mirror of
https://git.yoctoproject.org/poky
synced 2026-10-17 05:37:02 +00:00
Devansh Patel
7902807be5
The older Vim patch 9.2.0073 fixed CVE-2026-28417 by tightening netrw hostname validation. That CVE fix requires two regression patches because it rejects valid hostnames that include an optional port or an underscore. Backport Vim patches 9.2.0089 and 9.2.0553 in that order. They restore optional-port and underscore handling while retaining the stricter validation introduced by the original CVE fix. Scarthgap's Vim 9.1.1683 source does not contain test_plugin_netrw.vim, so the upstream test hunks are omitted. The src/version.c hunks are also omitted because this backport does not change the recipe version or Vim's upstream patch-number table. [1] https://github.com/vim/vim/commit/79348dbbc09332130f4c86045e1541d68514fcc1 [2] https://github.com/vim/vim/commit/a6198523fb28a50d96945458792cdb4787d3cdda [3] https://github.com/vim/vim/commit/93d177cd2b69bac58fc51a5a514d7bc71e264b11 [4] https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336 (From OE-Core rev: 1505d5181d610b221fd75d413d884172b46b7860) Signed-off-by: Devansh Patel <devanshp@cisco.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>