mirror of
https://git.yoctoproject.org/poky
synced 2026-10-23 07:28:17 +00:00
Siddharth Doshi
7a38ffe737
Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-57455 [2] https://security-tracker.debian.org/tracker/CVE-2026-57455 (From OE-Core rev: 91c8229fe73a22fdd07cec3db56fee2f281f1942) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
73 lines
2.4 KiB
Diff
73 lines
2.4 KiB
Diff
From 497d2fb19b2af9bccf139bb910e4f91b583e769d Mon Sep 17 00:00:00 2001
|
|
From: Christian Brabandt <cb@256bit.org>
|
|
Date: Sun, 21 Jun 2026 19:20:03 +0000
|
|
Subject: [PATCH 13/17] patch 9.2.0698: [security]: Out-of-bounds write with
|
|
soundfold()
|
|
|
|
Problem: [security]: Out-of-bounds write with soundfold()
|
|
(cipher-creator)
|
|
Solution: Add an abort condition to the for loop to validate the buffer
|
|
size.
|
|
|
|
Github Security Advisory:
|
|
https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4
|
|
|
|
Supported by AI
|
|
|
|
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
|
|
|
Upstream-Status: Backport [https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b]
|
|
CVE: CVE-2026-57455
|
|
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
|
|
---
|
|
src/spell.c | 2 +-
|
|
src/testdir/test_spellfile.vim | 21 +++++++++++++++++++++
|
|
2 files changed, 22 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/spell.c b/src/spell.c
|
|
index 6ef3fa899b..a7909ef46e 100644
|
|
--- a/src/spell.c
|
|
+++ b/src/spell.c
|
|
@@ -3273,7 +3273,7 @@ spell_soundfold_sofo(slang_T *slang, char_u *inword, char_u *res)
|
|
else
|
|
{
|
|
// The sl_sal_first[] table contains the translation.
|
|
- for (s = inword; (c = *s) != NUL; ++s)
|
|
+ for (s = inword; (c = *s) != NUL && ri < MAXWLEN - 1; ++s)
|
|
{
|
|
if (VIM_ISWHITE(c))
|
|
c = ' ';
|
|
diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim
|
|
index e5f8c5778f..d04d024911 100644
|
|
--- a/src/testdir/test_spellfile.vim
|
|
+++ b/src/testdir/test_spellfile.vim
|
|
@@ -1193,4 +1193,25 @@ func Test_spell_sug_tree_count_words_overflow()
|
|
bwipe!
|
|
endfunc
|
|
|
|
+" A word longer than MAXWLEN must not overflow the soundfold result buffer in
|
|
+" the single-byte SOFO branch of spell_soundfold_sofo().
|
|
+func Test_soundfold_overflow()
|
|
+ let _enc=&enc
|
|
+ set enc=latin1
|
|
+ call writefile(['SOFOFROM ab', 'SOFOTO xy'], 'Xtest.aff', 'D')
|
|
+ call writefile(['1', 'foo'], 'Xtest.dic', 'D')
|
|
+ mkspell! Xtest Xtest
|
|
+ defer delete('Xtest.latin1.spl')
|
|
+ defer delete('Xtest.latin1.sug')
|
|
+ setl spelllang=Xtest.latin1.spl spell
|
|
+
|
|
+ " Before the fix the copy loop wrote one byte per input byte into a
|
|
+ " MAXWLEN (254) stack buffer with no upper bound, smashing the stack.
|
|
+ let sound = soundfold(repeat('ab', 300))
|
|
+ call assert_true(strlen(sound) < 254, 'soundfold result exceeds MAXWLEN')
|
|
+
|
|
+ set spell& spelllang&
|
|
+ let &enc = _enc
|
|
+endfunc
|
|
+
|
|
" vim: shiftwidth=2 sts=2 expandtab
|
|
--
|
|
2.44.4
|
|
|