Fix CVE-2026-55693: out-of-bounds write in tree_count_words()
Backport upstream fix (commit a80874d9) for CVE-2026-55693,
an out-of-bounds write in tree_count_words() and
sug_filltree() in src/spellfile.c. A crafted spell file
could drive these functions past the end of their
MAXWLEN-sized depth arrays because the descent loops had
no depth bound. The patch adds depth checks and includes
an adapted test for vim 8.0.
CVE: CVE-2026-55693
Upstream patches:
- a80874d9b8.patch
Resolves: RHEL-194055
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent
parent
b236cd5aae
commit
469dc848cb
@ -0,0 +1,77 @@
|
||||
From 8afb664612a7bd2fc7203cb87658bbbcc3ce29b1 Mon Sep 17 00:00:00 2001
|
||||
From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
|
||||
Date: Mon, 13 Jul 2026 08:37:21 +0000
|
||||
Subject: [PATCH] patch 9.2.0653: [security]: out-of-bounds write in
|
||||
tree_count_words()
|
||||
|
||||
Problem: [security]: a crafted spell file can drive tree_count_words()
|
||||
past the end of its MAXWLEN-sized depth arrays; the descent
|
||||
loop has no depth bound.
|
||||
Solution: only descend while depth < MAXWLEN - 1, as the sibling trie
|
||||
walkers already do; apply the same guard to sug_filltree().
|
||||
|
||||
Github Security Advisory:
|
||||
https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq
|
||||
|
||||
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
||||
---
|
||||
src/spellfile.c | 4 ++--
|
||||
src/testdir/test_spellfile.vim | 28 ++++++++++++++++++++++++++++
|
||||
2 files changed, 30 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/spellfile.c b/src/spellfile.c
|
||||
index 92997ef..50a9c6a 100644
|
||||
--- a/src/spellfile.c
|
||||
+++ b/src/spellfile.c
|
||||
@@ -639,7 +639,7 @@ tree_count_words(char_u *byts, idx_T *idxs)
|
||||
++curi[depth];
|
||||
}
|
||||
}
|
||||
- else
|
||||
+ else if (depth < MAXWLEN - 1)
|
||||
{
|
||||
/* Normal char, go one level deeper to count the words. */
|
||||
++depth;
|
||||
@@ -5687,7 +5687,7 @@ sug_filltree(spellinfo_T *spin, slang_T *slang)
|
||||
++curi[depth];
|
||||
}
|
||||
}
|
||||
- else
|
||||
+ else if (depth < MAXWLEN - 1)
|
||||
{
|
||||
/* Normal char, go one level deeper. */
|
||||
tword[depth++] = c;
|
||||
diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim
|
||||
index 26235fe..d9f77d9 100644
|
||||
--- a/src/testdir/test_spellfile.vim
|
||||
+++ b/src/testdir/test_spellfile.vim
|
||||
@@ -23,4 +23,29 @@ func Test_soundfold_overflow()
|
||||
call delete('Xtest.latin1.sug')
|
||||
endfunc
|
||||
|
||||
+func Test_spell_sug_tree_count_words_overflow()
|
||||
+ " A crafted .spl/.sug pair with a BY_INDEX self-cycle in the fold word tree
|
||||
+ " parses cleanly (shared refs aren't recursed, so read_tree_node()'s depth
|
||||
+ " cap never trips), but drove tree_count_words() past its MAXWLEN-sized depth
|
||||
+ " arrays -> stack out-of-bounds write. The walk only happens when
|
||||
+ " spellsuggest() loads the matching .sug. Reaching the assert == no OOB.
|
||||
+ call mkdir('Xrtp/spell', 'p')
|
||||
+ " VIMspell + v50, SN_SUGFILE(ts), SN_END, LWORDTREE{node:1,BY_INDEX->0,'A'},
|
||||
+ " empty KWORDTREE/PREFIXTREE
|
||||
+ call system('printf ''\x56\x49\x4D\x73\x70\x65\x6C\x6C\x32\x0B\x00\x00\x00\x00\x08\x00\x00\x00\x00\x12\x34\x56\x78\xFF\x00\x00\x00\x02\x01\x01\x00\x00\x00\x41\x00\x00\x00\x00\x00\x00\x00\x00'' > Xrtp/spell/xx.utf-8.spl')
|
||||
+ " VIMsug + v1, matching ts, SUGWORDTREE word "a", empty SUGTABLE
|
||||
+ call system('printf ''\x56\x49\x4D\x73\x75\x67\x01\x00\x00\x00\x00\x12\x34\x56\x78\x00\x00\x00\x04\x01\x61\x01\x00\x00\x00\x00\x00'' > Xrtp/spell/xx.utf-8.sug')
|
||||
+
|
||||
+ new
|
||||
+ set runtimepath+=./Xrtp
|
||||
+ set spelllang=xx
|
||||
+ set spell
|
||||
+ " Unpatched: OOB write here (ASan abort, or crash). Patched: returns a list.
|
||||
+ call assert_equal(v:t_list, type(spellsuggest('helloo')))
|
||||
+
|
||||
+ set spell& spelllang& runtimepath&
|
||||
+ bwipe!
|
||||
+ call delete('Xrtp', 'rf')
|
||||
+endfunc
|
||||
+
|
||||
" vim: shiftwidth=2 sts=2 expandtab
|
||||
14
vim.spec
14
vim.spec
@ -24,7 +24,7 @@ Summary: The VIM editor
|
||||
URL: http://www.vim.org/
|
||||
Name: vim
|
||||
Version: %{baseversion}.%{patchlevel}
|
||||
Release: 29%{?dist}
|
||||
Release: 30%{?dist}
|
||||
License: Vim and MIT
|
||||
Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2
|
||||
Source1: vim.sh
|
||||
@ -203,6 +203,13 @@ Patch3064: 0001-patch-9.2.0699-security-possible-code-execution-with.patch
|
||||
# https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b
|
||||
# stripped src/version.c hunk, adapted test to vim 8.0 (no defer/D flag), added test to Make_all.mak
|
||||
Patch3065: 0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch
|
||||
# RHEL-194055 CVE-2026-55693 out-of-bounds write in tree_count_words()
|
||||
# https://redhat.atlassian.net/browse/RHEL-194055
|
||||
# https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7
|
||||
# stripped src/version.c hunk, adapted test for vim 8.0 (replaced blob
|
||||
# literals with system printf, used mkdir 'p' with manual cleanup instead
|
||||
# of 'pR', added test to Make_all.mak)
|
||||
Patch3066: 0001-patch-9.2.0653-security-out-of-bounds-write-in-tree_.patch
|
||||
|
||||
|
||||
# gcc is no longer in buildroot by default
|
||||
@ -450,6 +457,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
|
||||
%patch -P 3063 -p1 -b .CVE-2026-52858-fix
|
||||
%patch -P 3064 -p1 -b .CVE-2026-57456
|
||||
%patch -P 3065 -p1 -b .CVE-2026-57455
|
||||
%patch -P 3066 -p1 -b .CVE-2026-55693
|
||||
|
||||
|
||||
%build
|
||||
@ -969,6 +977,10 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
|
||||
%{_datadir}/icons/locolor/*/apps/*
|
||||
|
||||
%changelog
|
||||
* Mon Jul 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.0.1763-30
|
||||
- RHEL-194055 CVE-2026-55693 vim: out-of-bounds write in
|
||||
tree_count_words()
|
||||
|
||||
* Mon Jul 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.0.1763-29
|
||||
- RHEL-191365 CVE-2026-57455 vim: Out-of-bounds write with soundfold()
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user