mirror of
https://git.yoctoproject.org/poky
synced 2026-10-23 07:28:17 +00:00
Siddharth Doshi
4957a62a52
Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-55693 [2] https://security-tracker.debian.org/tracker/CVE-2026-55693 (From OE-Core rev: f4d6729cf38708effd445aa739bfd34d3adda3d0) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
89 lines
3.1 KiB
Diff
89 lines
3.1 KiB
Diff
From 315b35adb406138c962bcc653db95acc3c87c8ab Mon Sep 17 00:00:00 2001
|
|
From: Christian Brabandt <cb@256bit.org>
|
|
Date: Mon, 15 Jun 2026 19:39:08 +0000
|
|
Subject: [PATCH 09/17] patch 9.2.0653: [security]: out-of-bounds write in
|
|
tree_count_words()
|
|
|
|
Problem: [security]: a crafted spell file can drive tree_count_words()
|
|
past the end of its MAXWLEN-sized depth arrays; the descent
|
|
loop has no depth bound.
|
|
Solution: only descend while depth < MAXWLEN - 1, as the sibling trie
|
|
walkers already do; apply the same guard to sug_filltree().
|
|
|
|
Github Security Advisory:
|
|
https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq
|
|
|
|
Supported by AI.
|
|
|
|
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
|
|
|
Upstream-Status: Backport [https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7]
|
|
CVE: CVE-2026-55693
|
|
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
|
|
---
|
|
src/spellfile.c | 4 ++--
|
|
src/testdir/test_spellfile.vim | 27 +++++++++++++++++++++++++++
|
|
2 files changed, 29 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/spellfile.c b/src/spellfile.c
|
|
index 0b9536dc16..0010d9aa27 100644
|
|
--- a/src/spellfile.c
|
|
+++ b/src/spellfile.c
|
|
@@ -645,7 +645,7 @@ tree_count_words(char_u *byts, idx_T *idxs)
|
|
++curi[depth];
|
|
}
|
|
}
|
|
- else
|
|
+ else if (depth < MAXWLEN - 1)
|
|
{
|
|
// Normal char, go one level deeper to count the words.
|
|
++depth;
|
|
@@ -5648,7 +5648,7 @@ sug_filltree(spellinfo_T *spin, slang_T *slang)
|
|
++curi[depth];
|
|
}
|
|
}
|
|
- else
|
|
+ else if (depth < MAXWLEN - 1)
|
|
{
|
|
// Normal char, go one level deeper.
|
|
tword[depth++] = c;
|
|
diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim
|
|
index b72974ed07..e5f8c5778f 100644
|
|
--- a/src/testdir/test_spellfile.vim
|
|
+++ b/src/testdir/test_spellfile.vim
|
|
@@ -1166,4 +1166,31 @@ func Test_mkspell_empty_dic()
|
|
endfunc
|
|
|
|
|
|
+func Test_spell_sug_tree_count_words_overflow()
|
|
+ " A crafted .spl/.sug pair with a BY_INDEX self-cycle in the fold word tree
|
|
+ " parses cleanly (shared refs aren't recursed, so read_tree_node()'s depth
|
|
+ " cap never trips), but drove tree_count_words() past its MAXWLEN-sized depth
|
|
+ " arrays -> stack out-of-bounds write. The walk only happens when
|
|
+ " spellsuggest() loads the matching .sug. Reaching the assert == no OOB.
|
|
+ call mkdir('Xrtp/spell', 'pR')
|
|
+ " VIMspell + v50, SN_SUGFILE(ts), SN_END, LWORDTREE{node:1,BY_INDEX->0,'A'},
|
|
+ " empty KWORDTREE/PREFIXTREE
|
|
+ let spl = eval('0z56494D7370656C6C320B0000000008000000001234'
|
|
+ \ .. '5678FF000000020101000000410000000000000000')
|
|
+ " VIMsug + v1, matching ts, SUGWORDTREE word "a", empty SUGTABLE
|
|
+ let sug = 0z56494D737567010000000012345678000000040161010000000000
|
|
+ call writefile(spl, 'Xrtp/spell/xx.utf-8.spl', 'b')
|
|
+ call writefile(sug, 'Xrtp/spell/xx.utf-8.sug', 'b')
|
|
+
|
|
+ new
|
|
+ set runtimepath+=./Xrtp
|
|
+ set spelllang=xx
|
|
+ set spell
|
|
+ " Unpatched: OOB write here (ASan abort, or crash). Patched: returns a list.
|
|
+ call assert_equal(v:t_list, type(spellsuggest('helloo')))
|
|
+
|
|
+ set spell& spelllang& runtimepath&
|
|
+ bwipe!
|
|
+endfunc
|
|
+
|
|
" vim: shiftwidth=2 sts=2 expandtab
|
|
--
|
|
2.44.4
|
|
|