Fix CVE-2026-57455: Out-of-bounds write with soundfold()

Backport upstream commit 497f931f to fix CVE-2026-57455,
a stack buffer overflow in spell_soundfold_sofo(). The fix
adds a bounds check (ri < MAXWLEN - 1) to the loop condition
to prevent writing past the end of the result buffer. A
corresponding test case is included in the patch.

CVE: CVE-2026-57455
Upstream patches:
 - 497f931f85.patch
Resolves: RHEL-191361

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir

0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch

@@ -0,0 +1,65 @@
+From c842b2d1bf59d9bb17e6e2ed118b3faeeb4931a9 Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Sun, 21 Jun 2026 19:20:03 +0000
+Subject: [PATCH] patch 9.2.0698: [security]: Out-of-bounds write with
+ soundfold()
+
+Problem:  [security]: Out-of-bounds write with soundfold()
+          (cipher-creator)
+Solution: Add an abort condition to the for loop to validate the buffer
+          size.
+
+Github Security Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4
+
+Supported by AI
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+---
+ src/spell.c                    |  2 +-
+ src/testdir/test_spellfile.vim | 21 +++++++++++++++++++++
+ 2 files changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/src/spell.c b/src/spell.c
+index a1bbc9e23..428909eb4 100644
+--- a/src/spell.c
++++ b/src/spell.c
+@@ -3270,7 +3270,7 @@ spell_soundfold_sofo(slang_T *slang, char_u *inword, char_u *res)
+     else
+     {
+ 	// The sl_sal_first[] table contains the translation.
+-	for (s = inword; (c = *s) != NUL; ++s)
++	for (s = inword; (c = *s) != NUL && ri < MAXWLEN - 1; ++s)
+ 	{
+ 	    if (VIM_ISWHITE(c))
+ 		c = ' ';
+diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim
+index d8d954b3b..547748db2 100644
+--- a/src/testdir/test_spellfile.vim
++++ b/src/testdir/test_spellfile.vim
+@@ -1153,4 +1153,25 @@ func Test_mkspell_empty_dic()
+ endfunc
+ 
+ 
++" A word longer than MAXWLEN must not overflow the soundfold result buffer in
++" the single-byte SOFO branch of spell_soundfold_sofo().
++func Test_soundfold_overflow()
++  let _enc=&enc
++  set enc=latin1
++  call writefile(['SOFOFROM ab', 'SOFOTO xy'], 'Xtest.aff', 'D')
++  call writefile(['1', 'foo'], 'Xtest.dic', 'D')
++  mkspell! Xtest Xtest
++  defer delete('Xtest.latin1.spl')
++  defer delete('Xtest.latin1.sug')
++  setl spelllang=Xtest.latin1.spl spell
++
++  " Before the fix the copy loop wrote one byte per input byte into a
++  " MAXWLEN (254) stack buffer with no upper bound, smashing the stack.
++  let sound = soundfold(repeat('ab', 300))
++  call assert_true(strlen(sound) < 254, 'soundfold result exceeds MAXWLEN')
++
++  set spell& spelllang&
++  let &enc = _enc
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab

vim.spec

@@ -51,7 +51,7 @@ Summary: The VIM editor
 URL:     http://www.vim.org/
 Name: vim
 Version: %{baseversion}.%{patchlevel}
-Release: 16%{?dist}
+Release: 17%{?dist}
 Epoch: 2
 # swift.vim contains Apache 2.0 with runtime library exception:
 # which is taken as Apache-2.0 WITH Swift-exception - reported to legal as https://gitlab.com/fedora/legal/fedora-license-data/-/issues/188
@@ -163,6 +163,10 @@ Patch3024: 0001-patch-9.2.0496-security-Code-Injection-in-cucumber-f.patch
 # https://redhat.atlassian.net/browse/RHEL-201124
 # https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24
 Patch3025: 0001-patch-9.2.0736-potential-command-execution-in-PHP-om.patch
+# RHEL-191361 CVE-2026-57455 Out-of-bounds write with soundfold()
+# https://redhat.atlassian.net/browse/RHEL-191361
+# https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b
+Patch3026: 0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch
 
 
 # uses autoconf in spec file
@@ -506,6 +510,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
 %patch -P 3023 -p1 -b .tar-cmd-inject
 %patch -P 3024 -p1 -b .cucumber-code-inject
 %patch -P 3025 -p1 -b .php-omni-cmd-exec
+%patch -P 3026 -p1 -b .soundfold-overflow
 
 %build
 cd src
@@ -1136,6 +1141,9 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
 
 
 %changelog
+* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:9.1.083-17
+- RHEL-191361 CVE-2026-57455 vim: Out-of-bounds write with soundfold()
+
 * Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:9.1.083-16
 - RHEL-201124 CVE-2026-59856 vim: potential command execution in PHP
   omni-completion