From b236cd5aae2b9afdce193ffa835c85c122ed4395 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Mon, 13 Jul 2026 12:13:20 +0000 Subject: [PATCH] Fix CVE-2026-57455: Out-of-bounds write with soundfold() Backport upstream commit 497f931f to fix an out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455). The patch adds a bounds check (ri < MAXWLEN - 1) to the for loop in the single-byte SOFO soundfold branch of src/spell.c to prevent a stack buffer overflow when processing words longer than MAXWLEN. The test was adapted for Vim 8.0 (no defer/D flag) and registered in Make_all.mak. CVE: CVE-2026-57455 Upstream patches: - https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b.patch Resolves: RHEL-191365 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- ...ecurity-Out-of-bounds-write-with-sou.patch | 81 +++++++++++++++++++ vim.spec | 11 ++- 2 files changed, 91 insertions(+), 1 deletion(-) create mode 100644 0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch diff --git a/0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch b/0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch new file mode 100644 index 00000000..cc53ac34 --- /dev/null +++ b/0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch @@ -0,0 +1,81 @@ +From 11c60c9ae5466580e93defdff683bcd4b93c5283 Mon Sep 17 00:00:00 2001 +From: RHEL Packaging Agent +Date: Thu, 2 Jul 2026 11:09:19 +0000 +Subject: [PATCH] patch 9.2.0698: [security]: Out-of-bounds write with + soundfold() + +Problem: [security]: Out-of-bounds write with soundfold() + (cipher-creator) +Solution: Add an abort condition to the for loop to validate the buffer + size. + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4 + +Supported by AI + +Signed-off-by: Christian Brabandt +--- + src/spell.c | 2 +- + src/testdir/Make_all.mak | 1 + + src/testdir/test_spellfile.vim | 26 ++++++++++++++++++++++++++ + 3 files changed, 28 insertions(+), 1 deletion(-) + create mode 100644 src/testdir/test_spellfile.vim + +diff --git a/src/spell.c b/src/spell.c +index 05a9d2c..54f935b 100644 +--- a/src/spell.c ++++ b/src/spell.c +@@ -7107,7 +7107,7 @@ spell_soundfold_sofo(slang_T *slang, char_u *inword, char_u *res) + #endif + { + /* The sl_sal_first[] table contains the translation. */ +- for (s = inword; (c = *s) != NUL; ++s) ++ for (s = inword; (c = *s) != NUL && ri < MAXWLEN - 1; ++s) + { + if (VIM_ISWHITE(c)) + c = ' '; +diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak +index 4b34928..c7b5893 100644 +--- a/src/testdir/Make_all.mak ++++ b/src/testdir/Make_all.mak +@@ -166,6 +166,7 @@ NEW_TESTS = test_arabic.res \ + test_signs.res \ + test_smartindent.res \ + test_spell.res \ ++ test_spellfile.res \ + test_startup.res \ + test_stat.res \ + test_substitute.res \ +diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim +new file mode 100644 +index 0000000..26235fe +--- /dev/null ++++ b/src/testdir/test_spellfile.vim +@@ -0,0 +1,26 @@ ++" Tests for spellfile langauage generation and stripping ++ ++" A word longer than MAXWLEN must not overflow the soundfold result buffer in ++" the single-byte SOFO branch of spell_soundfold_sofo(). ++func Test_soundfold_overflow() ++ let _enc=&enc ++ set enc=latin1 ++ call writefile(['SOFOFROM ab', 'SOFOTO xy'], 'Xtest.aff') ++ call writefile(['1', 'foo'], 'Xtest.dic') ++ mkspell! Xtest Xtest ++ setl spelllang=Xtest.latin1.spl spell ++ ++ " Before the fix the copy loop wrote one byte per input byte into a ++ " MAXWLEN (254) stack buffer with no upper bound, smashing the stack. ++ let sound = soundfold(repeat('ab', 300)) ++ call assert_true(strlen(sound) < 254, 'soundfold result exceeds MAXWLEN') ++ ++ set spell& spelllang& ++ let &enc = _enc ++ call delete('Xtest.aff') ++ call delete('Xtest.dic') ++ call delete('Xtest.latin1.spl') ++ call delete('Xtest.latin1.sug') ++endfunc ++ ++" vim: shiftwidth=2 sts=2 expandtab diff --git a/vim.spec b/vim.spec index c5efe59f..f08c99a4 100644 --- a/vim.spec +++ b/vim.spec @@ -24,7 +24,7 @@ Summary: The VIM editor URL: http://www.vim.org/ Name: vim Version: %{baseversion}.%{patchlevel} -Release: 28%{?dist} +Release: 29%{?dist} License: Vim and MIT Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2 Source1: vim.sh @@ -198,6 +198,11 @@ Patch3063: 0001-patch-9.2.0568-pythoncomplete-g-pythoncomplete_allow.patch # https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8 # stripped src/version.c hunk, omitted Last Updated comment changes, created minimal test file, adapted for vim 8.0 Patch3064: 0001-patch-9.2.0699-security-possible-code-execution-with.patch +# RHEL-191365 CVE-2026-57455 Out-of-bounds write with soundfold() +# https://redhat.atlassian.net/browse/RHEL-191365 +# https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b +# stripped src/version.c hunk, adapted test to vim 8.0 (no defer/D flag), added test to Make_all.mak +Patch3065: 0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch # gcc is no longer in buildroot by default @@ -444,6 +449,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk %patch -P 3062 -p1 -b .CVE-2026-52858 %patch -P 3063 -p1 -b .CVE-2026-52858-fix %patch -P 3064 -p1 -b .CVE-2026-57456 +%patch -P 3065 -p1 -b .CVE-2026-57455 %build @@ -963,6 +969,9 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags %{_datadir}/icons/locolor/*/apps/* %changelog +* Mon Jul 13 2026 RHEL Packaging Agent - 2:8.0.1763-29 +- RHEL-191365 CVE-2026-57455 vim: Out-of-bounds write with soundfold() + * Sat Jul 04 2026 RHEL Packaging Agent - 2:8.0.1763-28 - RHEL-192102 CVE-2026-57456 vim: possible code execution with python complete via crafted docstrings