From 469dc848cbafd271cdcdd62ea3c460d2720bda0b Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Mon, 13 Jul 2026 12:27:39 +0000 Subject: [PATCH] Fix CVE-2026-55693: out-of-bounds write in tree_count_words() Backport upstream fix (commit a80874d9) for CVE-2026-55693, an out-of-bounds write in tree_count_words() and sug_filltree() in src/spellfile.c. A crafted spell file could drive these functions past the end of their MAXWLEN-sized depth arrays because the descent loops had no depth bound. The patch adds depth checks and includes an adapted test for vim 8.0. CVE: CVE-2026-55693 Upstream patches: - https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7.patch Resolves: RHEL-194055 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- ...ecurity-out-of-bounds-write-in-tree_.patch | 77 +++++++++++++++++++ vim.spec | 14 +++- 2 files changed, 90 insertions(+), 1 deletion(-) create mode 100644 0001-patch-9.2.0653-security-out-of-bounds-write-in-tree_.patch diff --git a/0001-patch-9.2.0653-security-out-of-bounds-write-in-tree_.patch b/0001-patch-9.2.0653-security-out-of-bounds-write-in-tree_.patch new file mode 100644 index 00000000..e57d53e0 --- /dev/null +++ b/0001-patch-9.2.0653-security-out-of-bounds-write-in-tree_.patch @@ -0,0 +1,77 @@ +From 8afb664612a7bd2fc7203cb87658bbbcc3ce29b1 Mon Sep 17 00:00:00 2001 +From: RHEL Packaging Agent +Date: Mon, 13 Jul 2026 08:37:21 +0000 +Subject: [PATCH] patch 9.2.0653: [security]: out-of-bounds write in + tree_count_words() + +Problem: [security]: a crafted spell file can drive tree_count_words() + past the end of its MAXWLEN-sized depth arrays; the descent + loop has no depth bound. +Solution: only descend while depth < MAXWLEN - 1, as the sibling trie + walkers already do; apply the same guard to sug_filltree(). + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq + +Signed-off-by: Christian Brabandt +--- + src/spellfile.c | 4 ++-- + src/testdir/test_spellfile.vim | 28 ++++++++++++++++++++++++++++ + 2 files changed, 30 insertions(+), 2 deletions(-) + +diff --git a/src/spellfile.c b/src/spellfile.c +index 92997ef..50a9c6a 100644 +--- a/src/spellfile.c ++++ b/src/spellfile.c +@@ -639,7 +639,7 @@ tree_count_words(char_u *byts, idx_T *idxs) + ++curi[depth]; + } + } +- else ++ else if (depth < MAXWLEN - 1) + { + /* Normal char, go one level deeper to count the words. */ + ++depth; +@@ -5687,7 +5687,7 @@ sug_filltree(spellinfo_T *spin, slang_T *slang) + ++curi[depth]; + } + } +- else ++ else if (depth < MAXWLEN - 1) + { + /* Normal char, go one level deeper. */ + tword[depth++] = c; +diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim +index 26235fe..d9f77d9 100644 +--- a/src/testdir/test_spellfile.vim ++++ b/src/testdir/test_spellfile.vim +@@ -23,4 +23,29 @@ func Test_soundfold_overflow() + call delete('Xtest.latin1.sug') + endfunc + ++func Test_spell_sug_tree_count_words_overflow() ++ " A crafted .spl/.sug pair with a BY_INDEX self-cycle in the fold word tree ++ " parses cleanly (shared refs aren't recursed, so read_tree_node()'s depth ++ " cap never trips), but drove tree_count_words() past its MAXWLEN-sized depth ++ " arrays -> stack out-of-bounds write. The walk only happens when ++ " spellsuggest() loads the matching .sug. Reaching the assert == no OOB. ++ call mkdir('Xrtp/spell', 'p') ++ " VIMspell + v50, SN_SUGFILE(ts), SN_END, LWORDTREE{node:1,BY_INDEX->0,'A'}, ++ " empty KWORDTREE/PREFIXTREE ++ call system('printf ''\x56\x49\x4D\x73\x70\x65\x6C\x6C\x32\x0B\x00\x00\x00\x00\x08\x00\x00\x00\x00\x12\x34\x56\x78\xFF\x00\x00\x00\x02\x01\x01\x00\x00\x00\x41\x00\x00\x00\x00\x00\x00\x00\x00'' > Xrtp/spell/xx.utf-8.spl') ++ " VIMsug + v1, matching ts, SUGWORDTREE word "a", empty SUGTABLE ++ call system('printf ''\x56\x49\x4D\x73\x75\x67\x01\x00\x00\x00\x00\x12\x34\x56\x78\x00\x00\x00\x04\x01\x61\x01\x00\x00\x00\x00\x00'' > Xrtp/spell/xx.utf-8.sug') ++ ++ new ++ set runtimepath+=./Xrtp ++ set spelllang=xx ++ set spell ++ " Unpatched: OOB write here (ASan abort, or crash). Patched: returns a list. ++ call assert_equal(v:t_list, type(spellsuggest('helloo'))) ++ ++ set spell& spelllang& runtimepath& ++ bwipe! ++ call delete('Xrtp', 'rf') ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab diff --git a/vim.spec b/vim.spec index f08c99a4..9e68b5f3 100644 --- a/vim.spec +++ b/vim.spec @@ -24,7 +24,7 @@ Summary: The VIM editor URL: http://www.vim.org/ Name: vim Version: %{baseversion}.%{patchlevel} -Release: 29%{?dist} +Release: 30%{?dist} License: Vim and MIT Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2 Source1: vim.sh @@ -203,6 +203,13 @@ Patch3064: 0001-patch-9.2.0699-security-possible-code-execution-with.patch # https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b # stripped src/version.c hunk, adapted test to vim 8.0 (no defer/D flag), added test to Make_all.mak Patch3065: 0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch +# RHEL-194055 CVE-2026-55693 out-of-bounds write in tree_count_words() +# https://redhat.atlassian.net/browse/RHEL-194055 +# https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7 +# stripped src/version.c hunk, adapted test for vim 8.0 (replaced blob +# literals with system printf, used mkdir 'p' with manual cleanup instead +# of 'pR', added test to Make_all.mak) +Patch3066: 0001-patch-9.2.0653-security-out-of-bounds-write-in-tree_.patch # gcc is no longer in buildroot by default @@ -450,6 +457,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk %patch -P 3063 -p1 -b .CVE-2026-52858-fix %patch -P 3064 -p1 -b .CVE-2026-57456 %patch -P 3065 -p1 -b .CVE-2026-57455 +%patch -P 3066 -p1 -b .CVE-2026-55693 %build @@ -969,6 +977,10 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags %{_datadir}/icons/locolor/*/apps/* %changelog +* Mon Jul 13 2026 RHEL Packaging Agent - 2:8.0.1763-30 +- RHEL-194055 CVE-2026-55693 vim: out-of-bounds write in + tree_count_words() + * Mon Jul 13 2026 RHEL Packaging Agent - 2:8.0.1763-29 - RHEL-191365 CVE-2026-57455 vim: Out-of-bounds write with soundfold()