Fix CVE-2026-55693: out-of-bounds write in tree_count_words()
Backport upstream patch 9.2.0653 (commit a80874d9) to fix
CVE-2026-55693 — an out-of-bounds write in tree_count_words()
in src/spellfile.c. A crafted spell file could drive the
function past its MAXWLEN-sized depth arrays. The fix adds
depth bound checks in tree_count_words() and sug_filltree(),
along with a new test case in test_spellfile.vim.
CVE: CVE-2026-55693
Upstream patches:
- a80874d9b8.patch
Resolves: RHEL-194056
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent
Zdenek Dohnal
parent
636b8cbcfc
commit
e28b8ae4ff
@ -0,0 +1,80 @@
|
||||
From 3dd65dfa11beb1328ec6376f836a0e3bf1356c9a Mon Sep 17 00:00:00 2001
|
||||
From: Christian Brabandt <cb@256bit.org>
|
||||
Date: Mon, 15 Jun 2026 19:39:08 +0000
|
||||
Subject: [PATCH] patch 9.2.0653: [security]: out-of-bounds write in
|
||||
tree_count_words()
|
||||
|
||||
Problem: [security]: a crafted spell file can drive tree_count_words()
|
||||
past the end of its MAXWLEN-sized depth arrays; the descent
|
||||
loop has no depth bound.
|
||||
Solution: only descend while depth < MAXWLEN - 1, as the sibling trie
|
||||
walkers already do; apply the same guard to sug_filltree().
|
||||
|
||||
Github Security Advisory:
|
||||
https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq
|
||||
|
||||
Supported by AI.
|
||||
|
||||
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
||||
---
|
||||
src/spellfile.c | 4 ++--
|
||||
src/testdir/test_spellfile.vim | 27 +++++++++++++++++++++++++++
|
||||
2 files changed, 29 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/spellfile.c b/src/spellfile.c
|
||||
index 24df042b7..988bb56c0 100644
|
||||
--- a/src/spellfile.c
|
||||
+++ b/src/spellfile.c
|
||||
@@ -645,7 +645,7 @@ tree_count_words(char_u *byts, idx_T *idxs)
|
||||
++curi[depth];
|
||||
}
|
||||
}
|
||||
- else
|
||||
+ else if (depth < MAXWLEN - 1)
|
||||
{
|
||||
// Normal char, go one level deeper to count the words.
|
||||
++depth;
|
||||
@@ -5648,7 +5648,7 @@ sug_filltree(spellinfo_T *spin, slang_T *slang)
|
||||
++curi[depth];
|
||||
}
|
||||
}
|
||||
- else
|
||||
+ else if (depth < MAXWLEN - 1)
|
||||
{
|
||||
// Normal char, go one level deeper.
|
||||
tword[depth++] = c;
|
||||
diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim
|
||||
index 547748db2..2367f6c20 100644
|
||||
--- a/src/testdir/test_spellfile.vim
|
||||
+++ b/src/testdir/test_spellfile.vim
|
||||
@@ -1174,3 +1174,30 @@ func Test_soundfold_overflow()
|
||||
endfunc
|
||||
|
||||
+func Test_spell_sug_tree_count_words_overflow()
|
||||
+ " A crafted .spl/.sug pair with a BY_INDEX self-cycle in the fold word tree
|
||||
+ " parses cleanly (shared refs aren't recursed, so read_tree_node()'s depth
|
||||
+ " cap never trips), but drove tree_count_words() past its MAXWLEN-sized depth
|
||||
+ " arrays -> stack out-of-bounds write. The walk only happens when
|
||||
+ " spellsuggest() loads the matching .sug. Reaching the assert == no OOB.
|
||||
+ call mkdir('Xrtp/spell', 'pR')
|
||||
+ " VIMspell + v50, SN_SUGFILE(ts), SN_END, LWORDTREE{node:1,BY_INDEX->0,'A'},
|
||||
+ " empty KWORDTREE/PREFIXTREE
|
||||
+ let spl = eval('0z56494D7370656C6C320B0000000008000000001234'
|
||||
+ \ .. '5678FF000000020101000000410000000000000000')
|
||||
+ " VIMsug + v1, matching ts, SUGWORDTREE word "a", empty SUGTABLE
|
||||
+ let sug = 0z56494D737567010000000012345678000000040161010000000000
|
||||
+ call writefile(spl, 'Xrtp/spell/xx.utf-8.spl', 'b')
|
||||
+ call writefile(sug, 'Xrtp/spell/xx.utf-8.sug', 'b')
|
||||
+
|
||||
+ new
|
||||
+ set runtimepath+=./Xrtp
|
||||
+ set spelllang=xx
|
||||
+ set spell
|
||||
+ " Unpatched: OOB write here (ASan abort, or crash). Patched: returns a list.
|
||||
+ call assert_equal(v:t_list, type(spellsuggest('helloo')))
|
||||
+
|
||||
+ set spell& spelllang& runtimepath&
|
||||
+ bwipe!
|
||||
+endfunc
|
||||
+
|
||||
" vim: shiftwidth=2 sts=2 expandtab
|
||||
11
vim.spec
11
vim.spec
@ -51,7 +51,7 @@ Summary: The VIM editor
|
||||
URL: http://www.vim.org/
|
||||
Name: vim
|
||||
Version: %{baseversion}.%{patchlevel}
|
||||
Release: 18%{?dist}
|
||||
Release: 19%{?dist}
|
||||
Epoch: 2
|
||||
# swift.vim contains Apache 2.0 with runtime library exception:
|
||||
# which is taken as Apache-2.0 WITH Swift-exception - reported to legal as https://gitlab.com/fedora/legal/fedora-license-data/-/issues/188
|
||||
@ -173,6 +173,10 @@ Patch3026: 0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch
|
||||
# https://github.com/vim/vim/commit/d9ec67691170cd3764cbf767636305e47987340f
|
||||
Patch3027: 0001-patch-9.2.0735-security-arbitrary-Ex-command-executi.patch
|
||||
Patch3028: 0001-runtime-ccomplete-fix-type-mismatch-error.patch
|
||||
# RHEL-194056 CVE-2026-55693 [security]: out-of-bounds write in tree_count_words()
|
||||
# https://redhat.atlassian.net/browse/RHEL-194056
|
||||
# https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7
|
||||
Patch3029: 0001-patch-9.2.0653-security-out-of-bounds-write-in-tree_.patch
|
||||
|
||||
|
||||
# uses autoconf in spec file
|
||||
@ -519,6 +523,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
|
||||
%patch -P 3026 -p1 -b .soundfold-overflow
|
||||
%patch -P 3027 -p1 -b .ccomplete-ex-inject
|
||||
%patch -P 3028 -p1 -b .runtime-ccomplete
|
||||
%patch -P 3029 -p1 -b .tree-count-words-oob
|
||||
|
||||
%build
|
||||
cd src
|
||||
@ -1149,6 +1154,10 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
|
||||
|
||||
|
||||
%changelog
|
||||
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:9.1.083-19
|
||||
- RHEL-194056 CVE-2026-55693 vim: out-of-bounds write in
|
||||
tree_count_words()
|
||||
|
||||
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:9.1.083-18
|
||||
- RHEL-203886 CVE-2026-59858 vim: arbitrary Ex command execution in C
|
||||
omni-completion
|
||||
|
||||
Loading…
Reference in New Issue
Block a user