Tue Jul 14 2026 RHEL Packaging Agent - 2:9.1.083-9.12 +- RHEL-201113 CVE-2026-59856 vim: potential command execution in PHP + omni-completion + +* Tue Jul 14 2026 RHEL Packaging Agent - 2:9.1.083-9.11 +- RHEL-203857 CVE-2026-59858 vim: arbitrary Ex command execution + during C omni-completion + +* Mon Jul 13 2026 RHEL Packaging Agent - 2:9.1.083-9.10 +- RHEL-194059 CVE-2026-55693 vim: out-of-bounds write in tree_count_words() + +* Mon Jul 13 2026 RHEL Packaging Agent - 2:9.1.083-9.9 +- RHEL-191359 CVE-2026-57455 vim: Out-of-bounds write with soundfold() + +* Sat Jul 04 2026 RHEL Packaging Agent - 2:9.1.083-9.8 +- RHEL-192105 CVE-2026-57456 vim: possible code execution with python complete + * Wed Jul 01 2026 RHEL Packaging Agent - 2:9.1.083-9.7 - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave() - RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete