mirror of
https://git.yoctoproject.org/poky
synced 2026-10-23 19:38:18 +00:00
Siddharth Doshi
ce0d6f7939
Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-55892 [2] https://security-tracker.debian.org/tracker/CVE-2026-55892 (From OE-Core rev: df7fb45b185ad3fd3b339ee25ce9dad041741f25) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
82 lines
2.7 KiB
Diff
82 lines
2.7 KiB
Diff
From f0df4a48a426bd67c0c2f5ad536000a4368cd4c0 Mon Sep 17 00:00:00 2001
|
|
From: Yasuhiro Matsumoto <mattn.jp@gmail.com>
|
|
Date: Tue, 16 Jun 2026 20:32:21 +0000
|
|
Subject: [PATCH 10/17] patch 9.2.0662: [security] Stack out-of-bounds write in
|
|
dump_prefixes()
|
|
|
|
Problem: [security]: a crafted spell file with a self-referential
|
|
BY_INDEX node in the prefix tree can drive dump_prefixes()
|
|
past the end of its MAXWLEN-sized depth arrays on :spelldump
|
|
(cipher-creator)
|
|
Solution: only descend while depth < MAXWLEN - 1, as the sibling trie
|
|
walkers already do (Yasuhiro Matsumoto)
|
|
|
|
Github Security Advisory:
|
|
https://github.com/vim/vim/security/advisories/GHSA-qm9w-fmpj-879h
|
|
|
|
Supported by AI
|
|
|
|
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
|
|
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
|
|
|
Upstream-Status: Backport [https://github.com/vim/vim/commit/8325b193bba5f01e7a7d8241fc8633d93dff996b]
|
|
CVE: CVE-2026-55892
|
|
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
|
|
---
|
|
src/spell.c | 2 +-
|
|
src/testdir/test_spell.vim | 27 +++++++++++++++++++++++++++
|
|
2 files changed, 28 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/spell.c b/src/spell.c
|
|
index 2281986435..6ef3fa899b 100644
|
|
--- a/src/spell.c
|
|
+++ b/src/spell.c
|
|
@@ -4328,7 +4328,7 @@ dump_prefixes(
|
|
}
|
|
}
|
|
}
|
|
- else
|
|
+ else if (depth < MAXWLEN - 1)
|
|
{
|
|
// Normal char, go one level deeper.
|
|
prefix[depth++] = c;
|
|
diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
|
|
index 170ea57926..2a3f0e3696 100644
|
|
--- a/src/testdir/test_spell.vim
|
|
+++ b/src/testdir/test_spell.vim
|
|
@@ -1567,4 +1567,31 @@ let g:test_data_aff_sal = [
|
|
\"SAL Z S",
|
|
\ ]
|
|
|
|
+" A crafted .spl with a self-referential BY_INDEX node in the PREFIXTREE drove
|
|
+" dump_prefixes() past its MAXWLEN-sized depth arrays (stack out-of-bounds
|
|
+" write). The tree parses cleanly (shared refs aren't recursed); the walk
|
|
+" happens on :spelldump. Reaching the assert means no OOB. Same class as the
|
|
+" tree_count_words() fix (9.2.0653).
|
|
+func Test_spelldump_prefixtree_overflow()
|
|
+ CheckUnix
|
|
+ call mkdir('Xrtp/spell', 'pR')
|
|
+ " VIMspell + v50, SN_PREFCOND(prefixcnt=1), SN_END,
|
|
+ " LWORDTREE word "a" with affixID=1 (so dump_prefixes runs),
|
|
+ " empty KWORDTREE, PREFIXTREE child BY_INDEX -> nodeidx 0 (self-cycle), 'A'
|
|
+ let spl = eval('0z56494D7370656C6C32030000000003000100FF00000004'
|
|
+ \ .. '0161010220010000000000000002010100000041')
|
|
+ call writefile(spl, 'Xrtp/spell/xx.utf-8.spl', 'b')
|
|
+
|
|
+ new
|
|
+ set runtimepath+=./Xrtp
|
|
+ set spelllang=xx
|
|
+ set spell
|
|
+ spelldump
|
|
+ call assert_true(line('$') > 1)
|
|
+
|
|
+ set spell& spelllang& runtimepath&
|
|
+ bwipe!
|
|
+ bwipe!
|
|
+endfunc
|
|
+
|
|
" vim: shiftwidth=2 sts=2 expandtab
|
|
--
|
|
2.44.4
|
|
|