mirror of
https://git.yoctoproject.org/poky
synced 2026-10-23 07:28:17 +00:00
Hitendra Prajapati
623f85f957
Pick patch from [1], [2] & [3] also mentioned at NVD report in [4,5 & 6] [1] https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615f13a7de44c0587 [2] https://github.com/vim/vim/commit/664701eb7576edb7c7c7d9f2d600815ec1f43459 [3] https://github.com/vim/vim/commit/7088926316d8d4a7572a242d0765e99adfc8b083 [4] https://nvd.nist.gov/vuln/detail/CVE-2026-34982 [5] https://nvd.nist.gov/vuln/detail/CVE-2026-34714 [6] https://nvd.nist.gov/vuln/detail/CVE-2026-35177 More info : CVE-2026-34982 - vim: arbitrary command execution via modeline sandbox bypass. CVE-2026-34714 - vim: Arbitrary code execution via crafted file. CVE-2026-35177 - vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass. (From OE-Core rev: 1b4ee99b86262ade31b69a2ba9f80791b15ea130) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
106 lines
3.6 KiB
Diff
106 lines
3.6 KiB
Diff
From 75661a66a1db1e1f3f1245c615f13a7de44c0587 Mon Sep 17 00:00:00 2001
|
|
From: Christian Brabandt <cb@256bit.org>
|
|
Date: Tue, 31 Mar 2026 18:29:00 +0000
|
|
Subject: [PATCH] patch 9.2.0276: [security]: modeline security bypass
|
|
|
|
Problem: [security]: modeline security bypass
|
|
Solution: disallow mapset() from secure mode, set the P_MLE flag for the
|
|
'complete', 'guitabtooltip' and 'printheader' options.
|
|
|
|
Github Advisory:
|
|
https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9
|
|
|
|
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
|
|
|
CVE: CVE-2026-34982
|
|
Upstream-Status: Backport [https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615f13a7de44c0587]
|
|
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
|
---
|
|
src/map.c | 3 +++
|
|
src/optiondefs.h | 6 +++---
|
|
src/testdir/test_modeline.vim | 25 +++++++++++++++++++++++++
|
|
3 files changed, 31 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/src/map.c b/src/map.c
|
|
index fbecf4aced..7677243625 100644
|
|
--- a/src/map.c
|
|
+++ b/src/map.c
|
|
@@ -2746,6 +2746,9 @@ f_mapset(typval_T *argvars, typval_T *rettv UNUSED)
|
|
int dict_only;
|
|
mapblock_T *mp_result[2] = {NULL, NULL};
|
|
|
|
+ if (check_secure())
|
|
+ return;
|
|
+
|
|
// If first arg is a dict, then that's the only arg permitted.
|
|
dict_only = argvars[0].v_type == VAR_DICT;
|
|
if (in_vim9script()
|
|
diff --git a/src/optiondefs.h b/src/optiondefs.h
|
|
index 77155a63e8..62d142e637 100644
|
|
--- a/src/optiondefs.h
|
|
+++ b/src/optiondefs.h
|
|
@@ -683,7 +683,7 @@ static struct vimoption options[] =
|
|
{"compatible", "cp", P_BOOL|P_RALL,
|
|
(char_u *)&p_cp, PV_NONE, did_set_compatible, NULL,
|
|
{(char_u *)TRUE, (char_u *)FALSE} SCTX_INIT},
|
|
- {"complete", "cpt", P_STRING|P_ALLOCED|P_VI_DEF|P_ONECOMMA|P_NODUP,
|
|
+ {"complete", "cpt", P_STRING|P_ALLOCED|P_VI_DEF|P_ONECOMMA|P_NODUP|P_MLE,
|
|
(char_u *)&p_cpt, PV_CPT, did_set_complete, expand_set_complete,
|
|
{(char_u *)".,w,b,u,t,i", (char_u *)0L}
|
|
SCTX_INIT},
|
|
@@ -1326,7 +1326,7 @@ static struct vimoption options[] =
|
|
{(char_u *)NULL, (char_u *)0L}
|
|
#endif
|
|
SCTX_INIT},
|
|
- {"guitabtooltip", "gtt", P_STRING|P_VI_DEF|P_RWIN,
|
|
+ {"guitabtooltip", "gtt", P_STRING|P_VI_DEF|P_RWIN|P_MLE,
|
|
#if defined(FEAT_GUI_TABLINE)
|
|
(char_u *)&p_gtt, PV_NONE, NULL, NULL,
|
|
{(char_u *)"", (char_u *)0L}
|
|
@@ -2044,7 +2044,7 @@ static struct vimoption options[] =
|
|
{(char_u *)NULL, (char_u *)0L}
|
|
#endif
|
|
SCTX_INIT},
|
|
- {"printheader", "pheader", P_STRING|P_VI_DEF|P_GETTEXT,
|
|
+ {"printheader", "pheader", P_STRING|P_VI_DEF|P_GETTEXT|P_MLE,
|
|
#ifdef FEAT_PRINTER
|
|
(char_u *)&p_header, PV_NONE, NULL, NULL,
|
|
// untranslated to avoid problems when 'encoding'
|
|
diff --git a/src/testdir/test_modeline.vim b/src/testdir/test_modeline.vim
|
|
index 1f8686328a..c00032ba72 100644
|
|
--- a/src/testdir/test_modeline.vim
|
|
+++ b/src/testdir/test_modeline.vim
|
|
@@ -361,4 +361,29 @@ func Test_modeline_disable()
|
|
call assert_equal(2, &sw)
|
|
endfunc
|
|
|
|
+func Test_modeline_forbidden()
|
|
+ let tempfile = tempname()
|
|
+ let lines =<< trim END
|
|
+ some test text for completion
|
|
+ vim: set complete=F{->system('touch_should_not_run')} :
|
|
+ END
|
|
+ call writefile(lines, tempfile, 'D')
|
|
+ call assert_fails($'new {tempfile}', 'E992:')
|
|
+ bw!
|
|
+ let lines =<< trim END
|
|
+ some text
|
|
+ vim: set guitabtooltip=%{%mapset()%}:
|
|
+ END
|
|
+ call writefile(lines, tempfile)
|
|
+ call assert_fails($'new {tempfile}', 'E992:')
|
|
+ bw!
|
|
+ let lines =<< trim END
|
|
+ some text
|
|
+ vim: set printheader=%{mapset('n',0,{})%)%}:
|
|
+ END
|
|
+ call writefile(lines, tempfile, 'D')
|
|
+ call assert_fails($'new {tempfile}', 'E992:')
|
|
+ bw!
|
|
+endfunc
|
|
+
|
|
" vim: shiftwidth=2 sts=2 expandtab
|
|
--
|
|
2.35.7
|
|
|