Fix CVE-2026-59857: stack out-of-bounds write in spell_soundfold_sal()
Backport upstream patch 9.2.0725 (commit d22ff1c) to fix
CVE-2026-59857 — a stack out-of-bounds write in
spell_soundfold_sal(). The fix corrects three boundary checks
in src/spell.c, changing `reslen < MAXWLEN` to
`reslen < MAXWLEN - 1` to prevent an off-by-one write when
the trailing NUL is appended. A regression test
(Test_spellfile_soundfold_sal_overflow) is also included.
CVE: CVE-2026-59857
Upstream patches:
- d22ff1c955.patch
Resolves: RHEL-215681
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent
Zdenek Dohnal
parent
24eb11eb32
commit
7e68df3cb6
@ -0,0 +1,83 @@
|
||||
From 4ee82daff45be566605be0debadbe54c9e9a598c Mon Sep 17 00:00:00 2001
|
||||
From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
|
||||
Date: Sat, 25 Jul 2026 10:14:58 +0000
|
||||
Subject: [PATCH] patch 9.2.0725: [security]: Stack out-of-bounds write in
|
||||
spell_soundfold_sal()
|
||||
|
||||
Problem: [security]: A crafted spell file with non-collapsing SAL rules
|
||||
can make soundfold() write one byte past the end of the
|
||||
MAXWLEN result buffer. This is the same class of
|
||||
out-of-bounds write as GHSA-q8mh-6qm3-25g4 (fixed in 9.2.0698
|
||||
for the SOFO branch), found while auditing the surrounding
|
||||
code.
|
||||
Solution: Bound the single-byte SAL result writes and the terminating
|
||||
NUL to MAXWLEN - 1, matching the SOFO branch.
|
||||
---
|
||||
src/spell.c | 6 +++---
|
||||
src/testdir/test_spellfile.vim | 24 ++++++++++++++++++++++++
|
||||
2 files changed, 27 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/src/spell.c b/src/spell.c
|
||||
index 54f935b..1a04a36 100644
|
||||
--- a/src/spell.c
|
||||
+++ b/src/spell.c
|
||||
@@ -7350,7 +7350,7 @@ spell_soundfold_sal(slang_T *slang, char_u *inword, char_u *res)
|
||||
/* no '<' rule used */
|
||||
i += k - 1;
|
||||
z = 0;
|
||||
- while (*s != NUL && s[1] != NUL && reslen < MAXWLEN)
|
||||
+ while (*s != NUL && s[1] != NUL && reslen < MAXWLEN - 1)
|
||||
{
|
||||
if (reslen == 0 || res[reslen - 1] != *s)
|
||||
res[reslen++] = *s;
|
||||
@@ -7360,7 +7360,7 @@ spell_soundfold_sal(slang_T *slang, char_u *inword, char_u *res)
|
||||
c = *s;
|
||||
if (strstr((char *)pf, "^^") != NULL)
|
||||
{
|
||||
- if (c != NUL)
|
||||
+ if (c != NUL && reslen < MAXWLEN - 1)
|
||||
res[reslen++] = c;
|
||||
STRMOVE(word, word + i + 1);
|
||||
i = 0;
|
||||
@@ -7379,7 +7379,7 @@ spell_soundfold_sal(slang_T *slang, char_u *inword, char_u *res)
|
||||
|
||||
if (z0 == 0)
|
||||
{
|
||||
- if (k && !p0 && reslen < MAXWLEN && c != NUL
|
||||
+ if (k && !p0 && reslen < MAXWLEN - 1 && c != NUL
|
||||
&& (!slang->sl_collapse || reslen == 0
|
||||
|| res[reslen - 1] != c))
|
||||
/* condense only double letters */
|
||||
diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim
|
||||
index 718b94a..ed45e32 100644
|
||||
--- a/src/testdir/test_spellfile.vim
|
||||
+++ b/src/testdir/test_spellfile.vim
|
||||
@@ -48,4 +48,28 @@ func Test_spell_sug_tree_count_words_overflow()
|
||||
call delete('Xrtp', 'rf')
|
||||
endfunc
|
||||
|
||||
+" An over-length soundfold() argument must not overflow the MAXWLEN result
|
||||
+" buffer in the single-byte branch of spell_soundfold_sal().
