From patchwork Sat Aug 1 09:10:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh R Maheshwari X-Patchwork-Id: 94095 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 92AD3C54FCD for ; Sat, 1 Aug 2026 09:12:01 +0000 (UTC) Received: from naesa03.arrow.com (naesa03.arrow.com [216.150.161.23]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.2447.1785575515784141923 for ; Sat, 01 Aug 2026 02:11:56 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=eC4J+Hoz; spf=pass (domain: einfochips.com, ip: 216.150.161.23, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=4821; q=dns/txt; s=NAESA-Selector1; t=1785575516; x=1817111516; h=from:to:subject:date:message-id:mime-version: content-transfer-encoding; bh=IpSIPR/ZLXxYvJc4HRCilk7kZjZXGwFMe7B1BxxspEo=; b=eC4J+Hoze8sdn9t+KWcFKSjFs/RKQTIwI6AU8ZtRSGs348cqfMtIX8HD NHxKJ8LYFGs5TseEVxKs63qH2qJkstH0L6pQfFSniF4U1zSPj3IqZ+r5n E46rx82lIXsyINYWcxZ7Ej40C7v2//2w19YNOy5+WJnWgdVCTDlCJ4as+ vbd1yATE6BuKfE7p1KuPqb8XLCF+zGBs+wmHdoUmqYn7pCI4oViDLwIag R0d1KztTFsN6jZw/XssLNwtqh5URb5BXOEbrr3jkk/xPG1aV94dTw9wVy PqRyZBaBORmvTIlh7eYm+K6ECZaW7xmCjacx0baCTIazu87EqnrysprbG A==; X-CSE-ConnectionGUID: d4PI0Pz3RR+VyDZfEGskeA== X-CSE-MsgGUID: 6SSOXVCHQ/KmRRySmGTWsA== X-IronPort-AV: E=Sophos;i="6.25,198,1779170400"; d="scan'208";a="118911515" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.22.168]) by naesa03out.arrow.com with ESMTP; 01 Aug 2026 03:11:54 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 01/10] vim: Fix for CVE-2026-55693 Date: Sat, 1 Aug 2026 14:40:18 +0530 Message-ID: <20260801091145.2788751-1-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 01 Aug 2026 09:12:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242479 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-55693 Signed-off-by: Bhavesh R Maheshwari --- .../vim/files/CVE-2026-55693.patch | 103 ++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 104 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-55693.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-55693.patch b/meta/recipes-support/vim/files/CVE-2026-55693.patch new file mode 100644 index 0000000000..cc302d2a18 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-55693.patch @@ -0,0 +1,103 @@ +From d64909ac1939bc91784de7f9b8d7705623d59f64 Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Mon, 15 Jun 2026 19:39:08 +0000 +Subject: [PATCH] patch 9.2.0653: [security]: out-of-bounds write in + tree_count_words() + +Problem: [security]: a crafted spell file can drive tree_count_words() + past the end of its MAXWLEN-sized depth arrays; the descent + loop has no depth bound. +Solution: only descend while depth < MAXWLEN - 1, as the sibling trie + walkers already do; apply the same guard to sug_filltree(). + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq + +Supported by AI. + +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7] +CVE: CVE-2026-55693 + +Signed-off-by: Bhavesh R Maheshwari +--- + src/spellfile.c | 4 ++-- + src/testdir/test_spellfile.vim | 27 +++++++++++++++++++++++++++ + src/version.c | 2 ++ + 3 files changed, 31 insertions(+), 2 deletions(-) + +diff --git a/src/spellfile.c b/src/spellfile.c +index 5102dad5b..b3ee9c0d6 100644 +--- a/src/spellfile.c ++++ b/src/spellfile.c +@@ -642,7 +642,7 @@ tree_count_words(char_u *byts, idx_T *idxs) + ++curi[depth]; + } + } +- else ++ else if (depth < MAXWLEN - 1) + { + // Normal char, go one level deeper to count the words. + ++depth; +@@ -5656,7 +5656,7 @@ sug_filltree(spellinfo_T *spin, slang_T *slang) + ++curi[depth]; + } + } +- else ++ else if (depth < MAXWLEN - 1) + { + // Normal char, go one level deeper. + tword[depth++] = c; +diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim +index 8f3ef4907..5b2ed4efd 100644 +--- a/src/testdir/test_spellfile.vim ++++ b/src/testdir/test_spellfile.vim +@@ -1197,4 +1197,31 @@ func Test_mkspell_no_buffer_overflow() + endfunc + + ++func Test_spell_sug_tree_count_words_overflow() ++ " A crafted .spl/.sug pair with a BY_INDEX self-cycle in the fold word tree ++ " parses cleanly (shared refs aren't recursed, so read_tree_node()'s depth ++ " cap never trips), but drove tree_count_words() past its MAXWLEN-sized depth ++ " arrays -> stack out-of-bounds write. The walk only happens when ++ " spellsuggest() loads the matching .sug. Reaching the assert == no OOB. ++ call mkdir('Xrtp/spell', 'pR') ++ " VIMspell + v50, SN_SUGFILE(ts), SN_END, LWORDTREE{node:1,BY_INDEX->0,'A'}, ++ " empty KWORDTREE/PREFIXTREE ++ let spl = eval('0z56494D7370656C6C320B0000000008000000001234' ++ \ .. '5678FF000000020101000000410000000000000000') ++ " VIMsug + v1, matching ts, SUGWORDTREE word "a", empty SUGTABLE ++ let sug = 0z56494D737567010000000012345678000000040161010000000000 ++ call writefile(spl, 'Xrtp/spell/xx.utf-8.spl', 'b') ++ call writefile(sug, 'Xrtp/spell/xx.utf-8.sug', 'b') ++ ++ new ++ set runtimepath+=./Xrtp ++ set spelllang=xx ++ set spell ++ " Unpatched: OOB write here (ASan abort, or crash). Patched: returns a list. ++ call assert_equal(v:t_list, type(spellsuggest('helloo'))) ++ ++ set spell& spelllang& runtimepath& ++ bwipe! ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab +diff --git a/src/version.c b/src/version.c +index 6eac3fc92..e7f323854 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -736,6 +736,8 @@ static int included_patches[] = + { /* Add new patch number below this line */ + /**/ + 671, ++/**/ ++ 653, + /**/ + 662, + /**/ +-- +2.53.0 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 20a5f7a054..4189817a8d 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -29,6 +29,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV} file://CVE-2026-47167.patch \ file://CVE-2026-55892.patch \ file://CVE-2026-57452.patch \ + file://CVE-2026-55693.patch \ " PV .= ".0340" From patchwork Sat Aug 1 09:10:19 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh R Maheshwari X-Patchwork-Id: 94097 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C6CDCC55175 for ; Sat, 1 Aug 2026 09:12:01 +0000 (UTC) Received: from naesa03.arrow.com (naesa03.arrow.com [216.150.161.23]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.2447.1785575515784141923 for ; Sat, 01 Aug 2026 02:11:57 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=aHcCmAfQ; spf=pass (domain: einfochips.com, ip: 216.150.161.23, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=5441; q=dns/txt; s=NAESA-Selector1; t=1785575517; x=1817111517; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=QDwSefYuciwX8ZuIft4k1HP53JZTi8uqkLABVIi0zeg=; b=aHcCmAfQLUPMFRJ1xDlAOAMT6R1wF44qe0/ARLPf3pBjfnqtC6GPsBbu oFJCZSgPKxyMJjiKRzYsB7dPRaJQoEjHWnEtNmlaJfKFG8BI7lntL5GI9 6naLlS5vtnlOKBDbKOR1b/5zB5v3mh3sNsazrIR1yvYo4BrJMB4JwNvp2 AOOAeVGHyrfqt0OdqXe5zAv1NmiHHqQ4jK1CvrtRtiuBtuMLK9CV6uGAR fwyFWBbF1LV2xF5zw0q4Z6vbvhgZKpjpImY8Uf3xBVSUXH6fPAQy2sUYJ CxnDBRBdR5lFUlLj6BSa6Lz0qYvHItzufAde60cpx3bxWLCs5cIPbLBVw A==; X-CSE-ConnectionGUID: f0DvwIV+RnSSxyycrYctgA== X-CSE-MsgGUID: sCOO62TtTe228B/wkTqljg== X-IronPort-AV: E=Sophos;i="6.25,198,1779170400"; d="scan'208";a="118911516" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.22.168]) by naesa03out.arrow.com with ESMTP; 01 Aug 2026 03:11:56 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 02/10] vim: Fix for CVE-2026-55895 Date: Sat, 1 Aug 2026 14:40:19 +0530 Message-ID: <20260801091145.2788751-2-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260801091145.2788751-1-bhavesh.maheshwari@einfochips.com> References: <20260801091145.2788751-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 01 Aug 2026 09:12:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242480 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://github.com/vim/vim/commit/55bc757a5d436e59d50fe43f7cda94b118f86cb2 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-55895 Signed-off-by: Bhavesh R Maheshwari --- .../vim/files/CVE-2026-55895.patch | 106 ++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 107 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-55895.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-55895.patch b/meta/recipes-support/vim/files/CVE-2026-55895.patch new file mode 100644 index 0000000000..6bfb8ee124 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-55895.patch @@ -0,0 +1,106 @@ +From 7c320315fab914a26bccfbbe6caf1a721897aa9c Mon Sep 17 00:00:00 2001 +From: Yasuhiro Matsumoto +Date: Tue, 16 Jun 2026 21:00:28 +0000 +Subject: [PATCH] patch 9.2.0663: [security]: runtime(netrw): code injection in + local file deletion + +Problem: [security]: s:NetrwLocalRmFile() escapes only the backslash in + the file name before passing it to :execute, so a name + containing "|" injects arbitrary Ex commands when the file is + deleted (cipher-creator) +Solution: Use fnameescape() to correctly escape the file name + (Yasuhiro Matsumoto). + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-vhh8-v6wx-hjjh + +Supported by AI + +Signed-off-by: Yasuhiro Matsumoto +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/55bc757a5d436e59d50fe43f7cda94b118f86cb2] +CVE: CVE-2026-55895 + +Signed-off-by: Bhavesh R Maheshwari +--- + .../pack/dist/opt/netrw/autoload/netrw.vim | 5 +++-- + src/testdir/test_plugin_netrw.vim | 20 +++++++++++++++++++ + src/version.c | 2 ++ + 3 files changed, 25 insertions(+), 2 deletions(-) + +diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +index a04120d5f..d7eca30e4 100644 +--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim ++++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +@@ -24,6 +24,7 @@ + " 2026 Mar 01 by Vim Project include portnumber in hostname checking #19533 + " 2026 Apr 01 by Vim Project use fnameescape() with netrw#FileUrlEdit() + " 2026 Apr 05 by Vim Project Fix netrw#RFC2396() #19913 ++" 2026 Jun 16 by Vim Project Fix filename escaping in local file deletion + " Copyright: Copyright (C) 2016 Charles E. Campbell {{{1 + " Permission is hereby granted to use and distribute this code, + " with or without modifications, provided that this copyright +@@ -3061,7 +3062,7 @@ function s:NetrwBrowse(islocal,dirname) + elseif !a:islocal && dirname !~ '[\/]$' && dirname !~ '^"' + " s:NetrwBrowse : remote regular file handler {{{3 + if bufname(dirname) != "" +- exe "NetrwKeepj b ".bufname(dirname) ++ exe "NetrwKeepj b ".fnameescape(bufname(dirname)) + else + " attempt transfer of remote regular file + +@@ -8770,7 +8771,7 @@ function s:NetrwLocalRmFile(path, fname, all) + call netrw#msg#Notify('ERROR', printf("unable to delete <%s>!", rmfile)) + else + " Remove file only if there are no pending changes +- execute printf('silent! bwipeout %s', rmfile) ++ execute printf('silent! bwipeout %s', fnameescape(rmfile)) + endif + + elseif dir && (all || empty(ok)) +diff --git a/src/testdir/test_plugin_netrw.vim b/src/testdir/test_plugin_netrw.vim +index cfce82f68..a0a3915f5 100644 +--- a/src/testdir/test_plugin_netrw.vim ++++ b/src/testdir/test_plugin_netrw.vim +@@ -674,4 +674,24 @@ func Test_netrw_injection() + endtry + endfunc + ++" Deleting a file whose name contains an Ex command separator must not let the ++" name inject commands into the :execute in s:NetrwLocalRmFile(). ++func Test_netrw_local_rm_injection() ++ CheckUnix ++ let dir = getcwd() . '/Xnetrwrm' ++ let fname = "x|let g:injected = 1" ++ call mkdir(dir, 'pR') ++ call writefile([], dir . '/' . fname) ++ try ++ call netrw#Call('NetrwLocalRmFile', dir, fname, 1) ++ call assert_false(exists('g:injected'), 'filename must not inject Ex commands') ++ " The file is removed before the sink, so its absence also confirms the ++ " vulnerable code path was actually exercised (not skipped on an error). ++ call assert_false(filereadable(dir . '/' . fname), 'crafted file must be deleted') ++ finally ++ call delete(dir . '/' . fname) ++ unlet! g:injected ++ endtry ++endfunc ++ + " vim:ts=8 sts=2 sw=2 et +diff --git a/src/version.c b/src/version.c +index e7f323854..16a8b140d 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -736,6 +736,8 @@ static int included_patches[] = + { /* Add new patch number below this line */ + /**/ + 671, ++/**/ ++ 663, + /**/ + 653, + /**/ +-- +2.53.0 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 4189817a8d..48edfc694f 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -30,6 +30,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV} file://CVE-2026-55892.patch \ file://CVE-2026-57452.patch \ file://CVE-2026-55693.patch \ + file://CVE-2026-55895.patch \ " PV .= ".0340" From patchwork Sat Aug 1 09:10:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh R Maheshwari X-Patchwork-Id: 94096 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 93B62C55174 for ; Sat, 1 Aug 2026 09:12:01 +0000 (UTC) Received: from naesa03.arrow.com (naesa03.arrow.com [216.150.161.23]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.2447.1785575515784141923 for ; Sat, 01 Aug 2026 02:11:59 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=JRVvG+BZ; spf=pass (domain: einfochips.com, ip: 216.150.161.23, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=7811; q=dns/txt; s=NAESA-Selector1; t=1785575519; x=1817111519; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=7BSZln1+H6e7oezg8JCq95avwM0z+1VabMr+VUHGXM0=; b=JRVvG+BZYgW4AWy+zmhQObsoSc0qsx7+FhOdrRHy1t/Zz9GsR4ZbJoqd nbGii2/rop7NQL3bLTsJTZ9XzjQkrRLGYWDCbkhTo+62AgczJB/VeAJvl Rzgaf4HlSl0fMJECP42h7NLHRfg00vTccGFx8BWF78OUXyb/y9qjjNXwJ 2PSDOl5orssmjyBJIvzyN2lVl43axIDJON5g692QkikOjp3aNyaqZpb3n v7RppKz71tQlGyxgUWmK5CNY4kC03yC/c/xQh4YEFQNQYoGVQrwq18ooP 1oN50Esa2DjMatpY4Qft6TUGAB2il2xXYt8ofEwqGbTY3GYSGLVacj08z A==; X-CSE-ConnectionGUID: 13qBAOtrSSO89oJDKIn43A== X-CSE-MsgGUID: C07/KM3zSumZK8Kcnld1wg== X-IronPort-AV: E=Sophos;i="6.25,198,1779170400"; d="scan'208";a="118911518" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.22.168]) by naesa03out.arrow.com with ESMTP; 01 Aug 2026 03:11:58 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 03/10] vim: Fix for CVE-2026-57451 Date: Sat, 1 Aug 2026 14:40:20 +0530 Message-ID: <20260801091145.2788751-3-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260801091145.2788751-1-bhavesh.maheshwari@einfochips.com> References: <20260801091145.2788751-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 01 Aug 2026 09:12:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242481 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://github.com/vim/vim/commit/b2338ca90643e2f01ecb6547c1172716aaec4f79 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-57451 Signed-off-by: Bhavesh R Maheshwari --- .../vim/files/CVE-2026-57451.patch | 192 ++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 193 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-57451.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-57451.patch b/meta/recipes-support/vim/files/CVE-2026-57451.patch new file mode 100644 index 0000000000..415ae0dd6c --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-57451.patch @@ -0,0 +1,192 @@ +From c3c95d56f5f800484b83aaf200dd393196774198 Mon Sep 17 00:00:00 2001 +From: Yasuhiro Matsumoto +Date: Wed, 17 Jun 2026 21:06:59 +0000 +Subject: [PATCH] patch 9.2.0670: [security]: Out-of-bounds read with text + properties + +Problem: [security]: Out-of-bounds read with text properties + (cipher-creator) +Solution: Add out-of-bound checks (Yasuhiro Matsumoto) + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-f36c-2qcp-7gpw + +Supported by AI + +Signed-off-by: Yasuhiro Matsumoto +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/b2338ca90643e2f01ecb6547c1172716aaec4f79] +CVE: CVE-2026-57451 + +Signed-off-by: Bhavesh R Maheshwari +--- + src/memline.c | 7 ++++ + src/proto/textprop.pro | 1 + + src/testdir/test_textprop2.vim | 59 ++++++++++++++++++++++++++++++++++ + src/textprop.c | 20 ++++++++++++ + src/version.c | 2 ++ + 5 files changed, 89 insertions(+) + +diff --git a/src/memline.c b/src/memline.c +index c15946a6e..07c7a07d3 100644 +--- a/src/memline.c ++++ b/src/memline.c +@@ -3796,6 +3796,11 @@ adjust_text_props_for_delete( + uint16_t pc; + + mch_memmove(&pc, text + textlen, PROP_COUNT_SIZE); ++ if (!text_prop_count_valid(pc, (size_t)(line_size - (long)textlen))) ++ { ++ internal_error("text property count too large"); ++ return; ++ } + this_props_len = pc * (int)sizeof(textprop_T); + } + +@@ -4034,6 +4039,8 @@ theend: + mch_memmove(&pc, textprop_save, PROP_COUNT_SIZE); + props_data = textprop_save + PROP_COUNT_SIZE; + props_bytes = pc * (int)sizeof(textprop_T); ++ if (!text_prop_count_valid(pc, (size_t)textprop_len)) ++ props_bytes = 0; + + // Adjust text properties in the line above and below. + if (lnum > 1) +diff --git a/src/proto/textprop.pro b/src/proto/textprop.pro +index d3ecf6d14..a01c2f3b2 100644 +--- a/src/proto/textprop.pro ++++ b/src/proto/textprop.pro +@@ -35,4 +35,5 @@ void clear_buf_prop_types(buf_T *buf); + int adjust_prop_columns(linenr_T lnum, colnr_T col, int bytes_added, int flags); + void adjust_props_for_split(linenr_T lnum_props, linenr_T lnum_top, int kept, int deleted, int at_eol); + void prepend_joined_props(unpacked_memline_T *um, linenr_T lnum, int last_line, long col, int removed); ++bool text_prop_count_valid(int prop_count, size_t propdata_len); + /* vim: set ft=c : */ +diff --git a/src/testdir/test_textprop2.vim b/src/testdir/test_textprop2.vim +index 193a80841..48387d1c0 100644 +--- a/src/testdir/test_textprop2.vim ++++ b/src/testdir/test_textprop2.vim +@@ -428,4 +428,63 @@ func Test_multiline_prop_delete_penultimate_line() + call s:CleanupPropTypes(['1', '2', '3']) + endfunc + ++func s:ManipulateUndoBlob(name) ++ " Patch the saved old line in the undo file: ++ " 00 00 00 08 'QQQQQQQQ' -> 00 00 00 27 'AAAA' NUL count=0xFFFF <32x00> ++ " i.e. textlen 8 text-only -> 39-byte blob: text "AAAA", NUL, prop_count ++ " 0xFFFF, one zeroed textprop_T(32). propdata_len becomes 34, count 65535. ++ let blob = readfile(a:name, 'B') ++ let marker = 0z000000085151515151515151 ++ let repl = 0z000000274141414100FFFF + repeat(0z00, 32) ++ let mlen = len(marker) ++ let idx = -1 ++ let i = 0 ++ while i <= len(blob) - mlen ++ if blob[i : i + mlen - 1] ==# marker ++ let idx = i ++ break ++ endif ++ let i += 1 ++ endwhile ++ call assert_true(idx >= 0, 'saved-line marker not found in undo file') ++ ++ let head = idx > 0 ? blob[0 : idx - 1] : 0z ++ call writefile(head + repl + blob[idx + mlen :], a:name) ++ ++ exe "rundo" a:name ++endfunc ++ ++" A crafted undo file can restore a line whose declared text-property count is ++" far larger than the data, making get_text_props() / consumers read past the ++" line buffer. Restore such a line and force a consumer; reaching the asserts ++" (no ASan abort / crash) means the count is bounded. ++func Test_textprop_undo_bad_prop_count() ++ CheckFeature persistent_undo ++ ++ new ++ call setline(1, ['QQQQQQQQ', 'DECOYLINE']) ++ let &ul = &ul ++ call setline(1, 'BBBB') " undo step saves old line 1 = "QQQQQQQQ" ++ wundo Xtpundo ++ call s:ManipulateUndoBlob('Xtpundo') ++ ++ undo ++ ++ " Safety: prove the malicious line was actually restored before the consumer ++ " runs, so the test can't pass vacuously if the patch missed. ++ call assert_equal('AAAA', getline(1)) ++ ++ " Adding a property anywhere sets b_has_textprop, so get_text_props() will ++ " actually inspect line 1 instead of returning early. ++ call prop_type_add('Xtp', {}) ++ call prop_add(2, 1, {'type': 'Xtp', 'length': 1}) ++ ++ " this caused OOB read, now it triggers internal error ++ call assert_fails('call prop_list(1)', ['E340:', 'corrupted']) ++ ++ call prop_type_delete('Xtp') ++ bwipe! ++ call delete('Xtpundo') ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab +diff --git a/src/textprop.c b/src/textprop.c +index 33165a8e4..6b0ce45f2 100644 +--- a/src/textprop.c ++++ b/src/textprop.c +@@ -109,6 +109,12 @@ um_goto_line(unpacked_memline_T *um, linenr_T lnum, int extra_props) + char_u *props_start; + + mch_memmove(&prop_count, count_ptr, PROP_COUNT_SIZE); ++ if (!text_prop_count_valid(prop_count, propdata_len)) ++ { ++ iemsg(e_text_property_info_corrupted); ++ um->buf = NULL; ++ return false; ++ } + proplen = (int)prop_count; + props_start = count_ptr + PROP_COUNT_SIZE; + +@@ -1235,6 +1241,11 @@ get_text_props(buf_T *buf, linenr_T lnum, char_u **props, int will_change) + return 0; + } + mch_memmove(&prop_count, text + textlen, PROP_COUNT_SIZE); ++ if (!text_prop_count_valid(prop_count, propdata_len)) ++ { ++ iemsg(e_text_property_info_corrupted); ++ return 0; ++ } + *props = text + textlen + PROP_COUNT_SIZE; + return (int)prop_count; + } +@@ -3219,4 +3230,13 @@ prepend_joined_props( + um_abort(&r_um); + } + ++ bool ++text_prop_count_valid(int prop_count, size_t propdata_len) ++{ ++ if (propdata_len < PROP_COUNT_SIZE) ++ return false; ++ return (size_t)prop_count * sizeof(textprop_T) ++ <= propdata_len - PROP_COUNT_SIZE; ++} ++ + #endif // FEAT_PROP_POPUP +diff --git a/src/version.c b/src/version.c +index 16a8b140d..a216b9b01 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -736,6 +736,8 @@ static int included_patches[] = + { /* Add new patch number below this line */ + /**/ + 671, ++/**/ ++ 670, + /**/ + 663, + /**/ +-- +2.53.0 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 48edfc694f..0fc3ae5df0 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -31,6 +31,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV} file://CVE-2026-57452.patch \ file://CVE-2026-55693.patch \ file://CVE-2026-55895.patch \ + file://CVE-2026-57451.patch \ " PV .= ".0340" From patchwork Sat Aug 1 09:10:21 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh R Maheshwari X-Patchwork-Id: 94098 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0261BC5516F for ; Sat, 1 Aug 2026 09:12:03 +0000 (UTC) Received: from naesa03.arrow.com (naesa03.arrow.com [216.150.161.23]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.2447.1785575515784141923 for ; Sat, 01 Aug 2026 02:12:01 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=DyKl9bLB; spf=pass (domain: einfochips.com, ip: 216.150.161.23, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=13140; q=dns/txt; s=NAESA-Selector1; t=1785575521; x=1817111521; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=ViEl7lxyzXwYo8MXX8OkEKfyDErZ6BxGcMAVLayEOqY=; b=DyKl9bLBB2+hicruNAIkV5ErYsPFh3ZMcRfMRuegsRrnRy0Lw3XJ+cTp H1xiJI7HRx9QWeSVyB4V9aPHimIObj3C5LxZXBip/kHnlulbmnncEKVrV 0+zNNFE6r+yV90w3w+r4brxZAItyTbz7PYstLaJUIpfu+kW9QvQ39zHVb rP4BjvZ4FXAIhCabeOpjrIm5LRE68/0U4y+h58MSTp/nPBqsaDeuCCOJI rGow35AJ9fUfaIcsaJQucNrf9dIjRwoyOaJP+gwEH3haSKgKkUoTXFCd1 qYpwL7rcEQjdHPoN/rEwFhJa8xZLbCRKLyEn0lpkS4OlvUO6uIDNc8GJH g==; X-CSE-ConnectionGUID: vTZKoA4YTvm7ZVFPwOEfww== X-CSE-MsgGUID: ToVcHSTvTVG7rVCcmu8xew== X-IronPort-AV: E=Sophos;i="6.25,198,1779170400"; d="scan'208";a="118911521" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.22.168]) by naesa03out.arrow.com with ESMTP; 01 Aug 2026 03:12:00 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 04/10] vim: Fix for CVE-2026-57453 Date: Sat, 1 Aug 2026 14:40:21 +0530 Message-ID: <20260801091145.2788751-4-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260801091145.2788751-1-bhavesh.maheshwari@einfochips.com> References: <20260801091145.2788751-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 01 Aug 2026 09:12:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242482 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://github.com/vim/vim/commit/b2cc9be119d51212bf0d3f2a99 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-57453 Signed-off-by: Bhavesh R Maheshwari --- .../vim/files/CVE-2026-57453.patch | 269 ++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 270 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-57453.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-57453.patch b/meta/recipes-support/vim/files/CVE-2026-57453.patch new file mode 100644 index 0000000000..46959d715a --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-57453.patch @@ -0,0 +1,269 @@ +From e1e4a712cb53b6f674ade81ba1384a37a31f3061 Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Sat, 20 Jun 2026 15:35:58 +0000 +Subject: [PATCH] patch 9.2.0678: [security]: potential powershell code + execution in zip.vim + +Problem: [security]: potential powershell code execution in zip.vim + (DDugs) +Solution: Cleanup zip.vim, introduce PSEscape() to escape() potential powershell code, + use consistent s:Escape() in the various PowerShell functions + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-x5fg-h5w9-9frf + +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/b2cc9be119d51212bf0d3f2a99] +CVE: CVE-2026-57453 + +Signed-off-by: Bhavesh R Maheshwari +--- + runtime/autoload/zip.vim | 78 +++++++++++++++++++--------------------- + runtime/doc/pi_zip.txt | 12 +------ + src/version.c | 2 ++ + 3 files changed, 39 insertions(+), 53 deletions(-) + +diff --git a/runtime/autoload/zip.vim b/runtime/autoload/zip.vim +index f4482fd7f..8738a7f68 100644 +--- a/runtime/autoload/zip.vim ++++ b/runtime/autoload/zip.vim +@@ -22,6 +22,7 @@ + " 2026 Mar 08 by Vim Project: Make ZipUpdatePS() check for powershell + " 2026 Apr 01 by Vim Project: Detect more path traversal attacks + " 2026 Apr 05 by Vim Project: Detect more path traversal attacks ++" 2026 Jun 20 by Vim Project: Fix wrong escaping for the powershell calls + " License: Vim License (see vim's :help license) + " Copyright: Copyright (C) 2005-2019 Charles E. Campbell {{{1 + " Permission is hereby granted to use and distribute this code, +@@ -49,15 +50,6 @@ let s:NOTE = 0 + + " --------------------------------------------------------------------- + " Global Values: {{{1 +-if !exists("g:zip_shq") +- if &shq != "" +- let g:zip_shq= &shq +- elseif has("unix") +- let g:zip_shq= "'" +- else +- let g:zip_shq= '"' +- endif +-endif + if !exists("g:zip_zipcmd") + let g:zip_zipcmd= "zip" + endif +@@ -133,7 +125,7 @@ function! s:ZipBrowsePS(zipfile) + " Browse the contents of a zip file using PowerShell's + " Equivalent `unzip -Z1 -- zipfile` + let cmds = [ +- \ '$zip = [System.IO.Compression.ZipFile]::OpenRead(' . s:Escape(a:zipfile, 1) . ');', ++ \ '$zip = [System.IO.Compression.ZipFile]::OpenRead(' . s:PSEscape(a:zipfile) . ');', + \ '$zip.Entries | ForEach-Object { $_.FullName };', + \ '$zip.Dispose()' + \ ] +@@ -147,16 +139,16 @@ function! s:ZipReadPS(zipfile, fname, tempfile) + call s:Mess('WarningMsg', "***warning*** PowerShell can display, but cannot update, files in archive subfolders") + endif + let cmds = [ +- \ '$zip = [System.IO.Compression.ZipFile]::OpenRead(' . s:Escape(a:zipfile, 1) . ');', +- \ '$fileEntry = $zip.Entries | Where-Object { $_.FullName -eq ' . s:Escape(a:fname, 1) . ' };', ++ \ '$zip = [System.IO.Compression.ZipFile]::OpenRead(' . s:PSEscape(a:zipfile) . ');', ++ \ '$fileEntry = $zip.Entries | Where-Object { $_.FullName -eq ' . s:PSEscape(a:fname) . ' };', + \ '$stream = $fileEntry.Open();', +- \ '$fileStream = [System.IO.File]::Create(' . s:Escape(a:tempfile, 1) . ');', ++ \ '$fileStream = [System.IO.File]::Create(' . s:PSEscape(a:tempfile) . ');', + \ '$stream.CopyTo($fileStream);', + \ '$fileStream.Close();', + \ '$stream.Close();', + \ '$zip.Dispose()' + \ ] +- return 'pwsh -NoProfile -Command ' . s:Escape(join(cmds, ' '), 1) ++ return 'pwsh -NoProfile -Command ' . s:Escape(join(cmds, ' ')) + endfunction + + function! s:ZipUpdatePS(zipfile, fname) +@@ -166,7 +158,7 @@ function! s:ZipUpdatePS(zipfile, fname) + call s:Mess('Error', "***error*** PowerShell cannot update files in archive subfolders") + return ':' + endif +- return 'Compress-Archive -Path ' . a:fname . ' -Update -DestinationPath ' . a:zipfile ++ return 'Compress-Archive -Path ' . s:PSEscape(a:fname) . ' -Update -DestinationPath ' . s:PSEscape(a:zipfile) + endfunction + + function! s:ZipExtractFilePS(zipfile, fname) +@@ -177,16 +169,16 @@ function! s:ZipExtractFilePS(zipfile, fname) + return ':' + endif + let cmds = [ +- \ '$zip = [System.IO.Compression.ZipFile]::OpenRead(' . s:Escape(a:zipfile, 1) . ');', +- \ '$fileEntry = $zip.Entries | Where-Object { $_.FullName -eq ' . a:fname . ' };', ++ \ '$zip = [System.IO.Compression.ZipFile]::OpenRead(' . s:PSEscape(a:zipfile) . ');', ++ \ '$fileEntry = $zip.Entries | Where-Object { $_.FullName -eq ' . s:PSEscape(a:fname) . ' };', + \ '$stream = $fileEntry.Open();', +- \ '$fileStream = [System.IO.File]::Create(' . a:fname . ');', ++ \ '$fileStream = [System.IO.File]::Create(' . s:PSEscape(a:fname) . ');', + \ '$stream.CopyTo($fileStream);', + \ '$fileStream.Close();', + \ '$stream.Close();', + \ '$zip.Dispose()' + \ ] +- return 'pwsh -NoProfile -Command ' . s:Escape(join(cmds, ' '), 1) ++ return 'pwsh -NoProfile -Command ' . s:Escape(join(cmds, ' ')) + endfunction + + function! s:ZipDeleteFilePS(zipfile, fname) +@@ -194,12 +186,12 @@ function! s:ZipDeleteFilePS(zipfile, fname) + " Equivalent to `zip -d zipfile fname` + let cmds = [ + \ 'Add-Type -AssemblyName System.IO.Compression.FileSystem;', +- \ '$zip = [System.IO.Compression.ZipFile]::Open(' . s:Escape(a:zipfile, 1) . ', ''Update'');', +- \ '$entry = $zip.Entries | Where-Object { $_.Name -eq ' . s:Escape(a:fname, 1) . ' };', ++ \ '$zip = [System.IO.Compression.ZipFile]::Open(' . s:PSEscape(a:zipfile) . ', ''Update'');', ++ \ '$entry = $zip.Entries | Where-Object { $_.Name -eq ' . s:PSEscape(a:fname) . ' };', + \ 'if ($entry) { $entry.Delete(); $zip.Dispose() }', + \ 'else { $zip.Dispose() }' + \ ] +- return 'pwsh -NoProfile -Command ' . s:Escape(join(cmds, ' '), 1) ++ return 'pwsh -NoProfile -Command ' . s:Escape(join(cmds, ' ')) + endfunction + + " ---------------- +@@ -339,9 +331,9 @@ fun! zip#Read(fname,mode) + let temp = tempname() + let fn = expand('%:p') + +- let gnu_cmd = g:zip_unzipcmd . ' -p -- ' . s:Escape(zipfile, 0) . ' ' . s:Escape(fname, 0) . ' > ' . s:Escape(temp, 0) +- let gnu_cmd = 'call system(''' . substitute(gnu_cmd, "'", "''", 'g') . ''')' +- let ps_cmd = 'sil !' . s:ZipReadPS(zipfile, fname, temp) ++ let gnu_cmd = g:zip_unzipcmd . ' -p -- ' . s:Escape(zipfile) . ' ' . s:Escape(fname) . ' > ' . s:Escape(temp) ++ let gnu_cmd = 'call system(' . string(gnu_cmd) . ')' ++ let ps_cmd = 'call system(' . string(s:ZipReadPS(zipfile, fname, temp)) . ')' + call s:TryExecGnuFallBackToPs(g:zip_unzipcmd, gnu_cmd, ps_cmd) + + sil exe 'keepalt file '.temp +@@ -408,9 +400,9 @@ fun! zip#Write(fname) + " TODO: what to check on MS-Windows to avoid writing absolute paths? + endif + if fname =~ '^[.]\{1,2}/' +- let gnu_cmd = g:zip_zipcmd . ' -d ' . s:Escape(fnamemodify(zipfile,":p"),0) . ' ' . s:Escape(fname,0) +- let gnu_cmd = 'call system(''' . substitute(gnu_cmd, "'", "''", 'g') . ''')' +- let ps_cmd = $"call system({s:Escape(s:ZipDeleteFilePS(zipfile, fname), 1)})" ++ let gnu_cmd = g:zip_zipcmd . ' -d ' . s:Escape(fnamemodify(zipfile,":p")) . ' ' . s:Escape(fname) ++ let gnu_cmd = 'call system(' . string(gnu_cmd) . ')' ++ let ps_cmd = $"call system({string(s:ZipDeleteFilePS(zipfile, fname))})" + call s:TryExecGnuFallBackToPs(g:zip_zipcmd, gnu_cmd, ps_cmd) + let fname = fname->substitute('^\([.]\{1,2}/\)\+', '', 'g') + let need_rename = 1 +@@ -419,7 +411,7 @@ fun! zip#Write(fname) + if fname =~ '/' + let dirpath = substitute(fname,'/[^/]\+$','','e') + if has("win32unix") && executable("cygpath") +- let dirpath = substitute(system("cygpath ".s:Escape(dirpath,0)),'\n','','e') ++ let dirpath = substitute(system("cygpath ".s:Escape(dirpath)),'\n','','e') + endif + call mkdir(dirpath,"p") + endif +@@ -430,16 +422,17 @@ fun! zip#Write(fname) + " don't overwrite files forcefully + exe "w ".fnameescape(fname) + if has("win32unix") && executable("cygpath") +- let zipfile = substitute(system("cygpath ".s:Escape(zipfile,0)),'\n','','e') ++ let zipfile = substitute(system("cygpath ".s:Escape(zipfile)),'\n','','e') + endif + + if (has("win32") || has("win95") || has("win64") || has("win16")) && &shell !~? 'sh$' + let fname = substitute(fname, '[', '[[]', 'g') + endif + +- let gnu_cmd = g:zip_zipcmd . ' -u '. s:Escape(fnamemodify(zipfile,":p"),0) . ' ' . s:Escape(fname,0) ++ let gnu_cmd = g:zip_zipcmd . ' -u '. s:Escape(fnamemodify(zipfile,":p")) . ' ' . s:Escape(fname) + let gnu_cmd = 'call system(''' . substitute(gnu_cmd, "'", "''", 'g') . ''')' +- let ps_cmd = s:ZipUpdatePS(s:Escape(fnamemodify(zipfile, ':p'), 0), s:Escape(fname, 0)) ++ let zip = fnamemodify(zipfile, ':p') ++ let ps_cmd = s:ZipUpdatePS(zip, fname) + let ps_cmd = 'call system(''' . substitute(ps_cmd, "'", "''", 'g') . ''')' + call s:TryExecGnuFallBackToPs(g:zip_zipcmd, gnu_cmd, ps_cmd) + if &shell =~ 'pwsh' +@@ -522,8 +515,8 @@ fun! zip#Extract() + + " extract the file mentioned under the cursor + let gnu_cmd = g:zip_extractcmd . ' -o '. shellescape(b:zipfile) . ' ' . target +- let gnu_cmd = 'call system(''' . substitute(gnu_cmd, "'", "''", 'g') . ''')' +- let ps_cmd = $"call system({s:Escape(s:ZipExtractFilePS(b:zipfile, target), 1)})" ++ let gnu_cmd = 'call system(' . string(gnu_cmd) . ')' ++ let ps_cmd = 'call system(' . string(s:ZipExtractFilePS(b:zipfile, fname)) . ')' + call s:TryExecGnuFallBackToPs(g:zip_extractcmd, gnu_cmd, ps_cmd) + + if v:shell_error != 0 +@@ -537,19 +530,20 @@ endfun + + " --------------------------------------------------------------------- + " s:Escape: {{{2 +-fun! s:Escape(fname,isfilt) +- if exists("*shellescape") +- if a:isfilt +- let qnameq= shellescape(a:fname,1) +- else +- let qnameq= shellescape(a:fname) +- endif ++fun! s:Escape(fname, isfilt = 0) ++ if a:isfilt ++ let qnameq = shellescape(a:fname, 1) + else +- let qnameq= g:zip_shq.escape(a:fname,g:zip_shq).g:zip_shq ++ let qnameq = shellescape(a:fname) + endif + return qnameq + endfun + ++" s:PSEscape: Escape a string for Powershell, shellescape() does not work here {{{2 ++fun! s:PSEscape(str) ++ return "'" .. substitute(a:str, "'", "''", 'g') .. "'" ++endfun ++ + " --------------------------------------------------------------------- + " s:ChgDir: {{{2 + fun! s:ChgDir(newdir,errlvl,errmsg) +diff --git a/runtime/doc/pi_zip.txt b/runtime/doc/pi_zip.txt +index e9294b405..67c37721f 100644 +--- a/runtime/doc/pi_zip.txt ++++ b/runtime/doc/pi_zip.txt +@@ -1,4 +1,4 @@ +-*pi_zip.txt* For Vim version 9.2. Last change: 2026 Apr 05 ++*pi_zip.txt* For Vim version 9.2. Last change: 2026 Jun 20 + + +====================+ + | Zip File Interface | +@@ -48,16 +48,6 @@ Copyright: Copyright (C) 2005-2015 Charles E Campbell *zip-copyright* + If this variable exists and is true, the file window will not be + automatically maximized when opened. + +- *g:zip_shq* +- Different operating systems may use one or more shells to execute +- commands. Zip will try to guess the correct quoting mechanism to +- allow spaces and whatnot in filenames; however, if it is incorrectly +- guessing the quote to use for your setup, you may use > +- g:zip_shq +-< which by default is a single quote under Unix (') and a double quote +- under Windows ("). If you'd rather have no quotes, simply set +- g:zip_shq to the empty string (let g:zip_shq= "") in your <.vimrc>. +- + *g:zip_unzipcmd* + Use this option to specify the program which does the duty of "unzip". + It's used during browsing. By default: > +diff --git a/src/version.c b/src/version.c +index a216b9b01..4d6908426 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -734,6 +734,8 @@ static char *(features[]) = + + static int included_patches[] = + { /* Add new patch number below this line */ ++/**/ ++ 678, + /**/ + 671, + /**/ +-- +2.53.0 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 0fc3ae5df0..56a2004899 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -32,6 +32,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV} file://CVE-2026-55693.patch \ file://CVE-2026-55895.patch \ file://CVE-2026-57451.patch \ + file://CVE-2026-57453.patch \ " PV .= ".0340" From patchwork Sat Aug 1 09:10:22 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh R Maheshwari X-Patchwork-Id: 94100 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D9829C5516F for ; Sat, 1 Aug 2026 09:12:11 +0000 (UTC) Received: from naesa03.arrow.com (naesa03.arrow.com [216.150.161.23]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.2447.1785575515784141923 for ; Sat, 01 Aug 2026 02:12:03 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=On8PLPZT; spf=pass (domain: einfochips.com, ip: 216.150.161.23, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=8955; q=dns/txt; s=NAESA-Selector1; t=1785575523; x=1817111523; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=jXPN18Wm9rGyVQ9EZbTwxgDIhgt5jq/bkKYBN8Z7G0w=; b=On8PLPZTeroBsDSI7BPtCDEDcJmjyaP8IWXG7j7JkruDfyCueyUpju6s XUTgMpWHB2d6MJZpdyRrOWrL3hEJ9JaQyidCb52m5X1SbiNg8GYumjIw2 UV7UpCE5nTeStltdnWbQKmXoV7p6swUF7vI7JO38lchomwc1WJTtwNGxz sE+OszOcJcSHKEISzWysUI2mHWX+fMVpmvyPpA7xonWxIP3aoA6lSwSrI jt034HlWWOqyglG/wu8bfvDMgKn3aXOIHPEZoaGZdkX4qeUEaiT7cUUf1 nZfuFvAxbIy1UGBZ0hdOsReyCFXnPs7/2D1ykZKNHVNlx0S4apo9y1Htc w==; X-CSE-ConnectionGUID: gXSyxxIXSNycY6EgFHVi+Q== X-CSE-MsgGUID: xqeILagoQIyZtZP2buqohw== X-IronPort-AV: E=Sophos;i="6.25,198,1779170400"; d="scan'208";a="118911522" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.22.168]) by naesa03out.arrow.com with ESMTP; 01 Aug 2026 03:12:02 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 05/10] vim: Fix for CVE-2026-57454 Date: Sat, 1 Aug 2026 14:40:22 +0530 Message-ID: <20260801091145.2788751-5-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260801091145.2788751-1-bhavesh.maheshwari@einfochips.com> References: <20260801091145.2788751-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 01 Aug 2026 09:12:11 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242483 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://github.com/vim/vim/commit/b3faeecc976d3031d7c0675623516ec60c30f949 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-57454 Signed-off-by: Bhavesh R Maheshwari --- .../vim/files/CVE-2026-57454.patch | 203 ++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 204 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-57454.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-57454.patch b/meta/recipes-support/vim/files/CVE-2026-57454.patch new file mode 100644 index 0000000000..00af91067b --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-57454.patch @@ -0,0 +1,203 @@ +From a3eac666d37ccedb32ad3b0a6b86882208eb6b50 Mon Sep 17 00:00:00 2001 +From: Hirohito Higashi +Date: Sat, 20 Jun 2026 16:06:58 +0000 +Subject: [PATCH] patch 9.2.0679: [security]: Out-of-bounds read with text + property virtual text + +Problem: [security]: Out-of-bounds read with text property virtual text. + A crafted undo file can declare a virtual-text property whose + offset points outside the line's property data, so reading the + virtual text reads out of bounds. This completes the count-only + check added in 9.2.0670. +Solution: Validate the virtual-text offset and length of each property + against the available property data before turning the offset + into a pointer. + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-ww8h-47xp-hp4w + +Co-Authored-By: Claude Opus 4.8 (1M context) +Signed-off-by: Hirohito Higashi +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/b3faeecc976d3031d7c0675623516ec60c30f949] +CVE: CVE-2026-57454 + +Signed-off-by: Bhavesh R Maheshwari +--- + src/proto/textprop.pro | 1 + + src/testdir/test_textprop2.vim | 60 ++++++++++++++++++++++++++++++---- + src/textprop.c | 36 ++++++++++++++++++++ + src/version.c | 2 ++ + 4 files changed, 92 insertions(+), 7 deletions(-) + +diff --git a/src/proto/textprop.pro b/src/proto/textprop.pro +index a01c2f3b2..4e6fcc89a 100644 +--- a/src/proto/textprop.pro ++++ b/src/proto/textprop.pro +@@ -36,4 +36,5 @@ int adjust_prop_columns(linenr_T lnum, colnr_T col, int bytes_added, int flags); + void adjust_props_for_split(linenr_T lnum_props, linenr_T lnum_top, int kept, int deleted, int at_eol); + void prepend_joined_props(unpacked_memline_T *um, linenr_T lnum, int last_line, long col, int removed); + bool text_prop_count_valid(int prop_count, size_t propdata_len); ++bool text_prop_vtext_valid(char_u *props, int prop_count, size_t propdata_len); + /* vim: set ft=c : */ +diff --git a/src/testdir/test_textprop2.vim b/src/testdir/test_textprop2.vim +index 48387d1c0..5f8f87e29 100644 +--- a/src/testdir/test_textprop2.vim ++++ b/src/testdir/test_textprop2.vim +@@ -428,14 +428,12 @@ func Test_multiline_prop_delete_penultimate_line() + call s:CleanupPropTypes(['1', '2', '3']) + endfunc + +-func s:ManipulateUndoBlob(name) +- " Patch the saved old line in the undo file: +- " 00 00 00 08 'QQQQQQQQ' -> 00 00 00 27 'AAAA' NUL count=0xFFFF <32x00> +- " i.e. textlen 8 text-only -> 39-byte blob: text "AAAA", NUL, prop_count +- " 0xFFFF, one zeroed textprop_T(32). propdata_len becomes 34, count 65535. ++func s:ManipulateUndoBlob(name, repl) ++ " Replace the saved old line (00 00 00 08 'QQQQQQQQ') in the undo file with ++ " the crafted "repl" blob, then read it back in. + let blob = readfile(a:name, 'B') + let marker = 0z000000085151515151515151 +- let repl = 0z000000274141414100FFFF + repeat(0z00, 32) ++ let repl = a:repl + let mlen = len(marker) + let idx = -1 + let i = 0 +@@ -466,7 +464,10 @@ func Test_textprop_undo_bad_prop_count() + let &ul = &ul + call setline(1, 'BBBB') " undo step saves old line 1 = "QQQQQQQQ" + wundo Xtpundo +- call s:ManipulateUndoBlob('Xtpundo') ++ " 39-byte blob: "AAAA" NUL count=0xFFFF, one zeroed textprop_T(32). ++ " propdata_len becomes 34 while the count claims 65535 properties. ++ call s:ManipulateUndoBlob('Xtpundo', 0z000000274141414100FFFF ++ \ + repeat(0z00, 32)) + + undo + +@@ -487,4 +488,49 @@ func Test_textprop_undo_bad_prop_count() + call delete('Xtpundo') + endfunc + ++" A crafted undo file can restore a line whose virtual-text property declares an ++" out-of-range tp_text_offset. Turning that offset into a pointer and reading ++" the virtual text would read past the line buffer. Restore such a line and ++" force a consumer; reaching the asserts (no ASan abort / crash) means the ++" offset is bounded. ++func Test_textprop_undo_bad_vtext_offset() ++ CheckFeature persistent_undo ++ ++ new ++ call setline(1, ['QQQQQQQQ', 'DECOYLINE']) ++ let &ul = &ul ++ call setline(1, 'BBBB') " undo step saves old line 1 = "QQQQQQQQ" ++ wundo Xtpundo ++ ++ " One textprop_T for a virtual text prop (tp_id < 0) whose tp_text_offset ++ " (0x00100000) points far past the 34-byte property data. The count (1) is ++ " valid, so only the offset/length check can reject this. ++ let prop = 0z01000000 " tp_col = 1 ++ let prop += 0z04000000 " tp_len = 4 ++ let prop += 0zFFFFFFFF " tp_id = -1 (virtual text) ++ let prop += 0z00000000 " tp_type = 0 ++ let prop += 0z00000000 " tp_flags = 0 ++ let prop += 0z00000000 " tp_padleft = 0 ++ let prop += 0z00001000 " u.tp_text_offset = 0x00100000 ++ let prop += 0z00000000 " union upper bytes ++ call s:ManipulateUndoBlob('Xtpundo', 0z000000274141414100 + 0z0100 + prop) ++ ++ undo ++ ++ " Safety: prove the malicious line was actually restored before the consumer ++ " runs, so the test can't pass vacuously if the patch missed. ++ call assert_equal('AAAA', getline(1)) ++ ++ call prop_type_add('Xtp', {}) ++ call prop_add(2, 1, {'type': 'Xtp', 'length': 1}) ++ ++ " this caused OOB read, now it is rejected as a corrupted (untrusted) undo ++ " file with a catchable error ++ call assert_fails('call prop_list(1)', 'E967:') ++ ++ call prop_type_delete('Xtp') ++ bwipe! ++ call delete('Xtpundo') ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab +diff --git a/src/textprop.c b/src/textprop.c +index 6b0ce45f2..5959ecc45 100644 +--- a/src/textprop.c ++++ b/src/textprop.c +@@ -118,6 +118,13 @@ um_goto_line(unpacked_memline_T *um, linenr_T lnum, int extra_props) + proplen = (int)prop_count; + props_start = count_ptr + PROP_COUNT_SIZE; + ++ if (!text_prop_vtext_valid(props_start, proplen, propdata_len)) ++ { ++ emsg(e_text_property_info_corrupted); ++ um->buf = NULL; ++ return false; ++ } ++ + um->props = ALLOC_MULT(textprop_T, proplen + extra_props); + if (um->props == NULL) + { +@@ -1246,6 +1253,12 @@ get_text_props(buf_T *buf, linenr_T lnum, char_u **props, int will_change) + iemsg(e_text_property_info_corrupted); + return 0; + } ++ if (!text_prop_vtext_valid(text + textlen + PROP_COUNT_SIZE, ++ (int)prop_count, propdata_len)) ++ { ++ emsg(e_text_property_info_corrupted); ++ return 0; ++ } + *props = text + textlen + PROP_COUNT_SIZE; + return (int)prop_count; + } +@@ -3239,4 +3252,27 @@ text_prop_count_valid(int prop_count, size_t propdata_len) + <= propdata_len - PROP_COUNT_SIZE; + } + ++/* ++ * Return true when every virtual text property's offset and length stay within ++ * "propdata_len", so tp_text_offset can be safely turned into a pointer. ++ * "props" may be unaligned. ++ */ ++ bool ++text_prop_vtext_valid(char_u *props, int prop_count, size_t propdata_len) ++{ ++ for (int i = 0; i < prop_count; ++i) ++ { ++ textprop_T prop; ++ ++ mch_memmove(&prop, props + (size_t)i * sizeof(textprop_T), ++ sizeof(textprop_T)); ++ if (prop.tp_id >= 0 || prop.u.tp_text_offset <= 0) ++ continue; ++ if (prop.tp_len < 0 || (size_t)prop.u.tp_text_offset ++ + (size_t)prop.tp_len + 1 > propdata_len) ++ return false; ++ } ++ return true; ++} ++ + #endif // FEAT_PROP_POPUP +diff --git a/src/version.c b/src/version.c +index 4d6908426..80d3cc7f5 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -734,6 +734,8 @@ static char *(features[]) = + + static int included_patches[] = + { /* Add new patch number below this line */ ++/**/ ++ 679, + /**/ + 678, + /**/ +-- +2.53.0 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 56a2004899..93b8ba3970 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -33,6 +33,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV} file://CVE-2026-55895.patch \ file://CVE-2026-57451.patch \ file://CVE-2026-57453.patch \ + file://CVE-2026-57454.patch \ " PV .= ".0340" From patchwork Sat Aug 1 09:10:23 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh R Maheshwari X-Patchwork-Id: 94101 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 18340C55178 for ; Sat, 1 Aug 2026 09:12:12 +0000 (UTC) Received: from naesa03.arrow.com (naesa03.arrow.com [216.150.161.23]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.2447.1785575515784141923 for ; Sat, 01 Aug 2026 02:12:05 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=im9//+Br; spf=pass (domain: einfochips.com, ip: 216.150.161.23, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=4125; q=dns/txt; s=NAESA-Selector1; t=1785575525; x=1817111525; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=6LdUiqI5gVA+r6+4hbaAMkdyXLs+jqLKf1QJzcX1Lt8=; b=im9//+Brzoa12Xbkb0F0KduLDQlvMzyf1agJpW86eA9A/xtztL9mXcVr VrFrm0GQKkKipWwNxQkeS20eaRYZ8UcqLGHixs2wqmnAYbsDcwe+6WCZe REXJdfXBszdN74VDUOzuMJiVi/tBVFyXjR2SsIQUD6YzDe92X6sujmonr kqQof6AP+BYzH8cf9G/fIBoVXCawFJMqDCN2O/lzav6zxPrSW5itX/z5x /fZ5+oEwpSXdHTUKo19ORo93OV7dMuxs5yf8sNOa3CDtjtS5yCcvkidTb yonIkxfezrmmelDLceodHfWzmVmiqdGJ1aZC3RCCfxHoFGbpouHZomQXE w==; X-CSE-ConnectionGUID: O3Y94HLgQpuHOKojegB70Q== X-CSE-MsgGUID: bdnc4AlFS2COubWdSiAgcw== X-IronPort-AV: E=Sophos;i="6.25,198,1779170400"; d="scan'208";a="118911524" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.22.168]) by naesa03out.arrow.com with ESMTP; 01 Aug 2026 03:12:04 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 06/10] vim: Fix for CVE-2026-57455 Date: Sat, 1 Aug 2026 14:40:23 +0530 Message-ID: <20260801091145.2788751-6-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260801091145.2788751-1-bhavesh.maheshwari@einfochips.com> References: <20260801091145.2788751-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 01 Aug 2026 09:12:12 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242484 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b [2] https://nvd.nist.gov/vuln/detail/CVE-2026-57455 Signed-off-by: Bhavesh R Maheshwari --- .../vim/files/CVE-2026-57455.patch | 87 +++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 88 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-57455.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-57455.patch b/meta/recipes-support/vim/files/CVE-2026-57455.patch new file mode 100644 index 0000000000..8b5bd0e0e8 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-57455.patch @@ -0,0 +1,87 @@ +From f2744f3810cee1c63850e58f85cda299a2c20ce3 Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Sun, 21 Jun 2026 19:20:03 +0000 +Subject: [PATCH] patch 9.2.0698: [security]: Out-of-bounds write with + soundfold() + +Problem: [security]: Out-of-bounds write with soundfold() + (cipher-creator) +Solution: Add an abort condition to the for loop to validate the buffer + size. + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4 + +Supported by AI + +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b] +CVE: CVE-2026-57455 + +Signed-off-by: Bhavesh R Maheshwari +--- + src/spell.c | 2 +- + src/testdir/test_spellfile.vim | 21 +++++++++++++++++++++ + src/version.c | 2 ++ + 3 files changed, 24 insertions(+), 1 deletion(-) + +diff --git a/src/spell.c b/src/spell.c +index 72d1f0b52..e0fc17bfb 100644 +--- a/src/spell.c ++++ b/src/spell.c +@@ -3270,7 +3270,7 @@ spell_soundfold_sofo(slang_T *slang, char_u *inword, char_u *res) + else + { + // The sl_sal_first[] table contains the translation. +- for (s = inword; (c = *s) != NUL; ++s) ++ for (s = inword; (c = *s) != NUL && ri < MAXWLEN - 1; ++s) + { + if (VIM_ISWHITE(c)) + c = ' '; +diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim +index 5b2ed4efd..50afe3dfa 100644 +--- a/src/testdir/test_spellfile.vim ++++ b/src/testdir/test_spellfile.vim +@@ -1224,4 +1224,25 @@ func Test_spell_sug_tree_count_words_overflow() + bwipe! + endfunc + ++" A word longer than MAXWLEN must not overflow the soundfold result buffer in ++" the single-byte SOFO branch of spell_soundfold_sofo(). ++func Test_soundfold_overflow() ++ let _enc=&enc ++ set enc=latin1 ++ call writefile(['SOFOFROM ab', 'SOFOTO xy'], 'Xtest.aff', 'D') ++ call writefile(['1', 'foo'], 'Xtest.dic', 'D') ++ mkspell! Xtest Xtest ++ defer delete('Xtest.latin1.spl') ++ defer delete('Xtest.latin1.sug') ++ setl spelllang=Xtest.latin1.spl spell ++ ++ " Before the fix the copy loop wrote one byte per input byte into a ++ " MAXWLEN (254) stack buffer with no upper bound, smashing the stack. ++ let sound = soundfold(repeat('ab', 300)) ++ call assert_true(strlen(sound) < 254, 'soundfold result exceeds MAXWLEN') ++ ++ set spell& spelllang& ++ let &enc = _enc ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab +diff --git a/src/version.c b/src/version.c +index 80d3cc7f5..d3b72595f 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -734,6 +734,8 @@ static char *(features[]) = + + static int included_patches[] = + { /* Add new patch number below this line */ ++/**/ ++ 698, + /**/ + 679, + /**/ +-- +2.53.0 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 93b8ba3970..8c5a5e88a9 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -34,6 +34,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV} file://CVE-2026-57451.patch \ file://CVE-2026-57453.patch \ file://CVE-2026-57454.patch \ + file://CVE-2026-57455.patch \ " PV .= ".0340" From patchwork Sat Aug 1 09:10:24 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh R Maheshwari X-Patchwork-Id: 94099 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E6FCAC54FCD for ; Sat, 1 Aug 2026 09:12:11 +0000 (UTC) Received: from naesa03.arrow.com (naesa03.arrow.com [216.150.161.23]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.2447.1785575515784141923 for ; Sat, 01 Aug 2026 02:12:06 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=LjeKKlLA; spf=pass (domain: einfochips.com, ip: 216.150.161.23, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=7643; q=dns/txt; s=NAESA-Selector1; t=1785575527; x=1817111527; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=KF6ZJhdpRevOznbtXv+wKFzqgakku31vrbaB3YLerLo=; b=LjeKKlLAzh1pY9qi+RwECnebdEl5D/pl9J41io2W4+0q9J8fvDJ8BUSk QXamR6wI3GaSrpFjp/H0oCW1jw+qDb/SSRQD8gmRaRtzxD0TRCRwhqBNq Lg3By6e4lV8zDgN3+ObBU3iIN7ISpp1hM6dBW5wRr2U4TgMCx8Ec/dfxq aBR3jWo3mkMujZhkJshjAnUGLTTwtmWkpmu3ooZtVJwJacvqw0BuVBgNn BRNu3UzxUJHTrBpNiU30mZi+QRorvZNZgbXUlSpTKHHOPpNrvp18RtP1M kKuks4QZ81+cZRZTic/hU36Gpajeu/IJgyzaJz8ii/YsX66DEO29ehTmY Q==; X-CSE-ConnectionGUID: JK7pg0+lTaCnRKBAwJR97w== X-CSE-MsgGUID: 0E4JBQbPRpOqR8uDRCy84Q== X-IronPort-AV: E=Sophos;i="6.25,198,1779170400"; d="scan'208";a="118911526" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.22.168]) by naesa03out.arrow.com with ESMTP; 01 Aug 2026 03:12:06 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 07/10] vim: Fix for CVE-2026-57456 Date: Sat, 1 Aug 2026 14:40:24 +0530 Message-ID: <20260801091145.2788751-7-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260801091145.2788751-1-bhavesh.maheshwari@einfochips.com> References: <20260801091145.2788751-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 01 Aug 2026 09:12:11 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242485 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-57456 Signed-off-by: Bhavesh R Maheshwari --- .../vim/files/CVE-2026-57456.patch | 164 ++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 165 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-57456.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-57456.patch b/meta/recipes-support/vim/files/CVE-2026-57456.patch new file mode 100644 index 0000000000..253fff486d --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-57456.patch @@ -0,0 +1,164 @@ +From 88a735ff4fa7ff269ba4ca94a44e8cdaefa5df28 Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Sun, 21 Jun 2026 19:50:56 +0000 +Subject: [PATCH] patch 9.2.0699: [security]: possible code execution with + python complete + +Problem: [security]: possible code execution with python complete + (morningbread) +Solution: Use repr() to quote the doc strings correctly + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3 + +Supported by AI + +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8] +CVE: CVE-2026-57456 + +Signed-off-by: Bhavesh R Maheshwari +--- + runtime/autoload/python3complete.vim | 9 +++++---- + runtime/autoload/pythoncomplete.vim | 9 +++++---- + src/testdir/test_plugin_python3complete.vim | 15 +++++++++++++++ + src/version.c | 2 ++ + 4 files changed, 27 insertions(+), 8 deletions(-) + +diff --git a/runtime/autoload/python3complete.vim b/runtime/autoload/python3complete.vim +index c4ef19d82..f90cca74b 100644 +--- a/runtime/autoload/python3complete.vim ++++ b/runtime/autoload/python3complete.vim +@@ -2,7 +2,7 @@ + " Maintainer: + " Previous Maintainer: Aaron Griffin + " Version: 0.10 +-" Last Updated: 2026 Jun 04 ++" Last Updated: 2026 Jun 21 + " + " Roland Puntaier: this file contains adaptations for python3 and is parallel to pythoncomplete.vim + " +@@ -22,6 +22,7 @@ + " previous code passed buffer-supplied expressions to exec() which + " Python evaluates at definition time, allowing arbitrary code + " execution via crafted def/class headers ++" * use repr() on doc strings to prevent code execution + " + " v 0.9 + " * Fixed docstring parsing for classes and functions +@@ -335,7 +336,7 @@ class Scope(object): + + def get_code(self): + str = "" +- if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n' ++ if len(self.docstr) > 0: str += repr(self.docstr)+'\n' + str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n' + for sub in self.subscopes: + str += sub.get_code() +@@ -378,7 +379,7 @@ class Class(Scope): + if _DOTTED_NAME_RE.match(s.strip())] + if len(safe_supers) > 0: str += '(%s)' % ','.join(safe_supers) + str += ':\n' +- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n' ++ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n' + if len(self.subscopes) > 0: + for s in self.subscopes: str += s.get_code() + else: +@@ -401,7 +402,7 @@ class Function(Scope): + safe_params = [p for p in safe_params if p] + str = "%sdef %s(%s):\n" % \ + (self.currentindent(),self.name,','.join(safe_params)) +- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n' ++ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n' + str += "%spass\n" % self.childindent() + return str + +diff --git a/runtime/autoload/pythoncomplete.vim b/runtime/autoload/pythoncomplete.vim +index 39b1efd29..d2f5d57b0 100644 +--- a/runtime/autoload/pythoncomplete.vim ++++ b/runtime/autoload/pythoncomplete.vim +@@ -2,7 +2,7 @@ + " Maintainer: + " Previous Maintainer: Aaron Griffin + " Version: 0.10 +-" Last Updated: 2026 Jun 04 ++" Last Updated: 2026 Jun 21 + " + " Changes + " TODO: +@@ -20,6 +20,7 @@ + " previous code passed buffer-supplied expressions to exec() which + " Python evaluates at definition time, allowing arbitrary code + " execution via crafted def/class headers ++" * use repr() on doc strings to prevent code execution + " + " v 0.9 + " * Fixed docstring parsing for classes and functions +@@ -350,7 +351,7 @@ class Scope(object): + + def get_code(self): + str = "" +- if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n' ++ if len(self.docstr) > 0: str += repr(self.docstr)+'\n' + str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n' + for sub in self.subscopes: + str += sub.get_code() +@@ -393,7 +394,7 @@ class Class(Scope): + if _DOTTED_NAME_RE.match(s.strip())] + if len(safe_supers) > 0: str += '(%s)' % ','.join(safe_supers) + str += ':\n' +- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n' ++ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n' + if len(self.subscopes) > 0: + for s in self.subscopes: str += s.get_code() + else: +@@ -416,7 +417,7 @@ class Function(Scope): + safe_params = [p for p in safe_params if p] + str = "%sdef %s(%s):\n" % \ + (self.currentindent(),self.name,','.join(safe_params)) +- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n' ++ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n' + str += "%spass\n" % self.childindent() + return str + +diff --git a/src/testdir/test_plugin_python3complete.vim b/src/testdir/test_plugin_python3complete.vim +index e2b0c6616..590348ee4 100644 +--- a/src/testdir/test_plugin_python3complete.vim ++++ b/src/testdir/test_plugin_python3complete.vim +@@ -221,4 +221,19 @@ func Test_python3complete_allow_import_on_runs_imports() + \ 'g:pythoncomplete_allow_import=1 did not run the buffer import') + endfunc + ++func Test_python3complete_no_exec_via_class_docstring() ++ " A class-body docstring is emitted verbatim between triple quotes by ++ " get_code() and runs at class-definition time during exec(). A single- ++ " quoted source docstring lets an embedded """ survive doc()'s leading/ ++ " trailing quote strip and break out of the generated literal. ++ let marker = tempname() ++ call s:CompleteAndExpectNoMarker([ ++ \ 'class Foo:', ++ \ ' ''x"""+open("' . marker . '", "w").close()+"""y''', ++ \ ' pass', ++ \ 'Foo.', ++ \ ], marker, ++ \ 'class docstring expression was evaluated during omni-completion') ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab +diff --git a/src/version.c b/src/version.c +index d3b72595f..bf680c656 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -734,6 +734,8 @@ static char *(features[]) = + + static int included_patches[] = + { /* Add new patch number below this line */ ++/**/ ++ 699, + /**/ + 698, + /**/ +-- +2.53.0 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 8c5a5e88a9..0f1355f0fc 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -35,6 +35,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV} file://CVE-2026-57453.patch \ file://CVE-2026-57454.patch \ file://CVE-2026-57455.patch \ + file://CVE-2026-57456.patch \ " PV .