From dd7bfa68279e794a16d3368b73dc5721f46b1bf8 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Wed, 29 Jul 2026 13:41:39 +0000 Subject: [PATCH] Fix CVE-2026-57455: Out-of-bounds write with soundfold() Backport upstream commit 497f931f to fix CVE-2026-57455, a stack buffer overflow in spell_soundfold_sofo(). The fix adds a bounds check (ri < MAXWLEN - 1) to the loop condition to prevent writing past the end of the result buffer. A corresponding test case is included in the patch. CVE: CVE-2026-57455 Upstream patches: - https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b.patch Resolves: RHEL-191361 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- ...ecurity-Out-of-bounds-write-with-sou.patch | 65 +++++++++++++++++++ vim.spec | 10 ++- 2 files changed, 74 insertions(+), 1 deletion(-) create mode 100644 0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch diff --git a/0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch b/0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch new file mode 100644 index 00000000..d80fac6f --- /dev/null +++ b/0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch @@ -0,0 +1,65 @@ +From c842b2d1bf59d9bb17e6e2ed118b3faeeb4931a9 Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Sun, 21 Jun 2026 19:20:03 +0000 +Subject: [PATCH] patch 9.2.0698: [security]: Out-of-bounds write with + soundfold() + +Problem: [security]: Out-of-bounds write with soundfold() + (cipher-creator) +Solution: Add an abort condition to the for loop to validate the buffer + size. + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4 + +Supported by AI + +Signed-off-by: Christian Brabandt +--- + src/spell.c | 2 +- + src/testdir/test_spellfile.vim | 21 +++++++++++++++++++++ + 2 files changed, 22 insertions(+), 1 deletion(-) + +diff --git a/src/spell.c b/src/spell.c +index a1bbc9e23..428909eb4 100644 +--- a/src/spell.c ++++ b/src/spell.c +@@ -3270,7 +3270,7 @@ spell_soundfold_sofo(slang_T *slang, char_u *inword, char_u *res) + else + { + // The sl_sal_first[] table contains the translation. +- for (s = inword; (c = *s) != NUL; ++s) ++ for (s = inword; (c = *s) != NUL && ri < MAXWLEN - 1; ++s) + { + if (VIM_ISWHITE(c)) + c = ' '; +diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim +index d8d954b3b..547748db2 100644 +--- a/src/testdir/test_spellfile.vim ++++ b/src/testdir/test_spellfile.vim +@@ -1153,4 +1153,25 @@ func Test_mkspell_empty_dic() + endfunc + + ++" A word longer than MAXWLEN must not overflow the soundfold result buffer in ++" the single-byte SOFO branch of spell_soundfold_sofo(). ++func Test_soundfold_overflow() ++ let _enc=&enc ++ set enc=latin1 ++ call writefile(['SOFOFROM ab', 'SOFOTO xy'], 'Xtest.aff', 'D') ++ call writefile(['1', 'foo'], 'Xtest.dic', 'D') ++ mkspell! Xtest Xtest ++ defer delete('Xtest.latin1.spl') ++ defer delete('Xtest.latin1.sug') ++ setl spelllang=Xtest.latin1.spl spell ++ ++ " Before the fix the copy loop wrote one byte per input byte into a ++ " MAXWLEN (254) stack buffer with no upper bound, smashing the stack. ++ let sound = soundfold(repeat('ab', 300)) ++ call assert_true(strlen(sound) < 254, 'soundfold result exceeds MAXWLEN') ++ ++ set spell& spelllang& ++ let &enc = _enc ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab diff --git a/vim.spec b/vim.spec index b671fde6..2b2b2db1 100644 --- a/vim.spec +++ b/vim.spec @@ -51,7 +51,7 @@ Summary: The VIM editor URL: http://www.vim.org/ Name: vim Version: %{baseversion}.%{patchlevel} -Release: 16%{?dist} +Release: 17%{?dist} Epoch: 2 # swift.vim contains Apache 2.0 with runtime library exception: # which is taken as Apache-2.0 WITH Swift-exception - reported to legal as https://gitlab.com/fedora/legal/fedora-license-data/-/issues/188 @@ -163,6 +163,10 @@ Patch3024: 0001-patch-9.2.0496-security-Code-Injection-in-cucumber-f.patch # https://redhat.atlassian.net/browse/RHEL-201124 # https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24 Patch3025: 0001-patch-9.2.0736-potential-command-execution-in-PHP-om.patch +# RHEL-191361 CVE-2026-57455 Out-of-bounds write with soundfold() +# https://redhat.atlassian.net/browse/RHEL-191361 +# https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b +Patch3026: 0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch # uses autoconf in spec file @@ -506,6 +510,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk %patch -P 3023 -p1 -b .tar-cmd-inject %patch -P 3024 -p1 -b .cucumber-code-inject %patch -P 3025 -p1 -b .php-omni-cmd-exec +%patch -P 3026 -p1 -b .soundfold-overflow %build cd src @@ -1136,6 +1141,9 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags %changelog +* Wed Jul 29 2026 RHEL Packaging Agent - 2:9.1.083-17 +- RHEL-191361 CVE-2026-57455 vim: Out-of-bounds write with soundfold() + * Wed Jul 29 2026 RHEL Packaging Agent - 2:9.1.083-16 - RHEL-201124 CVE-2026-59856 vim: potential command execution in PHP omni-completion