|
||||
+func Test_spellfile_soundfold_sal_overflow()
|
||||
+ let save_enc = &encoding
|
||||
+ set encoding=latin1
|
||||
+ " A SAL map that appends without collapsing, so the result is not shorter
|
||||
+ " than the input.
|
||||
+ call writefile(['SET ISO8859-1', 'SAL collapse_result false',
|
||||
+ \ 'SAL a aaaa', 'SAL b bbbb'], 'Xsal.aff')
|
||||
+ call writefile(['2', 'hello', 'world'], 'Xsal.dic')
|
||||
+ mkspell! Xsal Xsal
|
||||
+ set spl=Xsal.latin1.spl spell
|
||||
+
|
||||
+ " 253 input characters hit the buffer boundary; the result must not exceed
|
||||
+ " MAXWLEN - 1.
|
||||
+ call assert_true(strlen(soundfold(repeat('a', 253))) <= 253)
|
||||
+
|
||||
+ set nospell spl& spelllang&
|
||||
+ call delete('Xsal.aff')
|
||||
+ call delete('Xsal.dic')
|
||||
+ call delete('Xsal.latin1.spl')
|
||||
+ let &encoding = save_enc
|
||||
+endfunc
|
||||
+
|
||||
" vim: shiftwidth=2 sts=2 expandtab
|
||||
12
vim.spec
12
vim.spec
@ -24,7 +24,7 @@ Summary: The VIM editor
|
||||
URL: http://www.vim.org/
|
||||
Name: vim
|
||||
Version: %{baseversion}.%{patchlevel}
|
||||
Release: 31%{?dist}.4
|
||||
Release: 31%{?dist}.5
|
||||
License: Vim and MIT
|
||||
Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2
|
||||
Source1: vim.sh
|
||||
@ -238,6 +238,11 @@ Patch3070: 0001-patch-9.2.0846-security-heap-buffer-overflow-in-set_.patch
|
||||
# https://github.com/vim/vim/commit/63680c6d3d52477817b49cd1a66e7aabe8a7aa19
|
||||
# stripped src/version.c hunk, adapted test for vim 8.0 (test_terminal.vim instead of test_terminal3.vim)
|
||||
Patch3071: 0001-patch-9.2.0565-security-out-of-bounds-read-in-update.patch
|
||||
# RHEL-215681 CVE-2026-59857 Stack out-of-bounds write in spell_soundfold_sal()
|
||||
# https://redhat.atlassian.net/browse/RHEL-215681
|
||||
# https://github.com/vim/vim/commit/d22ff1c955ff87e8273210eae125aab0e85b6c30
|
||||
# stripped src/version.c hunk
|
||||
Patch3072: 0001-patch-9.2.0725-security-Stack-out-of-bounds-write-in.patch
|
||||
|
||||
|
||||
# gcc is no longer in buildroot by default
|
||||
@ -491,6 +496,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
|
||||
%patch -P 3069 -p1 -b .CVE-2026-73078
|
||||
%patch -P 3070 -p1 -b .CVE-2026-73072
|
||||
%patch -P 3071 -p1 -b .CVE-2026-52859
|
||||
%patch -P 3072 -p1 -b .CVE-2026-59857
|
||||
|
||||
|
||||
%build
|
||||
@ -1010,6 +1016,10 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
|
||||
%{_datadir}/icons/locolor/*/apps/*
|
||||
|
||||
%changelog
|
||||
* Fri Sep 04 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.0.1763-31.5
|
||||
- RHEL-215681 CVE-2026-59857 vim: stack out-of-bounds write in
|
||||
spell_soundfold_sal()
|
||||
|
||||
* Fri Sep 04 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.0.1763-31.4
|
||||
- RHEL-215657 CVE-2026-52859 vim: out-of-bounds read in terminal
|
||||
cell.chars[] loop
|
||||
|
||||
Loading…
Reference in New Issue
Block a user