rpms/vim
5
0
Fork 0
Code Issues Pull Requests Releases Activity

2004893 - CVE-2021-3778 vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c [rhel-9.0]

Browse Source 
Resolves: rhbz#2004893
This commit is contained in:
Zdenek Dohnal 2021-10-15 10:41:46 +02:00
parent d2eb71664f
commit 937cfb688b
2 changed files with 52 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
0001-patch-8.2.3409-reading-beyond-end-of-line-with-inval.patch Normal file
View File

@ -0,0 +1,48 @@
From 65b605665997fad54ef39a93199e305af2fe4d7f Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Tue, 7 Sep 2021 19:26:53 +0200
Subject: [PATCH] patch 8.2.3409: reading beyond end of line with invalid utf-8
character
Problem: Reading beyond end of line with invalid utf-8 character.
Solution: Check for NUL when advancing.
---
src/regexp_nfa.c | 3 ++-
src/testdir/test_regexp_utf8.vim | 8 ++++++++
src/version.c | 2 ++
3 files changed, 12 insertions(+), 1 deletion(-)
diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c
index 9757d7c47..c7db98187 100644
--- a/src/regexp_nfa.c
+++ b/src/regexp_nfa.c
@@ -5664,7 +5664,8 @@ find_match_text(colnr_T startcol, int regstart, char_u *match_text)
match = FALSE;
break;
}
- len2 += MB_CHAR2LEN(c2);
+ len2 += enc_utf8 ? utf_ptr2len(rex.line + col + len2)
+ : MB_CHAR2LEN(c2);
}
if (match
// check that no composing char follows
diff --git a/src/testdir/test_regexp_utf8.vim b/src/testdir/test_regexp_utf8.vim
index 9f0ffb9aa..044aeffb6 100644
--- a/src/testdir/test_regexp_utf8.vim
+++ b/src/testdir/test_regexp_utf8.vim
@@ -558,4 +558,12 @@ func Test_match_char_class_upper()
bwipe!
endfunc
+func Test_match_invalid_byte()
+ call writefile(0z630a.765d30aa0a.2e0a.790a.4030, 'Xinvalid')
+ new
+ source Xinvalid
+ bwipe!
+ call delete('Xinvalid')
+endfunc
+
" vim: shiftwidth=2 sts=2 expandtab
--
2.31.1

4
vim.spec
View File

@ -72,6 +72,8 @@ Patch3019: 0001-patch-8.2.3115-Coverity-complains-about-free_wininfo.patch
Patch3020: 0001-patch-8.2.3290-Vim9-compiling-dict-may-use-pointer-a.patch
# 2002320 - CVE-2021-3770 vim: using retab with large value may lead to heap buffer overflow [rhel-9.0]
Patch3021: vim-cve-var-retab.patch
# 2004893 - CVE-2021-3778 vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c [rhel-9.0]
Patch3022: 0001-patch-8.2.3409-reading-beyond-end-of-line-with-inval.patch
# gcc is no longer in buildroot by default
BuildRequires: gcc
@ -280,6 +282,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
%patch3019 -p1 -b .covscan-free-wininfo
%patch3020 -p1 -b .covscan-key-freed
%patch3021 -p1 -b .cve-var-retab
%patch3022 -p1 -b .cve-utf-ptrchar
%build
cd src
@ -843,6 +846,7 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
- 2011429 - Remove downstream patch vim-7.4-nowarning.patch
- 2011749 - Update test suite to work without default mouse behavior
- 2002320 - CVE-2021-3770 vim: using retab with large value may lead to heap buffer overflow [rhel-9.0]
- 2004893 - CVE-2021-3778 vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c [rhel-9.0]
* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 2:8.2.2637-5
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags