From 937cfb688b93d1ebc9df7e3b09bea5788dd075f9 Mon Sep 17 00:00:00 2001 From: Zdenek Dohnal Date: Fri, 15 Oct 2021 10:41:46 +0200 Subject: [PATCH] 2004893 - CVE-2021-3778 vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c [rhel-9.0] Resolves: rhbz#2004893 --- ...eading-beyond-end-of-line-with-inval.patch | 48 +++++++++++++++++++ vim.spec | 4 ++ 2 files changed, 52 insertions(+) create mode 100644 0001-patch-8.2.3409-reading-beyond-end-of-line-with-inval.patch diff --git a/0001-patch-8.2.3409-reading-beyond-end-of-line-with-inval.patch b/0001-patch-8.2.3409-reading-beyond-end-of-line-with-inval.patch new file mode 100644 index 0000000..407d2e7 --- /dev/null +++ b/0001-patch-8.2.3409-reading-beyond-end-of-line-with-inval.patch @@ -0,0 +1,48 @@ +From 65b605665997fad54ef39a93199e305af2fe4d7f Mon Sep 17 00:00:00 2001 +From: Bram Moolenaar +Date: Tue, 7 Sep 2021 19:26:53 +0200 +Subject: [PATCH] patch 8.2.3409: reading beyond end of line with invalid utf-8 + character + +Problem: Reading beyond end of line with invalid utf-8 character. +Solution: Check for NUL when advancing. +--- + src/regexp_nfa.c | 3 ++- + src/testdir/test_regexp_utf8.vim | 8 ++++++++ + src/version.c | 2 ++ + 3 files changed, 12 insertions(+), 1 deletion(-) + +diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c +index 9757d7c47..c7db98187 100644 +--- a/src/regexp_nfa.c ++++ b/src/regexp_nfa.c +@@ -5664,7 +5664,8 @@ find_match_text(colnr_T startcol, int regstart, char_u *match_text) + match = FALSE; + break; + } +- len2 += MB_CHAR2LEN(c2); ++ len2 += enc_utf8 ? utf_ptr2len(rex.line + col + len2) ++ : MB_CHAR2LEN(c2); + } + if (match + // check that no composing char follows +diff --git a/src/testdir/test_regexp_utf8.vim b/src/testdir/test_regexp_utf8.vim +index 9f0ffb9aa..044aeffb6 100644 +--- a/src/testdir/test_regexp_utf8.vim ++++ b/src/testdir/test_regexp_utf8.vim +@@ -558,4 +558,12 @@ func Test_match_char_class_upper() + bwipe! + endfunc + ++func Test_match_invalid_byte() ++ call writefile(0z630a.765d30aa0a.2e0a.790a.4030, 'Xinvalid') ++ new ++ source Xinvalid ++ bwipe! ++ call delete('Xinvalid') ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab +-- +2.31.1 + diff --git a/vim.spec b/vim.spec index 83668d8..8670203 100644 --- a/vim.spec +++ b/vim.spec @@ -72,6 +72,8 @@ Patch3019: 0001-patch-8.2.3115-Coverity-complains-about-free_wininfo.patch Patch3020: 0001-patch-8.2.3290-Vim9-compiling-dict-may-use-pointer-a.patch # 2002320 - CVE-2021-3770 vim: using retab with large value may lead to heap buffer overflow [rhel-9.0] Patch3021: vim-cve-var-retab.patch +# 2004893 - CVE-2021-3778 vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c [rhel-9.0] +Patch3022: 0001-patch-8.2.3409-reading-beyond-end-of-line-with-inval.patch # gcc is no longer in buildroot by default BuildRequires: gcc @@ -280,6 +282,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk %patch3019 -p1 -b .covscan-free-wininfo %patch3020 -p1 -b .covscan-key-freed %patch3021 -p1 -b .cve-var-retab +%patch3022 -p1 -b .cve-utf-ptrchar %build cd src @@ -843,6 +846,7 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags - 2011429 - Remove downstream patch vim-7.4-nowarning.patch - 2011749 - Update test suite to work without default mouse behavior - 2002320 - CVE-2021-3770 vim: using retab with large value may lead to heap buffer overflow [rhel-9.0] +- 2004893 - CVE-2021-3778 vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c [rhel-9.0] * Tue Aug 10 2021 Mohan Boddu - 2:8.2.2637-5 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags