Fix CVE-2026-57455: Out-of-bounds write with soundfold()
Backport upstream commit 497f931f to fix CVE-2026-57455, an
out-of-bounds write in spell_soundfold_sofo(). The fix adds
a bounds check (ri < MAXWLEN - 1) to the copy loop so that
input longer than MAXWLEN cannot overflow the stack buffer.
The test was adapted for Vim 8.2 compatibility by replacing
defer/writefile 'D' flag with explicit call delete() at
function end.
CVE: CVE-2026-57455
Upstream patches:
- 497f931f85.patch
Resolves: RHEL-191362
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent
Zdenek Dohnal
parent
35ece7d48c
commit
fef027391d
@ -0,0 +1,67 @@
|
||||
From 71827f5d2af8cee6aa1b7e9868e28d84e2008e96 Mon Sep 17 00:00:00 2001
|
||||
From: Christian Brabandt <cb@256bit.org>
|
||||
Date: Sun, 21 Jun 2026 19:20:03 +0000
|
||||
Subject: [PATCH] patch 9.2.0698: [security]: Out-of-bounds write with
|
||||
soundfold()
|
||||
|
||||
Problem: [security]: Out-of-bounds write with soundfold()
|
||||
(cipher-creator)
|
||||
Solution: Add an abort condition to the for loop to validate the buffer
|
||||
size.
|
||||
|
||||
Github Security Advisory:
|
||||
https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4
|
||||
|
||||
Supported by AI
|
||||
|
||||
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
||||
---
|
||||
src/spell.c | 2 +-
|
||||
src/testdir/test_spellfile.vim | 23 +++++++++++++++++++++++
|
||||
2 files changed, 24 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/spell.c b/src/spell.c
|
||||
index d43056660..52117ea71 100644
|
||||
--- a/src/spell.c
|
||||
+++ b/src/spell.c
|
||||
@@ -3167,7 +3167,7 @@ spell_soundfold_sofo(slang_T *slang, char_u *inword, char_u *res)
|
||||
else
|
||||
{
|
||||
// The sl_sal_first[] table contains the translation.
|
||||
- for (s = inword; (c = *s) != NUL; ++s)
|
||||
+ for (s = inword; (c = *s) != NUL && ri < MAXWLEN - 1; ++s)
|
||||
{
|
||||
if (VIM_ISWHITE(c))
|
||||
c = ' ';
|
||||
diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim
|
||||
index 410553daf..a400d51c0 100644
|
||||
--- a/src/testdir/test_spellfile.vim
|
||||
+++ b/src/testdir/test_spellfile.vim
|
||||
@@ -874,4 +874,27 @@ func Test_mkspellmem_opt()
|
||||
call assert_fails('set mkspellmem=1000,50,0', 'E474:')
|
||||
endfunc
|
||||
|
||||
+" A word longer than MAXWLEN must not overflow the soundfold result buffer in
|
||||
+" the single-byte SOFO branch of spell_soundfold_sofo().
|
||||
+func Test_soundfold_overflow()
|
||||
+ let _enc=&enc
|
||||
+ set enc=latin1
|
||||
+ call writefile(['SOFOFROM ab', 'SOFOTO xy'], 'Xtest.aff')
|
||||
+ call writefile(['1', 'foo'], 'Xtest.dic')
|
||||
+ mkspell! Xtest Xtest
|
||||
+ setl spelllang=Xtest.latin1.spl spell
|
||||
+
|
||||
+ " Before the fix the copy loop wrote one byte per input byte into a
|
||||
+ " MAXWLEN (254) stack buffer with no upper bound, smashing the stack.
|
||||
+ let sound = soundfold(repeat('ab', 300))
|
||||
+ call assert_true(strlen(sound) < 254, 'soundfold result exceeds MAXWLEN')
|
||||
+
|
||||
+ set spell& spelllang&
|
||||
+ let &enc = _enc
|
||||
+ call delete('Xtest.aff')
|
||||
+ call delete('Xtest.dic')
|
||||
+ call delete('Xtest.latin1.spl')
|
||||
+ call delete('Xtest.latin1.sug')
|
||||
+endfunc
|
||||
+
|
||||
" vim: shiftwidth=2 sts=2 expandtab
|
||||
11
vim.spec
11
vim.spec
@ -27,7 +27,7 @@ Summary: The VIM editor
|
||||
URL: http://www.vim.org/
|
||||
Name: vim
|
||||
Version: %{baseversion}.%{patchlevel}
|
||||
Release: 35%{?dist}
|
||||
Release: 36%{?dist}
|
||||
License: Vim and MIT
|
||||
Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2
|
||||
Source1: virc
|
||||
@ -216,6 +216,11 @@ Patch3074: 0001-patch-9.2.0735-security-arbitrary-Ex-command-executi.patch
|
||||
# https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24
|
||||
# adjusted: adapted Make_all.mak hunk for Vim 8.2 test list, stripped src/version.c
|
||||
Patch3075: 0001-patch-9.2.0736-potential-command-execution-in-PHP-omn.patch
|
||||
# RHEL-191362 CVE-2026-57455 Out-of-bounds write with soundfold()
|
||||
# https://redhat.atlassian.net/browse/RHEL-191362
|
||||
# https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b
|
||||
# adjusted: replaced defer/writefile 'D' flag with call delete() for Vim 8.2 compat
|
||||
Patch3076: 0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch
|
||||
|
||||
|
||||
# gcc is no longer in buildroot by default
|
||||
@ -479,6 +484,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
|
||||
%patch -P 3073 -p1 -b .cucumber-code-inject
|
||||
%patch -P 3074 -p1 -b .ccomplete-typeref-escape
|
||||
%patch -P 3075 -p1 -b .phpcomplete-cmd-exec
|
||||
%patch -P 3076 -p1 -b .soundfold-overflow
|
||||
|
||||
%build
|
||||
cd src
|
||||
@ -1031,6 +1037,9 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.2.2637-36
|
||||
- RHEL-191362 CVE-2026-57455 vim: Out-of-bounds write with soundfold()
|
||||
|
||||
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.2.2637-35
|
||||
- RHEL-201196 CVE-2026-59856 vim: potential command execution in PHP
|
||||
omni-completion
|
||||
|
||||
Loading…
Reference in New Issue
Block a user