diff mbox series

[kirkstone] vim: Fix CVE-2026-25749

Message ID 20260408112654.1029664-1-hprajapati@mvista.com
State Under Review
Delegated to: Yoann Congal
Headers show
Series [kirkstone] vim: Fix CVE-2026-25749 | expand

Commit Message

Hitendra Prajapati April 8, 2026, 11:26 a.m. UTC 
Pick patch from [1] also mentioned in [2]

[1] https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-25749

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
---
 .../vim/files/CVE-2026-25749.patch            | 64 +++++++++++++++++++
 meta/recipes-support/vim/vim.inc              |  1 +
 2 files changed, 65 insertions(+)
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-25749.patch

Comments

Yoann Congal April 9, 2026, 8:30 a.m. UTC | #1 
On Wed Apr 8, 2026 at 1:26 PM CEST, Hitendra Prajapati via lists.openembedded.org wrote:
> Pick patch from [1] also mentioned in [2]
>
> [1] https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9
> [2] https://nvd.nist.gov/vuln/detail/CVE-2026-25749
>
> Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
> ---

Hello,

I'm sorry but this patch (and the other vim patches sent after this one)
is too late to make it into the last kirkstone release.
See: End of kirkstone LTS support
https://lore.kernel.org/yocto/DH8I3C005I7I.EAFAABGT2FJL@smile.fr/T/#u

Regards,

>  .../vim/files/CVE-2026-25749.patch            | 64 +++++++++++++++++++
>  meta/recipes-support/vim/vim.inc              |  1 +
>  2 files changed, 65 insertions(+)
>  create mode 100644 meta/recipes-support/vim/files/CVE-2026-25749.patch
>
> diff --git a/meta/recipes-support/vim/files/CVE-2026-25749.patch b/meta/recipes-support/vim/files/CVE-2026-25749.patch
> new file mode 100644
> index 0000000000..8b04379b9b
> --- /dev/null
> +++ b/meta/recipes-support/vim/files/CVE-2026-25749.patch
> @@ -0,0 +1,64 @@
> +From e0065a61a42bdff9c75aa18104f8ff546938395f Mon Sep 17 00:00:00 2001
> +From: Christian Brabandt <cb@256bit.org>
> +Date: Thu, 5 Feb 2026 18:51:54 +0000
> +Subject: [PATCH] patch 9.1.2132: [security]: buffer-overflow in 'helpfile'
> + option handling
> +
> +Problem:  [security]: buffer-overflow in 'helpfile' option handling by
> +          using strcpy without bound checks (Rahul Hoysala)
> +Solution: Limit strncpy to the length of the buffer (MAXPATHL)
> +
> +Github Advisory:
> +https://github.com/vim/vim/security/advisories/GHSA-5w93-4g67-mm43
> +
> +CVE: CVE-2026-25749
> +Upstream-Status: Backport [https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9]
> +
> +Backport Changes:
> +- Excluded changes to src/version.c and runtime/doc/version9.txt
> +  from this backport. This file only tracks upstream version increments.
> +  We are applying a security fix, not a version upgrade. These changes
> +  were skipped to maintain current package versioning and avoid merge conflicts.
> +
> +Signed-off-by: Christian Brabandt <cb@256bit.org>
> +(cherry picked from commit 0714b15940b245108e6e9d7aa2260dd849a26fa9)
> +Signed-off-by: Anil Dongare <adongare@cisco.com>
> +---
> + src/tag.c                 | 2 +-
> + src/testdir/test_help.vim | 9 +++++++++
> + 2 files changed, 10 insertions(+), 1 deletion(-)
> +
> +diff --git a/src/tag.c b/src/tag.c
> +index 6912e8743..a32bbb245 100644
> +--- a/src/tag.c
> ++++ b/src/tag.c
> +@@ -3348,7 +3348,7 @@ get_tagfname(
> + 	    if (tnp->tn_hf_idx > tag_fnames.ga_len || *p_hf == NUL)
> + 		return FAIL;
> + 	    ++tnp->tn_hf_idx;
> +-	    STRCPY(buf, p_hf);
> ++	    vim_strncpy(buf, p_hf, MAXPATHL - 1);
> + 	    STRCPY(gettail(buf), "tags");
> + #ifdef BACKSLASH_IN_FILENAME
> + 	    slash_adjust(buf);
> +diff --git a/src/testdir/test_help.vim b/src/testdir/test_help.vim
> +index dac153d86..f9e4686bb 100644
> +--- a/src/testdir/test_help.vim
> ++++ b/src/testdir/test_help.vim
> +@@ -222,4 +222,13 @@ func Test_helptag_navigation()
> + endfunc
> + 
> + 
> ++" This caused a buffer overflow
> ++func Test_helpfile_overflow()
> ++  let _helpfile = &helpfile
> ++  let &helpfile = repeat('A', 5000)
> ++  help
> ++  helpclose
> ++  let &helpfile = _helpfile
> ++endfunc
> ++
> + " vim: shiftwidth=2 sts=2 expandtab
> +-- 
> +2.43.7
> +
> diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
> index fc9b4db055..fa63689ef1 100644
> --- a/meta/recipes-support/vim/vim.inc
> +++ b/meta/recipes-support/vim/vim.inc
> @@ -17,6 +17,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \
>             file://0001-src-Makefile-improve-reproducibility.patch \
>             file://no-path-adjust.patch \
>             file://CVE-2026-33412.patch \
> +           file://CVE-2026-25749.patch \
>             "
>  
>  PV .= ".1683"
Hitendra Prajapati April 9, 2026, 9:04 a.m. UTC | #2 
Hi Yoann,

Thanks for the info. I understand it's too late for kirkstone.

Regards,
Hitendra

On Thu, 9 Apr, 2026, 2:00 pm Yoann Congal, <yoann.congal@smile.fr> wrote:

> On Wed Apr 8, 2026 at 1:26 PM CEST, Hitendra Prajapati via
> lists.openembedded.org wrote:
> > Pick patch from [1] also mentioned in [2]
> >
> > [1]
> https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9
> > [2] https://nvd.nist.gov/vuln/detail/CVE-2026-25749
> >
> > Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
> > ---
>
> Hello,
>
> I'm sorry but this patch (and the other vim patches sent after this one)
> is too late to make it into the last kirkstone release.
> See: End of kirkstone LTS support
> https://lore.kernel.org/yocto/DH8I3C005I7I.EAFAABGT2FJL@smile.fr/T/#u
>
> Regards,
>
> >  .../vim/files/CVE-2026-25749.patch            | 64 +++++++++++++++++++
> >  meta/recipes-support/vim/vim.inc              |  1 +
> >  2 files changed, 65 insertions(+)
> >  create mode 100644 meta/recipes-support/vim/files/CVE-2026-25749.patch
> >
> > diff --git a/meta/recipes-support/vim/files/CVE-2026-25749.patch
> b/meta/recipes-support/vim/files/CVE-2026-25749.patch
> > new file mode 100644
> > index 0000000000..8b04379b9b
> > --- /dev/null
> > +++ b/meta/recipes-support/vim/files/CVE-2026-25749.patch
> > @@ -0,0 +1,64 @@
> > +From e0065a61a42bdff9c75aa18104f8ff546938395f Mon Sep 17 00:00:00 2001
> > +From: Christian Brabandt <cb@256bit.org>
> > +Date: Thu, 5 Feb 2026 18:51:54 +0000
> > +Subject: [PATCH] patch 9.1.2132: [security]: buffer-overflow in
> 'helpfile'
> > + option handling
> > +
> > +Problem:  [security]: buffer-overflow in 'helpfile' option handling by
> > +          using strcpy without bound checks (Rahul Hoysala)
> > +Solution: Limit strncpy to the length of the buffer (MAXPATHL)
> > +
> > +Github Advisory:
> > +https://github.com/vim/vim/security/advisories/GHSA-5w93-4g67-mm43
> > +
> > +CVE: CVE-2026-25749
> > +Upstream-Status: Backport [
> https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9
> ]
> > +
> > +Backport Changes:
> > +- Excluded changes to src/version.c and runtime/doc/version9.txt
> > +  from this backport. This file only tracks upstream version increments.
> > +  We are applying a security fix, not a version upgrade. These changes
> > +  were skipped to maintain current package versioning and avoid merge
> conflicts.
> > +
> > +Signed-off-by: Christian Brabandt <cb@256bit.org>
> > +(cherry picked from commit 0714b15940b245108e6e9d7aa2260dd849a26fa9)
> > +Signed-off-by: Anil Dongare <adongare@cisco.com>
> > +---
> > + src/tag.c                 | 2 +-
> > + src/testdir/test_help.vim | 9 +++++++++
> > + 2 files changed, 10 insertions(+), 1 deletion(-)
> > +
> > +diff --git a/src/tag.c b/src/tag.c
> > +index 6912e8743..a32bbb245 100644
> > +--- a/src/tag.c
> > ++++ b/src/tag.c
> > +@@ -3348,7 +3348,7 @@ get_tagfname(
> > +         if (tnp->tn_hf_idx > tag_fnames.ga_len || *p_hf == NUL)
> > +             return FAIL;
> > +         ++tnp->tn_hf_idx;
> > +-        STRCPY(buf, p_hf);
> > ++        vim_strncpy(buf, p_hf, MAXPATHL - 1);
> > +         STRCPY(gettail(buf), "tags");
> > + #ifdef BACKSLASH_IN_FILENAME
> > +         slash_adjust(buf);
> > +diff --git a/src/testdir/test_help.vim b/src/testdir/test_help.vim
> > +index dac153d86..f9e4686bb 100644
> > +--- a/src/testdir/test_help.vim
> > ++++ b/src/testdir/test_help.vim
> > +@@ -222,4 +222,13 @@ func Test_helptag_navigation()
> > + endfunc
> > +
> > +
> > ++" This caused a buffer overflow
> > ++func Test_helpfile_overflow()
> > ++  let _helpfile = &helpfile
> > ++  let &helpfile = repeat('A', 5000)
> > ++  help
> > ++  helpclose
> > ++  let &helpfile = _helpfile
> > ++endfunc
> > ++
> > + " vim: shiftwidth=2 sts=2 expandtab
> > +--
> > +2.43.7
> > +
> > diff --git a/meta/recipes-support/vim/vim.inc
> b/meta/recipes-support/vim/vim.inc
> > index fc9b4db055..fa63689ef1 100644
> > --- a/meta/recipes-support/vim/vim.inc
> > +++ b/meta/recipes-support/vim/vim.inc
> > @@ -17,6 +17,7 @@ SRC_URI = "git://
> github.com/vim/vim.git;branch=master;protocol=https \
> >             file://0001-src-Makefile-improve-reproducibility.patch \
> >             file://no-path-adjust.patch \
> >             file://CVE-2026-33412.patch \
> > +           file://CVE-2026-25749.patch \
> >             "
> >
> >  PV .= ".1683"
>
>
> --
> Yoann Congal
> Smile ECS
>
>
Yoann Congal April 9, 2026, 9:16 a.m. UTC | #3 
Le jeu. 9 avr. 2026 à 11:05, Hitendra Prajapati <hprajapati@mvista.com> a
écrit :

> Hi Yoann,
>
> Thanks for the info. I understand it's too late for kirkstone.
>

Well... Stay tuned because I might ultimately slip them in: I need to fix
the branch before building the release.


> Regards,
> Hitendra
>
> On Thu, 9 Apr, 2026, 2:00 pm Yoann Congal, <yoann.congal@smile.fr> wrote:
>
>> On Wed Apr 8, 2026 at 1:26 PM CEST, Hitendra Prajapati via
>> lists.openembedded.org wrote:
>> > Pick patch from [1] also mentioned in [2]
>> >
>> > [1]
>> https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9
>> > [2] https://nvd.nist.gov/vuln/detail/CVE-2026-25749
>> >
>> > Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
>> > ---
>>
>> Hello,
>>
>> I'm sorry but this patch (and the other vim patches sent after this one)
>> is too late to make it into the last kirkstone release.
>> See: End of kirkstone LTS support
>> https://lore.kernel.org/yocto/DH8I3C005I7I.EAFAABGT2FJL@smile.fr/T/#u
>>
>> Regards,
>>
>> >  .../vim/files/CVE-2026-25749.patch            | 64 +++++++++++++++++++
>> >  meta/recipes-support/vim/vim.inc              |  1 +
>> >  2 files changed, 65 insertions(+)
>> >  create mode 100644 meta/recipes-support/vim/files/CVE-2026-25749.patch
>> >
>> > diff --git a/meta/recipes-support/vim/files/CVE-2026-25749.patch
>> b/meta/recipes-support/vim/files/CVE-2026-25749.patch
>> > new file mode 100644
>> > index 0000000000..8b04379b9b
>> > --- /dev/null
>> > +++ b/meta/recipes-support/vim/files/CVE-2026-25749.patch
>> > @@ -0,0 +1,64 @@
>> > +From e0065a61a42bdff9c75aa18104f8ff546938395f Mon Sep 17 00:00:00 2001
>> > +From: Christian Brabandt <cb@256bit.org>
>> > +Date: Thu, 5 Feb 2026 18:51:54 +0000
>> > +Subject: [PATCH] patch 9.1.2132: [security]: buffer-overflow in
>> 'helpfile'
>> > + option handling
>> > +
>> > +Problem:  [security]: buffer-overflow in 'helpfile' option handling by
>> > +          using strcpy without bound checks (Rahul Hoysala)
>> > +Solution: Limit strncpy to the length of the buffer (MAXPATHL)
>> > +
>> > +Github Advisory:
>> > +https://github.com/vim/vim/security/advisories/GHSA-5w93-4g67-mm43
>> > +
>> > +CVE: CVE-2026-25749
>> > +Upstream-Status: Backport [
>> https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9
>> ]
>> > +
>> > +Backport Changes:
>> > +- Excluded changes to src/version.c and runtime/doc/version9.txt
>> > +  from this backport. This file only tracks upstream version
>> increments.
>> > +  We are applying a security fix, not a version upgrade. These changes
>> > +  were skipped to maintain current package versioning and avoid merge
>> conflicts.
>> > +
>> > +Signed-off-by: Christian Brabandt <cb@256bit.org>
>> > +(cherry picked from commit 0714b15940b245108e6e9d7aa2260dd849a26fa9)
>> > +Signed-off-by: Anil Dongare <adongare@cisco.com>
>> > +---
>> > + src/tag.c                 | 2 +-
>> > + src/testdir/test_help.vim | 9 +++++++++
>> > + 2 files changed, 10 insertions(+), 1 deletion(-)
>> > +
>> > +diff --git a/src/tag.c b/src/tag.c
>> > +index 6912e8743..a32bbb245 100644
>> > +--- a/src/tag.c
>> > ++++ b/src/tag.c
>> > +@@ -3348,7 +3348,7 @@ get_tagfname(
>> > +         if (tnp->tn_hf_idx > tag_fnames.ga_len || *p_hf == NUL)
>> > +             return FAIL;
>> > +         ++tnp->tn_hf_idx;
>> > +-        STRCPY(buf, p_hf);
>> > ++        vim_strncpy(buf, p_hf, MAXPATHL - 1);
>> > +         STRCPY(gettail(buf), "tags");
>> > + #ifdef BACKSLASH_IN_FILENAME
>> > +         slash_adjust(buf);
>> > +diff --git a/src/testdir/test_help.vim b/src/testdir/test_help.vim
>> > +index dac153d86..f9e4686bb 100644
>> > +--- a/src/testdir/test_help.vim
>> > ++++ b/src/testdir/test_help.vim
>> > +@@ -222,4 +222,13 @@ func Test_helptag_navigation()
>> > + endfunc
>> > +
>> > +
>> > ++" This caused a buffer overflow
>> > ++func Test_helpfile_overflow()
>> > ++  let _helpfile = &helpfile
>> > ++  let &helpfile = repeat('A', 5000)
>> > ++  help
>> > ++  helpclose
>> > ++  let &helpfile = _helpfile
>> > ++endfunc
>> > ++
>> > + " vim: shiftwidth=2 sts=2 expandtab
>> > +--
>> > +2.43.7
>> > +
>> > diff --git a/meta/recipes-support/vim/vim.inc
>> b/meta/recipes-support/vim/vim.inc
>> > index fc9b4db055..fa63689ef1 100644
>> > --- a/meta/recipes-support/vim/vim.inc
>> > +++ b/meta/recipes-support/vim/vim.inc
>> > @@ -17,6 +17,7 @@ SRC_URI = "git://
>> github.com/vim/vim.git;branch=master;protocol=https \
>> >             file://0001-src-Makefile-improve-reproducibility.patch \
>> >             file://no-path-adjust.patch \
>> >             file://CVE-2026-33412.patch \
>> > +           file://CVE-2026-25749.patch \
>> >             "
>> >
>> >  PV .= ".1683"
>>
>>
>> --
>> Yoann Congal
>> Smile ECS
>>
>>
diff mbox series

