Fix CVE-2026-57455: Out-of-bounds write with soundfold()
Backport upstream commit 497f931f to fix an out-of-bounds
write in spell_soundfold_sofo() (CVE-2026-57455). The patch
adds a bounds check (ri < MAXWLEN - 1) to the for loop in the
single-byte SOFO soundfold branch of src/spell.c to prevent
a stack buffer overflow when processing words longer than
MAXWLEN. The test was adapted for Vim 8.0 (no defer/D flag)
and registered in Make_all.mak.
CVE: CVE-2026-57455
Upstream patches:
- 497f931f85.patch
Resolves: RHEL-191365
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent
parent
7331b6f4ba
commit
b236cd5aae
@ -0,0 +1,81 @@
|
||||
From 11c60c9ae5466580e93defdff683bcd4b93c5283 Mon Sep 17 00:00:00 2001
|
||||
From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
|
||||
Date: Thu, 2 Jul 2026 11:09:19 +0000
|
||||
Subject: [PATCH] patch 9.2.0698: [security]: Out-of-bounds write with
|
||||
soundfold()
|
||||
|
||||
Problem: [security]: Out-of-bounds write with soundfold()
|
||||
(cipher-creator)
|
||||
Solution: Add an abort condition to the for loop to validate the buffer
|
||||
size.
|
||||
|
||||
Github Security Advisory:
|
||||
https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4
|
||||
|
||||
Supported by AI
|
||||
|
||||
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
||||
---
|
||||
src/spell.c | 2 +-
|
||||
src/testdir/Make_all.mak | 1 +
|
||||
src/testdir/test_spellfile.vim | 26 ++++++++++++++++++++++++++
|
||||
3 files changed, 28 insertions(+), 1 deletion(-)
|
||||
create mode 100644 src/testdir/test_spellfile.vim
|
||||
|
||||
diff --git a/src/spell.c b/src/spell.c
|
||||
index 05a9d2c..54f935b 100644
|
||||
--- a/src/spell.c
|
||||
+++ b/src/spell.c
|
||||
@@ -7107,7 +7107,7 @@ spell_soundfold_sofo(slang_T *slang, char_u *inword, char_u *res)
|
||||
#endif
|
||||
{
|
||||
/* The sl_sal_first[] table contains the translation. */
|
||||
- for (s = inword; (c = *s) != NUL; ++s)
|
||||
+ for (s = inword; (c = *s) != NUL && ri < MAXWLEN - 1; ++s)
|
||||
{
|
||||
if (VIM_ISWHITE(c))
|
||||
c = ' ';
|
||||
diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
|
||||
index 4b34928..c7b5893 100644
|
||||
--- a/src/testdir/Make_all.mak
|
||||
+++ b/src/testdir/Make_all.mak
|
||||
@@ -166,6 +166,7 @@ NEW_TESTS = test_arabic.res \
|
||||
test_signs.res \
|
||||
test_smartindent.res \
|
||||
test_spell.res \
|
||||
+ test_spellfile.res \
|
||||
test_startup.res \
|
||||
test_stat.res \
|
||||
test_substitute.res \
|
||||
diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim
|
||||
new file mode 100644
|
||||
index 0000000..26235fe
|
||||
--- /dev/null
|
||||
+++ b/src/testdir/test_spellfile.vim
|
||||
@@ -0,0 +1,26 @@
|
||||
+" Tests for spellfile langauage generation and stripping
|
||||
+
|
||||
+" A word longer than MAXWLEN must not overflow the soundfold result buffer in
|
||||
+" the single-byte SOFO branch of spell_soundfold_sofo().
|
||||
+func Test_soundfold_overflow()
|
||||
+ let _enc=&enc
|
||||
+ set enc=latin1
|
||||
+ call writefile(['SOFOFROM ab', 'SOFOTO xy'], 'Xtest.aff')
|
||||
+ call writefile(['1', 'foo'], 'Xtest.dic')
|
||||
+ mkspell! Xtest Xtest
|
||||
+ setl spelllang=Xtest.latin1.spl spell
|
||||
+
|
||||
+ " Before the fix the copy loop wrote one byte per input byte into a
|
||||
+ " MAXWLEN (254) stack buffer with no upper bound, smashing the stack.
|
||||
+ let sound = soundfold(repeat('ab', 300))
|
||||
+ call assert_true(strlen(sound) < 254, 'soundfold result exceeds MAXWLEN')
|
||||
+
|
||||
+ set spell& spelllang&
|
||||
+ let &enc = _enc
|
||||
+ call delete('Xtest.aff')
|
||||
+ call delete('Xtest.dic')
|
||||
+ call delete('Xtest.latin1.spl')
|
||||
+ call delete('Xtest.latin1.sug')
|
||||
+endfunc
|
||||
+
|
||||
+" vim: shiftwidth=2 sts=2 expandtab
|
||||
11
vim.spec
11
vim.spec
@ -24,7 +24,7 @@ Summary: The VIM editor
|
||||
URL: http://www.vim.org/
|
||||
Name: vim
|
||||
Version: %{baseversion}.%{patchlevel}
|
||||
Release: 28%{?dist}
|
||||
Release: 29%{?dist}
|
||||
License: Vim and MIT
|
||||
Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2
|
||||
Source1: vim.sh
|
||||
@ -198,6 +198,11 @@ Patch3063: 0001-patch-9.2.0568-pythoncomplete-g-pythoncomplete_allow.patch
|
||||
# https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8
|
||||
# stripped src/version.c hunk, omitted Last Updated comment changes, created minimal test file, adapted for vim 8.0
|
||||
Patch3064: 0001-patch-9.2.0699-security-possible-code-execution-with.patch
|
||||
# RHEL-191365 CVE-2026-57455 Out-of-bounds write with soundfold()
|
||||
# https://redhat.atlassian.net/browse/RHEL-191365
|
||||
# https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b
|
||||
# stripped src/version.c hunk, adapted test to vim 8.0 (no defer/D flag), added test to Make_all.mak
|
||||
Patch3065: 0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch
|
||||
|
||||
|
||||
# gcc is no longer in buildroot by default
|
||||
@ -444,6 +449,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
|
||||
%patch -P 3062 -p1 -b .CVE-2026-52858
|
||||
%patch -P 3063 -p1 -b .CVE-2026-52858-fix
|
||||
%patch -P 3064 -p1 -b .CVE-2026-57456
|
||||
%patch -P 3065 -p1 -b .CVE-2026-57455
|
||||
|
||||
|
||||
%build
|
||||
@ -963,6 +969,9 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
|
||||
%{_datadir}/icons/locolor/*/apps/*
|
||||
|
||||
%changelog
|
||||
* Mon Jul 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.0.1763-29
|
||||
- RHEL-191365 CVE-2026-57455 vim: Out-of-bounds write with soundfold()
|
||||
|
||||
* Sat Jul 04 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.0.1763-28
|
||||
- RHEL-192102 CVE-2026-57456 vim: possible code execution with python
|
||||
complete via crafted docstrings
|
||||
|
||||
Loading…
Reference in New Issue
Block a user