mirror of
https://git.yoctoproject.org/poky
synced 2026-10-23 07:28:17 +00:00
Hitendra Prajapati
4c5339109d
Pick the patch from [1], also referenced in the NVD report [2]. [1] https://github.com/vim/vim/commit/a9336b476fd1a182e3f79b5f83c0ffb04f8a922b [2] https://nvd.nist.gov/vuln/detail/CVE-2026-73074 (From OE-Core rev: 61f5f1268344dac4696f6390e4a81b6ed324fd34) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
102 lines
3.4 KiB
Diff
102 lines
3.4 KiB
Diff
From a9336b476fd1a182e3f79b5f83c0ffb04f8a922b Mon Sep 17 00:00:00 2001
|
|
From: Yasuhiro Matsumoto <mattn.jp@gmail.com>
|
|
Date: Thu, 23 Jul 2026 20:14:13 +0000
|
|
Subject: [PATCH] patch 9.2.0841: [security]: heap overflow when adding > 65535
|
|
text properties
|
|
|
|
Problem: [security]: heap overflow when adding > 65535 text properties
|
|
(Wang1rrr).
|
|
Solution: Verify that the number of text properties falls within the
|
|
limit (Yasuhiro Matsumoto).
|
|
|
|
Github Security Advisory:
|
|
https://github.com/vim/vim/security/advisories/GHSA-hm4g-pjfx-m27j
|
|
|
|
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
|
|
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
|
|
|
CVE: CVE-2026-73074
|
|
Upstream-Status: Backport [https://github.com/vim/vim/commit/a9336b476fd1a182e3f79b5f83c0ffb04f8a922b]
|
|
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
|
---
|
|
src/errors.h | 4 ++++
|
|
src/po/vim.pot | 3 +++
|
|
src/testdir/test_textprop.vim | 18 ++++++++++++++++++
|
|
src/textprop.c | 7 +++++++
|
|
4 files changed, 32 insertions(+)
|
|
|
|
diff --git a/src/errors.h b/src/errors.h
|
|
index 01ed16a035..5354e85f25 100644
|
|
--- a/src/errors.h
|
|
+++ b/src/errors.h
|
|
@@ -3795,3 +3795,7 @@ EXTERN char e_socket_server_failed_connecting[]
|
|
EXTERN char e_socket_server_unavailable[]
|
|
INIT(= N_("E1567: Cannot start socket server, socket path is unavailable"));
|
|
#endif
|
|
+#ifdef FEAT_PROP_POPUP
|
|
+EXTERN char e_too_many_text_properties_on_a_single_line[]
|
|
+ INIT(= N_("E1580: Too many text properties on a single line"));
|
|
+#endif
|
|
diff --git a/src/po/vim.pot b/src/po/vim.pot
|
|
index be79cf0dab..100344e270 100644
|
|
--- a/src/po/vim.pot
|
|
+++ b/src/po/vim.pot
|
|
@@ -8838,6 +8838,9 @@ msgstr ""
|
|
msgid "E1567: Cannot start socket server, socket path is unavailable"
|
|
msgstr ""
|
|
|
|
+msgid "E1580: Too many text properties on a single line"
|
|
+msgstr ""
|
|
+
|
|
#. type of cmdline window or 0
|
|
#. result of cmdline window or 0
|
|
#. buffer of cmdline window or NULL
|
|
diff --git a/src/testdir/test_textprop.vim b/src/testdir/test_textprop.vim
|
|
index b5c9f63f65..5a69ca75e7 100644
|
|
--- a/src/testdir/test_textprop.vim
|
|
+++ b/src/testdir/test_textprop.vim
|
|
@@ -4781,4 +4781,22 @@ func Test_textprop_materialize_list()
|
|
call assert_equal([], prop_list(1, #{ids: 3->range()}))
|
|
endfunc
|
|
|
|
+" Adding more than 65535 text properties to one line must be rejected instead
|
|
+" of wrapping the uint16_t property count and overflowing the allocation.
|
|
+func Test_prop_add_over_uint16_max()
|
|
+ CheckNotAsan
|
|
+ CheckNotValgrind
|
|
+ new
|
|
+ call setline(1, 'x')
|
|
+ call prop_type_add('overflow', {})
|
|
+ for _ in range(0xffff)
|
|
+ call prop_add(1, 1, {'type': 'overflow', 'length': 0})
|
|
+ endfor
|
|
+ call assert_equal(0xffff, prop_list(1)->len())
|
|
+ call assert_fails("call prop_add(1, 1, {'type': 'overflow', 'length': 0})", 'E1580:')
|
|
+ call assert_equal(0xffff, prop_list(1)->len())
|
|
+ call prop_type_delete('overflow')
|
|
+ bwipe!
|
|
+endfunc
|
|
+
|
|
" vim: shiftwidth=2 sts=2 expandtab
|
|
diff --git a/src/textprop.c b/src/textprop.c
|
|
index a06605d3dd..1f06615dbc 100644
|
|
--- a/src/textprop.c
|
|
+++ b/src/textprop.c
|
|
@@ -240,6 +240,13 @@ prop_add_one(
|
|
proplen = get_text_props(buf, lnum, &props, TRUE);
|
|
textlen = buf->b_ml.ml_line_len - proplen * sizeof(textprop_T);
|
|
|
|
+ // prop_count is a uint16_t; stop before proplen + 1 wraps to zero.
|
|
+ if (proplen >= 0xffff)
|
|
+ {
|
|
+ emsg(_(e_too_many_text_properties_on_a_single_line));
|
|
+ goto theend;
|
|
+ }
|
|
+
|
|
if (lnum == start_lnum)
|
|
col = start_col;
|
|
else
|
|
--
|
|
2.50.1
|
|
|