Patch

diff --git a/meta/recipes-support/vim/files/CVE-2026-25749.patch b/meta/recipes-support/vim/files/CVE-2026-25749.patch
new file mode 100644
index 0000000000..8b04379b9b
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-25749.patch
@@ -0,0 +1,64 @@ 
+From e0065a61a42bdff9c75aa18104f8ff546938395f Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Thu, 5 Feb 2026 18:51:54 +0000
+Subject: [PATCH] patch 9.1.2132: [security]: buffer-overflow in 'helpfile'
+ option handling
+
+Problem:  [security]: buffer-overflow in 'helpfile' option handling by
+          using strcpy without bound checks (Rahul Hoysala)
+Solution: Limit strncpy to the length of the buffer (MAXPATHL)
+
+Github Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-5w93-4g67-mm43
+
+CVE: CVE-2026-25749
+Upstream-Status: Backport [https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9]
+
+Backport Changes:
+- Excluded changes to src/version.c and runtime/doc/version9.txt
+  from this backport. This file only tracks upstream version increments.
+  We are applying a security fix, not a version upgrade. These changes
+  were skipped to maintain current package versioning and avoid merge conflicts.
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+(cherry picked from commit 0714b15940b245108e6e9d7aa2260dd849a26fa9)
+Signed-off-by: Anil Dongare <adongare@cisco.com>
+---
+ src/tag.c                 | 2 +-
+ src/testdir/test_help.vim | 9 +++++++++
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/src/tag.c b/src/tag.c
+index 6912e8743..a32bbb245 100644
+--- a/src/tag.c
++++ b/src/tag.c
+@@ -3348,7 +3348,7 @@ get_tagfname(
+ 	    if (tnp->tn_hf_idx > tag_fnames.ga_len || *p_hf == NUL)
+ 		return FAIL;
+ 	    ++tnp->tn_hf_idx;
+-	    STRCPY(buf, p_hf);
++	    vim_strncpy(buf, p_hf, MAXPATHL - 1);
+ 	    STRCPY(gettail(buf), "tags");
+ #ifdef BACKSLASH_IN_FILENAME
+ 	    slash_adjust(buf);
+diff --git a/src/testdir/test_help.vim b/src/testdir/test_help.vim
+index dac153d86..f9e4686bb 100644
+--- a/src/testdir/test_help.vim
++++ b/src/testdir/test_help.vim
+@@ -222,4 +222,13 @@ func Test_helptag_navigation()
+ endfunc
+ 
+ 
++" This caused a buffer overflow
++func Test_helpfile_overflow()
++  let _helpfile = &helpfile
++  let &helpfile = repeat('A', 5000)
++  help
++  helpclose
++  let &helpfile = _helpfile
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+2.43.7
+
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index fc9b4db055..fa63689ef1 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -17,6 +17,7 @@  SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \
            file://0001-src-Makefile-improve-reproducibility.patch \
            file://no-path-adjust.patch \
            file://CVE-2026-33412.patch \
+           file://CVE-2026-25749.patch \
            "
 
 PV .= ".1683"