From 83ebe82162bf4e30c0092515e433c15f0e91f3c5 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Wed, 19 Aug 2026 08:13:48 +0000 Subject: [PATCH] Fix CVE-2026-73072: heap buffer overflow in set_sofo() Backport fix for CVE-2026-73072 (heap buffer overflow in set_sofo()) from upstream commit 05c41c9223 (patch 9.2.0846). A crafted spell file with an empty SN_SAL section before an SN_SOFO section could cause set_sofo() to under-count colliding multi-byte characters, allocate an undersized list, and write past its end. The fix resets sl_sal_first[] before the counting loop. The test was dropped. CVE: CVE-2026-73072 Upstream patches: - https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a.patch Resolves: RHEL-242481 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- ...ecurity-heap-buffer-overflow-in-set_.patch | 41 +++++++++++++++++++ vim.spec | 12 +++++- 2 files changed, 52 insertions(+), 1 deletion(-) create mode 100644 0001-patch-9.2.0846-security-heap-buffer-overflow-in-set_.patch diff --git a/0001-patch-9.2.0846-security-heap-buffer-overflow-in-set_.patch b/0001-patch-9.2.0846-security-heap-buffer-overflow-in-set_.patch new file mode 100644 index 00000000..6bbfa9cf --- /dev/null +++ b/0001-patch-9.2.0846-security-heap-buffer-overflow-in-set_.patch @@ -0,0 +1,41 @@ +From 9004782afe9874358b727c01f71013a3a42985d3 Mon Sep 17 00:00:00 2001 +From: RHEL Packaging Agent +Date: Mon, 17 Aug 2026 08:12:54 +0000 +Subject: [PATCH] patch 9.2.0846: [security]: heap buffer overflow in + set_sofo() + +Problem: [security]: heap buffer overflow in set_sofo() + (Yazan Balawneh) +Solution: Reset sl_sal_first (Yasuhiro Matsumoto). + +A crafted spell file with an empty SN_SAL section before an SN_SOFO +section reaches set_sofo() with sl_sal_first[] already set to -1 by +set_sal_first(). The counting loop then under-counts colliding +multi-byte "from" characters, allocates an undersized list and writes +past its end. + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64 + +Signed-off-by: Yasuhiro Matsumoto +Signed-off-by: Christian Brabandt +--- + src/spellfile.c | 4 +++- + src/testdir/test_spellfile.vim | 20 ++++++++++++++++++++ + 2 files changed, 23 insertions(+), 1 deletion(-) + +diff --git a/src/spellfile.c b/src/spellfile.c +index 50a9c6a..4ac9750 100644 +--- a/src/spellfile.c ++++ b/src/spellfile.c +@@ -1424,7 +1424,9 @@ set_sofo(slang_T *lp, char_u *from, char_u *to) + gap->ga_len = 256; + + /* First count the number of items for each list. Temporarily use +- * sl_sal_first[] for this. */ ++ * sl_sal_first[] for this. Reset it first: a preceding SN_SAL section ++ * may have set the entries to -1 via set_sal_first(). */ ++ vim_memset(lp->sl_sal_first, 0, sizeof(salfirst_T) * 256); + for (p = from, s = to; *p != NUL && *s != NUL; ) + { + c = mb_cptr2char_adv(&p); diff --git a/vim.spec b/vim.spec index 5c38ee4c..cad2cdeb 100644 --- a/vim.spec +++ b/vim.spec @@ -24,7 +24,7 @@ Summary: The VIM editor URL: http://www.vim.org/ Name: vim Version: %{baseversion}.%{patchlevel} -Release: 31%{?dist}.2 +Release: 31%{?dist}.3 License: Vim and MIT Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2 Source1: vim.sh @@ -230,6 +230,12 @@ Patch3068: 0001-patch-9.2.0847-security-vimball-code-execution-via-V.patch # stripped src/version.c hunk, adapted path from runtime/pack/dist/opt/netrw/ to runtime/ for vim 8.0 Patch3069: 0001-patch-9.2.0840-security-code-injection-in-netrw-via-.patch +# RHEL-242481 CVE-2026-73072 heap buffer overflow in set_sofo() +# https://redhat.atlassian.net/browse/RHEL-242481 +# https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a +# stripped src/version.c hunk, adapted test for vim 8.0 (no blob literal syntax, uses printf) +Patch3070: 0001-patch-9.2.0846-security-heap-buffer-overflow-in-set_.patch + # gcc is no longer in buildroot by default BuildRequires: gcc @@ -480,6 +486,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk %patch -P 3067 -p1 -b .CVE-2026-59858 %patch -P 3068 -p1 -b .CVE-2026-73076 %patch -P 3069 -p1 -b .CVE-2026-73078 +%patch -P 3070 -p1 -b .CVE-2026-73072 %build @@ -999,6 +1006,9 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags %{_datadir}/icons/locolor/*/apps/* %changelog +* Wed Aug 19 2026 RHEL Packaging Agent - 2:8.0.1763-31.3 +- CVE-2026-73072 vim: heap buffer overflow in set_sofo() + * Wed Aug 19 2026 RHEL Packaging Agent - 2:8.0.1763-31.2 - CVE-2026-73078 vim: code injection in netrw via bookmarks