RHEL-253666 CVE-2026-28420 buffer overflow in terminal emulator
Resolves: RHEL-253666
This commit is contained in:
Zdenek Dohnal
parent
cda7c60e2d
commit
b8bfc5f745
127
0001-patch-9.2.0076-security-buffer-overflow-in-terminal-.patch
Normal file
127
0001-patch-9.2.0076-security-buffer-overflow-in-terminal-.patch
Normal file
@ -0,0 +1,127 @@
|
||||
diff -up vim80/src/terminal.c.terminal-buffer-over vim80/src/terminal.c
|
||||
--- vim80/src/terminal.c.terminal-buffer-over 2026-09-07 13:02:46.797199881 +0200
|
||||
+++ vim80/src/terminal.c 2026-09-07 13:02:46.802423699 +0200
|
||||
@@ -2609,12 +2609,13 @@ handle_pushline(int cols, const VTermScr
|
||||
{
|
||||
for (col = 0; col < len; col += cells[col].width)
|
||||
{
|
||||
- if (ga_grow(&ga, MB_MAXBYTES) == FAIL)
|
||||
+ if (ga_grow(&ga, VTERM_MAX_CHARS_PER_CELL * 4) == FAIL)
|
||||
{
|
||||
ga.ga_len = 0;
|
||||
break;
|
||||
}
|
||||
- for (i = 0; (c = cells[col].chars[i]) > 0 || i == 0; ++i)
|
||||
+ for (i = 0; i < VTERM_MAX_CHARS_PER_CELL &&
|
||||
+ ((c = cells[col].chars[i]) > 0 || i == 0); ++i)
|
||||
ga.ga_len += utf_char2bytes(c == NUL ? ' ' : c,
|
||||
(char_u *)ga.ga_data + ga.ga_len);
|
||||
cell2cellattr(&cells[col], &p[col]);
|
||||
diff -up vim80/src/testdir/samples/terminal_max_combining_chars.txt.terminal-buffer-over vim80/src/testdir/samples/terminal_max_combining_chars.txt
|
||||
--- vim80/src/testdir/samples/terminal_max_combining_chars.txt.terminal-buffer-over 2026-09-07 13:02:46.803004283 +0200
|
||||
+++ vim80/src/testdir/samples/terminal_max_combining_chars.txt 2026-09-07 13:02:46.803004283 +0200
|
||||
@@ -0,0 +1,80 @@
|
||||
+padding line 000
|
||||
+padding line 001
|
||||
+padding line 002
|
||||
+padding line 003
|
||||
+padding line 004
|
||||
+padding line 005
|
||||
+padding line 006
|
||||
+padding line 007
|
||||
+padding line 008
|
||||
+padding line 009
|
||||
+padding line 010
|
||||
+padding line 011
|
||||
+padding line 012
|
||||
+padding line 013
|
||||
+padding line 014
|
||||
+padding line 015
|
||||
+padding line 016
|
||||
+padding line 017
|
||||
+padding line 018
|
||||
+padding line 019
|
||||
+padding line 020
|
||||
+padding line 021
|
||||
+padding line 022
|
||||
+padding line 023
|
||||
+padding line 024
|
||||
+padding line 025
|
||||
+padding line 026
|
||||
+padding line 027
|
||||
+padding line 028
|
||||
+padding line 029
|
||||
+padding line 030
|
||||
+padding line 031
|
||||
+padding line 032
|
||||
+padding line 033
|
||||
+padding line 034
|
||||
+padding line 035
|
||||
+padding line 036
|
||||
+padding line 037
|
||||
+padding line 038
|
||||
+padding line 039
|
||||
+padding line 040
|
||||
+padding line 041
|
||||
+padding line 042
|
||||
+padding line 043
|
||||
+padding line 044
|
||||
+padding line 045
|
||||
+padding line 046
|
||||
+padding line 047
|
||||
+padding line 048
|
||||
+padding line 049
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄
|
||||
diff -up vim80/src/testdir/test_terminal.vim.terminal-buffer-over vim80/src/testdir/test_terminal.vim
|
||||
--- vim80/src/testdir/test_terminal.vim.terminal-buffer-over 2026-09-07 13:02:46.797725537 +0200
|
||||
+++ vim80/src/testdir/test_terminal.vim 2026-09-07 17:10:46.065503976 +0200
|
||||
@@ -1502,3 +1502,20 @@ func Test_terminal_output_combining_char
|
||||
call assert_equal(expected, lens)
|
||||
bw!
