diff --git a/0001-patch-9.2.0076-security-buffer-overflow-in-terminal-.patch b/0001-patch-9.2.0076-security-buffer-overflow-in-terminal-.patch new file mode 100644 index 00000000..b8abfd80 --- /dev/null +++ b/0001-patch-9.2.0076-security-buffer-overflow-in-terminal-.patch @@ -0,0 +1,127 @@ +diff -up vim80/src/terminal.c.terminal-buffer-over vim80/src/terminal.c +--- vim80/src/terminal.c.terminal-buffer-over 2026-09-07 13:02:46.797199881 +0200 ++++ vim80/src/terminal.c 2026-09-07 13:02:46.802423699 +0200 +@@ -2609,12 +2609,13 @@ handle_pushline(int cols, const VTermScr + { + for (col = 0; col < len; col += cells[col].width) + { +- if (ga_grow(&ga, MB_MAXBYTES) == FAIL) ++ if (ga_grow(&ga, VTERM_MAX_CHARS_PER_CELL * 4) == FAIL) + { + ga.ga_len = 0; + break; + } +- for (i = 0; (c = cells[col].chars[i]) > 0 || i == 0; ++i) ++ for (i = 0; i < VTERM_MAX_CHARS_PER_CELL && ++ ((c = cells[col].chars[i]) > 0 || i == 0); ++i) + ga.ga_len += utf_char2bytes(c == NUL ? ' ' : c, + (char_u *)ga.ga_data + ga.ga_len); + cell2cellattr(&cells[col], &p[col]); +diff -up vim80/src/testdir/samples/terminal_max_combining_chars.txt.terminal-buffer-over vim80/src/testdir/samples/terminal_max_combining_chars.txt +--- vim80/src/testdir/samples/terminal_max_combining_chars.txt.terminal-buffer-over 2026-09-07 13:02:46.803004283 +0200 ++++ vim80/src/testdir/samples/terminal_max_combining_chars.txt 2026-09-07 13:02:46.803004283 +0200 +@@ -0,0 +1,80 @@ ++padding line 000 ++padding line 001 ++padding line 002 ++padding line 003 ++padding line 004 ++padding line 005 ++padding line 006 ++padding line 007 ++padding line 008 ++padding line 009 ++padding line 010 ++padding line 011 ++padding line 012 ++padding line 013 ++padding line 014 ++padding line 015 ++padding line 016 ++padding line 017 ++padding line 018 ++padding line 019 ++padding line 020 ++padding line 021 ++padding line 022 ++padding line 023 ++padding line 024 ++padding line 025 ++padding line 026 ++padding line 027 ++padding line 028 ++padding line 029 ++padding line 030 ++padding line 031 ++padding line 032 ++padding line 033 ++padding line 034 ++padding line 035 ++padding line 036 ++padding line 037 ++padding line 038 ++padding line 039 ++padding line 040 ++padding line 041 ++padding line 042 ++padding line 043 ++padding line 044 ++padding line 045 ++padding line 046 ++padding line 047 ++padding line 048 ++padding line 049 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 ++AAAAAAAAAAAAAAAAAAAAAAAAAAAA𐀀󠄀󠄁󠄂󠄃󠄄 +diff -up vim80/src/testdir/test_terminal.vim.terminal-buffer-over vim80/src/testdir/test_terminal.vim +--- vim80/src/testdir/test_terminal.vim.terminal-buffer-over 2026-09-07 13:02:46.797725537 +0200 ++++ vim80/src/testdir/test_terminal.vim 2026-09-07 17:10:46.065503976 +0200 +@@ -1502,3 +1502,20 @@ func Test_terminal_output_combining_char + call assert_equal(expected, lens) + bw! + endfunc ++ ++func Test_terminal_max_combining_chars() ++ " somehow doesn't work on MS-Windows ++ if !has('unix') ++ return ++ endif ++ let cmd = "cat samples/terminal_max_combining_chars.txt\" ++ let buf = Run_shell_in_terminal({'term_rows': 15, 'term_cols': 35}) ++ call term_wait(buf) ++ call term_sendkeys(buf, cmd) ++ " last char is a space with many combining chars ++ call WaitFor({-> term_getline(buf, 14) =~ "AAAAAAAAAAAAAAAAAAAAAAAAAAAA."}) ++ call assert_match('AAAAAAAAAAAAAAAAAAAAAAAAAAAA.', term_getline(buf, 14)) ++ ++ call term_sendkeys(buf, "exit\r") ++ exe buf . "bwipe!" ++endfunc diff --git a/vim.spec b/vim.spec index 930ac051..7a571df4 100644 --- a/vim.spec +++ b/vim.spec @@ -24,7 +24,7 @@ Summary: The VIM editor URL: http://www.vim.org/ Name: vim Version: %{baseversion}.%{patchlevel} -Release: 31%{?dist}.6 +Release: 31%{?dist}.7 License: Vim and MIT Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2 Source1: vim.sh @@ -250,6 +250,10 @@ Patch3072: 0001-patch-9.2.0725-security-Stack-out-of-bounds-write-in.patch # with has('unix') check, replaced blob literals with system printf, used # mkdir 'p' with manual cleanup instead of 'pR') Patch3073: 0001-patch-9.2.0662-security-Stack-out-of-bounds-write-in.patch +# RHEL-253668 CVE-2026-28420 fix backported to make test suite passing +# https://redhat.atlassian.net/browse/RHEL-253668 +# https://github.com/vim/vim/commit/bb6de2105 +Patch3074: 0001-patch-9.2.0076-security-buffer-overflow-in-terminal-.patch # gcc is no longer in buildroot by default @@ -505,6 +509,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk %patch -P 3071 -p1 -b .CVE-2026-52859 %patch -P 3072 -p1 -b .CVE-2026-59857 %patch -P 3073 -p1 -b .CVE-2026-55892 +%patch -P 3074 -p1 -b .terminal-buffer-over %build @@ -1024,6 +1029,9 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags %{_datadir}/icons/locolor/*/apps/* %changelog +* Fri Sep 04 2026 Zdenek Dohnal - 2:8.0.1763-31.7 +- RHEL-253666 CVE-2026-28420 buffer overflow in terminal emulator + * Fri Sep 04 2026 RHEL Packaging Agent - 2:8.0.1763-31.6 - RHEL-215662 CVE-2026-55892 vim: stack out-of-bounds write in dump_prefixes()