Fix CVE-2026-73072: heap buffer overflow in set_sofo()

Backport fix for CVE-2026-73072 (heap buffer overflow in
set_sofo()) from upstream commit 05c41c9223 (patch 9.2.0846).

A crafted spell file with an empty SN_SAL section before an
SN_SOFO section could cause set_sofo() to under-count colliding
multi-byte characters, allocate an undersized list, and write
past its end. The fix resets sl_sal_first[] before the counting
loop. The test was dropped.

CVE: CVE-2026-73072
Upstream patches:
 - 05c41c9223.patch
Resolves: RHEL-242481

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir

0001-patch-9.2.0846-security-heap-buffer-overflow-in-set_.patch

@@ -0,0 +1,41 @@
+From 9004782afe9874358b727c01f71013a3a42985d3 Mon Sep 17 00:00:00 2001
+From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
+Date: Mon, 17 Aug 2026 08:12:54 +0000
+Subject: [PATCH] patch 9.2.0846: [security]: heap buffer overflow in
+ set_sofo()
+
+Problem:  [security]: heap buffer overflow in set_sofo()
+          (Yazan Balawneh)
+Solution: Reset sl_sal_first (Yasuhiro Matsumoto).
+
+A crafted spell file with an empty SN_SAL section before an SN_SOFO
+section reaches set_sofo() with sl_sal_first[] already set to -1 by
+set_sal_first(). The counting loop then under-counts colliding
+multi-byte "from" characters, allocates an undersized list and writes
+past its end.
+
+Github Security Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64
+
+Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+---
+ src/spellfile.c                |  4 +++-
+ src/testdir/test_spellfile.vim | 20 ++++++++++++++++++++
+ 2 files changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/src/spellfile.c b/src/spellfile.c
+index 50a9c6a..4ac9750 100644
+--- a/src/spellfile.c
++++ b/src/spellfile.c
+@@ -1424,7 +1424,9 @@ set_sofo(slang_T *lp, char_u *from, char_u *to)
+ 	gap->ga_len = 256;
+ 
+ 	/* First count the number of items for each list.  Temporarily use
+-	 * sl_sal_first[] for this. */
++	 * sl_sal_first[] for this.  Reset it first: a preceding SN_SAL section
++	 * may have set the entries to -1 via set_sal_first(). */
++	vim_memset(lp->sl_sal_first, 0, sizeof(salfirst_T) * 256);
+ 	for (p = from, s = to; *p != NUL && *s != NUL; )
+ 	{
+ 	    c = mb_cptr2char_adv(&p);

vim.spec

@@ -24,7 +24,7 @@ Summary: The VIM editor
 URL:     http://www.vim.org/
 Name: vim
 Version: %{baseversion}.%{patchlevel}
-Release: 31%{?dist}.2
+Release: 31%{?dist}.3
 License: Vim and MIT
 Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2
 Source1: vim.sh
@@ -230,6 +230,12 @@ Patch3068: 0001-patch-9.2.0847-security-vimball-code-execution-via-V.patch
 # stripped src/version.c hunk, adapted path from runtime/pack/dist/opt/netrw/ to runtime/ for vim 8.0
 Patch3069: 0001-patch-9.2.0840-security-code-injection-in-netrw-via-.patch
 
+# RHEL-242481 CVE-2026-73072 heap buffer overflow in set_sofo()
+# https://redhat.atlassian.net/browse/RHEL-242481
+# https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a
+# stripped src/version.c hunk, adapted test for vim 8.0 (no blob literal syntax, uses printf)
+Patch3070: 0001-patch-9.2.0846-security-heap-buffer-overflow-in-set_.patch
+
 
 # gcc is no longer in buildroot by default
 BuildRequires: gcc
@@ -480,6 +486,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
 %patch -P 3067 -p1 -b .CVE-2026-59858
 %patch -P 3068 -p1 -b .CVE-2026-73076
 %patch -P 3069 -p1 -b .CVE-2026-73078
+%patch -P 3070 -p1 -b .CVE-2026-73072
 
 
 %build
@@ -999,6 +1006,9 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
 %{_datadir}/icons/locolor/*/apps/*
 
 %changelog
+* Wed Aug 19 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.0.1763-31.3
+- CVE-2026-73072 vim: heap buffer overflow in set_sofo()
+
 * Wed Aug 19 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.0.1763-31.2
 - CVE-2026-73078 vim: code injection in netrw via bookmarks