|
||||
endfunc
|
||||
+
|
||||
+func Test_terminal_max_combining_chars()
|
||||
+ " somehow doesn't work on MS-Windows
|
||||
+ if !has('unix')
|
||||
+ return
|
||||
+ endif
|
||||
+ let cmd = "cat samples/terminal_max_combining_chars.txt\<CR>"
|
||||
+ let buf = Run_shell_in_terminal({'term_rows': 15, 'term_cols': 35})
|
||||
+ call term_wait(buf)
|
||||
+ call term_sendkeys(buf, cmd)
|
||||
+ " last char is a space with many combining chars
|
||||
+ call WaitFor({-> term_getline(buf, 14) =~ "AAAAAAAAAAAAAAAAAAAAAAAAAAAA."})
|
||||
+ call assert_match('AAAAAAAAAAAAAAAAAAAAAAAAAAAA.', term_getline(buf, 14))
|
||||
+
|
||||
+ call term_sendkeys(buf, "exit\r")
|
||||
+ exe buf . "bwipe!"
|
||||
+endfunc
|
||||
10
vim.spec
10
vim.spec
@ -24,7 +24,7 @@ Summary: The VIM editor
|
||||
URL: http://www.vim.org/
|
||||
Name: vim
|
||||
Version: %{baseversion}.%{patchlevel}
|
||||
Release: 31%{?dist}.6
|
||||
Release: 31%{?dist}.7
|
||||
License: Vim and MIT
|
||||
Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2
|
||||
Source1: vim.sh
|
||||
@ -250,6 +250,10 @@ Patch3072: 0001-patch-9.2.0725-security-Stack-out-of-bounds-write-in.patch
|
||||
# with has('unix') check, replaced blob literals with system printf, used
|
||||
# mkdir 'p' with manual cleanup instead of 'pR')
|
||||
Patch3073: 0001-patch-9.2.0662-security-Stack-out-of-bounds-write-in.patch
|
||||
# RHEL-253668 CVE-2026-28420 fix backported to make test suite passing
|
||||
# https://redhat.atlassian.net/browse/RHEL-253668
|
||||
# https://github.com/vim/vim/commit/bb6de2105
|
||||
Patch3074: 0001-patch-9.2.0076-security-buffer-overflow-in-terminal-.patch
|
||||
|
||||
|
||||
# gcc is no longer in buildroot by default
|
||||
@ -505,6 +509,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
|
||||
%patch -P 3071 -p1 -b .CVE-2026-52859
|
||||
%patch -P 3072 -p1 -b .CVE-2026-59857
|
||||
%patch -P 3073 -p1 -b .CVE-2026-55892
|
||||
%patch -P 3074 -p1 -b .terminal-buffer-over
|
||||
|
||||
|
||||
%build
|
||||
@ -1024,6 +1029,9 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
|
||||
%{_datadir}/icons/locolor/*/apps/*
|
||||
|
||||
%changelog
|
||||
* Fri Sep 04 2026 Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-31.7
|
||||
- RHEL-253666 CVE-2026-28420 buffer overflow in terminal emulator
|
||||
|
||||
* Fri Sep 04 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.0.1763-31.6
|
||||
- RHEL-215662 CVE-2026-55892 vim: stack out-of-bounds write in
|
||||
dump_prefixes()
|
||||
|
||||
Loading…
Reference in New Issue
Block a user