diff mbox series

[scarthgap,01/13] vim: Security Fix for CVE-2026-28422

Message ID 20260722201905.491897-1-sdoshi@mvista.com
State New
Headers show
Series [scarthgap,01/13] vim: Security Fix for CVE-2026-28422 | expand

Commit Message

Siddharth July 22, 2026, 8:18 p.m. UTC 
From: Siddharth Doshi <sdoshi@mvista.com>

Picking patch as per [1], and same patch is mentioned in [2]

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-28422
[2] https://security-tracker.debian.org/tracker/CVE-2026-28422

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
---
 .../vim/files/CVE-2026-28422.patch            | 44 +++++++++++++++++++
 meta/recipes-support/vim/vim.inc              |  1 +
 2 files changed, 45 insertions(+)
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-28422.patch
diff mbox series

Patch

diff --git a/meta/recipes-support/vim/files/CVE-2026-28422.patch b/meta/recipes-support/vim/files/CVE-2026-28422.patch
new file mode 100644
index 0000000000..89f219ccf6
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-28422.patch
@@ -0,0 +1,44 @@ 
+From fcf19885004325f5a52db6bd6893cb5b387799d3 Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Tue, 24 Feb 2026 20:29:20 +0000
+Subject: [PATCH 01/17] patch 9.2.0078: [security]: stack-buffer-overflow in
+ build_stl_str_hl()
+
+Problem:  A stack-buffer-overflow occurs when rendering a statusline
+          with a multi-byte fill character on a very wide terminal.
+          The size check in build_stl_str_hl() uses the cell width
+          rather than the byte length, allowing the subsequent fill
+          loop to write beyond the 4096-byte MAXPATHL buffer
+          (ehdgks0627, un3xploitable).
+Solution: Update the size check to account for the byte length of
+          the fill character (using MB_CHAR2LEN).
+
+Github Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-gmqx-prf2-8mwf
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+
+Upstream-Status: Backport [https://github.com/vim/vim/commit/4e5b9e31cb7484ad156fba995fdce3c9b075b5fd]
+CVE: CVE-2026-28422
+Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
+---
+ src/buffer.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/buffer.c b/src/buffer.c
+index 0feafc590d..363dd0e04a 100644
+--- a/src/buffer.c
++++ b/src/buffer.c
+@@ -5293,7 +5293,8 @@ build_stl_str_hl(
+ 	}
+ 	width = maxwidth;
+     }
+-    else if (width < maxwidth && outputlen + maxwidth - width + 1 < outlen)
++    else if (width < maxwidth &&
++	    outputlen + (maxwidth - width) * MB_CHAR2LEN(fillchar) + 1 < outlen)
+     {
+ 	// Find how many separators there are, which we will use when
+ 	// figuring out how many groups there are.
+-- 
+2.44.4
+
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 9a4b21f530..16edebf1e9 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -33,6 +33,7 @@  SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \
            file://CVE-2026-45130.patch \
            file://CVE-2026-46483.patch \
            file://CVE-2026-28420.patch \
+           file://CVE-2026-28422.patch \
            "
 
 PV .= ".1683"