= ".0340" From patchwork Sat Aug 1 09:10:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh R Maheshwari X-Patchwork-Id: 94103 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0E3BC55175 for ; Sat, 1 Aug 2026 09:12:11 +0000 (UTC) Received: from naesa03.arrow.com (naesa03.arrow.com [216.150.161.23]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.2447.1785575515784141923 for ; Sat, 01 Aug 2026 02:12:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=BwfsGP94; spf=pass (domain: einfochips.com, ip: 216.150.161.23, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=5875; q=dns/txt; s=NAESA-Selector1; t=1785575529; x=1817111529; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=ZDf+nBW5H8iafKoE02iD2AyPCMhevJVzRvIKWSFaMVs=; b=BwfsGP94KNx1F+TH7MFxKv9ZREx7SOJZZiik4+bYBJPhqLHLbC6la5d2 hWyALbe3TqiiDnk4iucIrA9ts0IMO616Asb5bbF11GozexLwHHyKw/9Ai O3v/5sUWkTyDni0E5Nym9dltddB3OKdGp3N2eCQ6CvXNi91xQymTuJp/S HfozxjnZTwvCYcLivCyVPS7dR+7NwdM+K2tNFjWZ/aFtJ6k4qviPoZf4J +40zPBhxiAAp/+oVRS38MLvfwRoftEIoe7atfkJHhgN7+WhrSi8Zg3Qtd U4Twvn1MLyyRFqytU9h57yVnoaY9awJ9/KTkoHBOzxtWi0a17zWU3zUX2 g==; X-CSE-ConnectionGUID: LGGZGycRQ+G6pq6z3PCq0g== X-CSE-MsgGUID: Q2jtvQH0QiekmjGAfUXg6Q== X-IronPort-AV: E=Sophos;i="6.25,198,1779170400"; d="scan'208";a="118911527" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.22.168]) by naesa03out.arrow.com with ESMTP; 01 Aug 2026 03:12:07 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 08/10] vim: Fix for CVE-2026-59856 Date: Sat, 1 Aug 2026 14:40:25 +0530 Message-ID: <20260801091145.2788751-8-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260801091145.2788751-1-bhavesh.maheshwari@einfochips.com> References: <20260801091145.2788751-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 01 Aug 2026 09:12:11 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242486 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-59856 Signed-off-by: Bhavesh R Maheshwari --- .../vim/files/CVE-2026-59856.patch | 118 ++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 119 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-59856.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-59856.patch b/meta/recipes-support/vim/files/CVE-2026-59856.patch new file mode 100644 index 0000000000..9e9bdf03c5 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-59856.patch @@ -0,0 +1,118 @@ +From c532c40015db331fbcfdf4ef9dd717b13fc54d2e Mon Sep 17 00:00:00 2001 +From: Hirohito Higashi +Date: Fri, 26 Jun 2026 20:07:01 +0900 +Subject: [PATCH] patch 9.2.0736: potential command execution in PHP + omni-completion + +Problem: With PHP omni-completion, a crafted file can potentially + execute arbitrary commands when completing a class member. +Solution: Quote the class name before inserting it into the search() + pattern run via win_execute(). + +Co-Authored-By: Claude Opus 4.8 (1M context) +Signed-off-by: Hirohito Higashi +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24] +CVE: CVE-2026-59856 + +Signed-off-by: Bhavesh R Maheshwari +--- + runtime/autoload/phpcomplete.vim | 3 ++- + src/testdir/Make_all.mak | 2 ++ + src/testdir/test_plugin_phpcomplete.vim | 35 +++++++++++++++++++++++++ + src/version.c | 2 ++ + 4 files changed, 41 insertions(+), 1 deletion(-) + create mode 100644 src/testdir/test_plugin_phpcomplete.vim + +diff --git a/runtime/autoload/phpcomplete.vim b/runtime/autoload/phpcomplete.vim +index 5b4263ae4..93f7d8b45 100644 +--- a/runtime/autoload/phpcomplete.vim ++++ b/runtime/autoload/phpcomplete.vim +@@ -2082,7 +2082,8 @@ function! phpcomplete#GetClassContentsStructure(file_path, file_lines, class_nam + let result = [] + let popup_id = popup_create(a:file_lines, {'hidden': v:true}) + +- call win_execute(popup_id, 'call search(''\c\(class\|interface\|trait\)\_s\+'.a:class_name.'\(\>\|$\)'')') ++ call win_execute(popup_id, 'call search(' ++ \ . string('\c\(class\|interface\|trait\)\_s\+' . a:class_name . '\(\>\|$\)') . ')') + call win_execute(popup_id, "let cfline = line('.')") + call win_execute(popup_id, "call search('{')") + call win_execute(popup_id, "let endline = line('.')") +diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak +index b06d1af43..b5735b6c3 100644 +--- a/src/testdir/Make_all.mak ++++ b/src/testdir/Make_all.mak +@@ -250,6 +250,7 @@ NEW_TESTS = \ + test_plugin_man \ + test_plugin_matchparen \ + test_plugin_netrw \ ++ test_plugin_phpcomplete \ + test_plugin_python3complete \ + test_plugin_osc52 \ + test_plugin_tar \ +@@ -529,6 +530,7 @@ NEW_TESTS_RES = \ + test_plugin_man.res \ + test_plugin_matchparen.res \ + test_plugin_netrw.res \ ++ test_plugin_phpcomplete.res \ + test_plugin_python3complete.res \ + test_plugin_osc52.res \ + test_plugin_tar.res \ +diff --git a/src/testdir/test_plugin_phpcomplete.vim b/src/testdir/test_plugin_phpcomplete.vim +new file mode 100644 +index 000000000..7f66be47b +--- /dev/null ++++ b/src/testdir/test_plugin_phpcomplete.vim +@@ -0,0 +1,35 @@ ++" Tests for the PHP omni-completion plugin (runtime/autoload/phpcomplete.vim). ++ ++" A buffer class name is interpolated into a search() pattern run via ++" win_execute(). Without escaping, "'" closes the string and "|" starts a new ++" Ex command, so the name runs as an Ex command during completion. ++func Test_phpcomplete_no_exec_via_class_name() ++ unlet! g:phpcomplete_injected ++ let lines = [' 0, 'no class structure returned') ++ call assert_match('class Foo', result[0].content, ++ \ 'class body missing from returned content') ++ call assert_match('bar', result[0].content, ++ \ 'class member missing from returned content') ++endfunc ++ ++" vim: shiftwidth=2 sts=2 expandtab +diff --git a/src/version.c b/src/version.c +index bf680c656..fbc2c8b15 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -734,6 +734,8 @@ static char *(features[]) = + + static int included_patches[] = + { /* Add new patch number below this line */ ++/**/ ++ 736, + /**/ + 699, + /**/ +-- +2.53.0 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 0f1355f0fc..f0e54d71e0 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -36,6 +36,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV} file://CVE-2026-57454.patch \ file://CVE-2026-57455.patch \ file://CVE-2026-57456.patch \ + file://CVE-2026-59856.patch \ " PV .= ".0340" From patchwork Sat Aug 1 09:10:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh R Maheshwari X-Patchwork-Id: 94102 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0A102C55174 for ; Sat, 1 Aug 2026 09:12:12 +0000 (UTC) Received: from naesa03.arrow.com (naesa03.arrow.com [216.150.161.23]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.2447.1785575515784141923 for ; Sat, 01 Aug 2026 02:12:10 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=UpPXQw01; spf=pass (domain: einfochips.com, ip: 216.150.161.23, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=5880; q=dns/txt; s=NAESA-Selector1; t=1785575530; x=1817111530; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=e+FXMB7LZiC5Sy+yfgEhm+N8ahgiw4icNNZwaUP0VDk=; b=UpPXQw01GcFtPPPcyzYpbNzbkWI/M34SoqV5JzjbW991r/8I2Bf0jMgq xbIcXPiY9+IxYQ02/iB2neTgxNr0810ghe6tT+AsTwxwzBFDUGwh5j/Qv 8bHjJBVzSRyXOrMoPgTcqRg0Sk5BktQWyrnZXma/60O+hTmRdFwtytt3p 5YnqX7ydvXAYPN930p5h1FKe5A5/0FYRJ38WrKaqWMRNVOjZehsGSGzze G2hNv+fgrkgIyoXQuOdAeFDQA8iwmPcoHDhqu2kxKsnwxmPKskrwa81Nq H4OHGHynvT2Cs1xFbLzFNElrFqTlIdWaZa/crE20vY/Qoh+UOHlHr+YUd A==; X-CSE-ConnectionGUID: mcwflKMMSsCSC0CFJ0U2Hg== X-CSE-MsgGUID: Bx4lo9qSSne2Jl8YIU4Ufw== X-IronPort-AV: E=Sophos;i="6.25,198,1779170400"; d="scan'208";a="118911528" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.22.168]) by naesa03out.arrow.com with ESMTP; 01 Aug 2026 03:12:09 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 09/10] vim: Fix for CVE-2026-59857 Date: Sat, 1 Aug 2026 14:40:26 +0530 Message-ID: <20260801091145.2788751-9-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260801091145.2788751-1-bhavesh.maheshwari@einfochips.com> References: <20260801091145.2788751-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 01 Aug 2026 09:12:12 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242487 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://github.com/vim/vim/commit/d22ff1c955ff87e8273210eae125aab0e85b6c30 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-59857 Signed-off-by: Bhavesh R Maheshwari --- .../vim/files/CVE-2026-59857.patch | 125 ++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 126 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-59857.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-59857.patch b/meta/recipes-support/vim/files/CVE-2026-59857.patch new file mode 100644 index 0000000000..656a5be888 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-59857.patch @@ -0,0 +1,125 @@ +From 0665e4c6f2723757814da2114a3bc7c85c6e1271 Mon Sep 17 00:00:00 2001 +From: Hirohito Higashi +Date: Mon, 22 Jun 2026 13:00:36 +0900 +Subject: [PATCH] patch 9.2.0725: [security]: Stack out-of-bounds write in + spell_soundfold_sal() + +Problem: [security]: A crafted spell file with non-collapsing SAL rules + can make soundfold() write one byte past the end of the + MAXWLEN result buffer. This is the same class of + out-of-bounds write as GHSA-q8mh-6qm3-25g4 (fixed in 9.2.0698 + for the SOFO branch), found while auditing the surrounding + code. +Solution: Bound the single-byte SAL result writes and the terminating + NUL to MAXWLEN - 1, matching the SOFO branch. + +The single-byte branch of spell_soundfold_sal() guarded its writes with +"reslen < MAXWLEN", allowing reslen to reach MAXWLEN (254). The trailing +"res[reslen] = NUL" then wrote at index 254 of the 254-byte stack buffer +res[MAXWLEN], an off-by-one out-of-bounds write. Input is case-folded to +about 253 characters, so a 253-character argument together with a SAL map +that does not collapse (collapse_result false) reaches the boundary. + +Related to previous issue +[GHSA-q8mh-6qm3-25g4](https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4) +(9.2.0698) + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-m3hf-xcm3-xhm2 + +Co-Authored-By: Claude Opus 4.8 (1M context) +Signed-off-by: Hirohito Higashi +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/d22ff1c955ff87e8273210eae125aab0e85b6c30] +CVE: CVE-2026-59857 + +Signed-off-by: Bhavesh R Maheshwari +--- + src/spell.c | 6 +++--- + src/testdir/test_spellfile.vim | 24 ++++++++++++++++++++++++ + src/version.c | 2 ++ + 3 files changed, 29 insertions(+), 3 deletions(-) + +diff --git a/src/spell.c b/src/spell.c +index e0fc17bfb..34f5edb55 100644 +--- a/src/spell.c ++++ b/src/spell.c +@@ -3513,7 +3513,7 @@ spell_soundfold_sal(slang_T *slang, char_u *inword, char_u *res) + // no '<' rule used + i += k - 1; + z = 0; +- while (*s != NUL && s[1] != NUL && reslen < MAXWLEN) ++ while (*s != NUL && s[1] != NUL && reslen < MAXWLEN - 1) + { + if (reslen == 0 || res[reslen - 1] != *s) + res[reslen++] = *s; +@@ -3523,7 +3523,7 @@ spell_soundfold_sal(slang_T *slang, char_u *inword, char_u *res) + c = *s; + if (strstr((char *)pf, "^^") != NULL) + { +- if (c != NUL) ++ if (c != NUL && reslen < MAXWLEN - 1) + res[reslen++] = c; + STRMOVE(word, word + i + 1); + i = 0; +@@ -3542,7 +3542,7 @@ spell_soundfold_sal(slang_T *slang, char_u *inword, char_u *res) + + if (z0 == 0) + { +- if (k && !p0 && reslen < MAXWLEN && c != NUL ++ if (k && !p0 && reslen < MAXWLEN - 1 && c != NUL + && (!slang->sl_collapse || reslen == 0 + || res[reslen - 1] != c)) + // condense only double letters +diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim +index 50afe3dfa..3a93883b4 100644 +--- a/src/testdir/test_spellfile.vim ++++ b/src/testdir/test_spellfile.vim +@@ -387,6 +387,30 @@ func Test_spellfile_format_error() + let &rtp = save_rtp + endfunc + ++" An over-length soundfold() argument must not overflow the MAXWLEN result ++" buffer in the single-byte branch of spell_soundfold_sal(). ++func Test_spellfile_soundfold_sal_overflow() ++ let save_enc = &encoding ++ set encoding=latin1 ++ " A SAL map that appends without collapsing, so the result is not shorter ++ " than the input. ++ call writefile(['SET ISO8859-1', 'SAL collapse_result false', ++ \ 'SAL a aaaa', 'SAL b bbbb'], 'Xsal.aff') ++ call writefile(['2', 'hello', 'world'], 'Xsal.dic') ++ mkspell! Xsal Xsal ++ set spl=Xsal.latin1.spl spell ++ ++ " 253 input characters hit the buffer boundary; the result must not exceed ++ " MAXWLEN - 1. ++ call assert_true(strlen(soundfold(repeat('a', 253))) <= 253) ++ ++ set nospell spl& spelllang& ++ call delete('Xsal.aff') ++ call delete('Xsal.dic') ++ call delete('Xsal.latin1.spl') ++ let &encoding = save_enc ++endfunc ++ + " Test for format errors in suggest file + func Test_sugfile_format_error() + let save_rtp = &rtp +diff --git a/src/version.c b/src/version.c +index fbc2c8b15..ceea0d5e7 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -736,6 +736,8 @@ static int included_patches[] = + { /* Add new patch number below this line */ + /**/ + 736, ++/**/ ++ 725, + /**/ + 699, + /**/ +-- +2.53.0 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index f0e54d71e0..9e2338fcb0 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -37,6 +37,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV} file://CVE-2026-57455.patch \ file://CVE-2026-57456.patch \ file://CVE-2026-59856.patch \ + file://CVE-2026-59857.patch \ " PV .= ".0340" From patchwork Sat Aug 1 09:10:27 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh R Maheshwari X-Patchwork-Id: 94104 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0FCADC54FCD for ; Sat, 1 Aug 2026 09:12:22 +0000 (UTC) Received: from naesa03.arrow.com (naesa03.arrow.com [216.150.161.23]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.2447.1785575515784141923 for ; Sat, 01 Aug 2026 02:12:12 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=JKSC7UqN; spf=pass (domain: einfochips.com, ip: 216.150.161.23, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=6391; q=dns/txt; s=NAESA-Selector1; t=1785575532; x=1817111532; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=odcXevo3f6NzI6ESJFDj4CFfC+XGvXFBtMIn1RVWmKs=; b=JKSC7UqNya6YxeuaY+IwRx8hedHjBWakMte9yEw1k0h3g/iXYPnog5lU 4CC7sBn+OLhgWbUbV2ZdnI7foAeBjIas/UxPW+F9/BH0LMdLTZqd1KcrX FFhNKayvRn+TG/rkYy8vXWeCKpw5fUhh9tPr9dXH/jiQZZX94xvB5Rx7U 2V03pu4qS2qLXRq69M3TKC7al3h8RsXfLbAFtPSNYXZfFCXiKsdNPl/z2 KwNz/IjbsOqkI/EmOBiCTbcO37Hpdvl1gorutMoPPIsYvjXNJImLDyTyt eYBz+9DNI1ghZGz0k6auGG0yHCtUKfF6SNEem7lUUVrGtKtpI6e8FEEas g==; X-CSE-ConnectionGUID: cu/G8/PiSDGHBKsz1K06fg== X-CSE-MsgGUID: lvBPr9xLRb694cLhS4v50g== X-IronPort-AV: E=Sophos;i="6.25,198,1779170400"; d="scan'208";a="118911530" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.22.168]) by naesa03out.arrow.com with ESMTP; 01 Aug 2026 03:12:11 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 10/10] vim: Fix for CVE-2026-59858 Date: Sat, 1 Aug 2026 14:40:27 +0530 Message-ID: <20260801091145.2788751-10-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260801091145.2788751-1-bhavesh.maheshwari@einfochips.com> References: <20260801091145.2788751-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 01 Aug 2026 09:12:22 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242488 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e [2] https://nvd.nist.gov/vuln/detail/CVE-2026-59858 Signed-off-by: Bhavesh R Maheshwari --- .../vim/files/CVE-2026-59858.patch | 149 ++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 150 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-59858.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-59858.patch b/meta/recipes-support/vim/files/CVE-2026-59858.patch new file mode 100644 index 0000000000..f18637bd93 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-59858.patch @@ -0,0 +1,149 @@ +From 09554668bd5ab31261a5c5585a0f58baa1080105 Mon Sep 17 00:00:00 2001 +From: Hirohito Higashi +Date: Fri, 26 Jun 2026 15:41:24 +0900 +Subject: [PATCH] patch 9.2.0735: [security]: arbitrary Ex command execution + during C omni-completion + +Problem: [security]: With C omni-completion, a crafted tags file can execute + arbitrary Ex commands when completing a struct/union member + (cipher-creator) +Solution: Escape the type field before inserting it into the :vimgrep + pattern so it cannot close the pattern and start a new command + (Hirohito Higashi). + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x + +Co-Authored-By: Claude Opus 4.8 (1M context) " +Signed-off-by: Hirohito Higashi +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e] +CVE: CVE-2026-59858 + +Signed-off-by: Bhavesh R Maheshwari +--- + runtime/autoload/ccomplete.vim | 2 +- + src/testdir/Make_all.mak | 2 + + src/testdir/test_plugin_ccomplete.vim | 62 +++++++++++++++++++++++++++ + src/version.c | 2 + + 4 files changed, 67 insertions(+), 1 deletion(-) + create mode 100644 src/testdir/test_plugin_ccomplete.vim + +diff --git a/runtime/autoload/ccomplete.vim b/runtime/autoload/ccomplete.vim +index 51237be98..dc3388b52 100644 +--- a/runtime/autoload/ccomplete.vim ++++ b/runtime/autoload/ccomplete.vim +@@ -600,7 +600,7 @@ def StructMembers( # {{{1 + return [] + endif + execute 'silent! keepjumps noautocmd ' +- .. n .. 'vimgrep ' .. '/\t' .. typename .. '\(\t\|$\)/j ' ++ .. n .. 'vimgrep ' .. '/\t' .. escape(typename, '/\') .. '\(\t\|$\)/j ' + .. fnames + + qflist = getqflist() +diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak +index b5735b6c3..0cf2c4110 100644 +--- a/src/testdir/Make_all.mak ++++ b/src/testdir/Make_all.mak +@@ -243,6 +243,7 @@ NEW_TESTS = \ + test_partial \ + test_paste \ + test_perl \ ++ test_plugin_ccomplete \ + test_plugin_comment \ + test_plugin_glvs \ + test_plugin_helpcurwin \ +@@ -523,6 +524,7 @@ NEW_TESTS_RES = \ + test_partial.res \ + test_paste.res \ + test_perl.res \ ++ test_plugin_ccomplete.res \ + test_plugin_comment.res \ + test_plugin_glvs.res \ + test_plugin_helpcurwin.res \ +diff --git a/src/testdir/test_plugin_ccomplete.vim b/src/testdir/test_plugin_ccomplete.vim +new file mode 100644 +index 000000000..a635bd50b +--- /dev/null ++++ b/src/testdir/test_plugin_ccomplete.vim +@@ -0,0 +1,62 @@ ++" Tests for the C omni-completion plugin (runtime/autoload/ccomplete.vim). ++ ++func s:WriteTags(lines) ++ " Mark unsorted so lookup is a linear scan regardless of entry order. ++ let tagsfile = tempname() ++ call writefile(["!_TAG_FILE_SORTED\t0\t/0/"] + a:lines, tagsfile) ++ return tagsfile ++endfunc ++ ++" A crafted typeref field is interpolated into the :vimgrep pattern in ++" StructMembers(). Without escaping, "/" closes the pattern and "|" starts a ++" new Ex command, so the field runs as an Ex command during completion. ++func Test_ccomplete_no_exec_via_typeref() ++ unlet! g:ccomplete_injected ++ let tagsfile = s:WriteTags([ ++ \ "myvar\tmain.c\t/^x$/;\"\tv\ttyperef:x/|let g:ccomplete_injected = 1|\"", ++ \ ]) ++ ++ let save_tags = &tags ++ let &tags = tagsfile ++ ++ new ++ call ccomplete#Complete(1, '') ++ call ccomplete#Complete(0, 'myvar.x') ++ ++ call assert_false(exists('g:ccomplete_injected'), ++ \ 'typeref field was executed as an Ex command during omni-completion') ++ ++ bwipe! ++ let &tags = save_tags ++ unlet! g:ccomplete_injected ++endfunc ++ ++" A legitimate typeref must still drive struct-member completion: escaping the ++" field value must not break the normal path. ++func Test_ccomplete_typeref_completion_still_works() ++ let tagsfile = s:WriteTags([ ++ \ "myvar\tmain.c\t/^x$/;\"\tv\ttyperef:struct:mystruct", ++ \ "alpha\tmain.c\t/^x$/;\"\tm\tstruct:mystruct", ++ \ "beta\tmain.c\t/^x$/;\"\tm\tstruct:mystruct", ++ \ ]) ++ ++ let save_tags = &tags ++ let &tags = tagsfile ++ ++ new ++ call ccomplete#Complete(1, '') ++ let items = ccomplete#Complete(0, 'myvar.') ++ ++ call assert_equal(type([]), type(items), ++ \ 'ccomplete#Complete did not return a list') ++ let names = map(copy(items), 'v:val.word') ++ call assert_true(index(names, 'alpha') >= 0, ++ \ 'struct member "alpha" missing from completion: ' . string(names)) ++ call assert_true(index(names, 'beta') >= 0, ++ \ 'struct member "beta" missing from completion: ' . string(names)) ++ ++ bwipe! ++ let &tags = save_tags ++endfunc ++ ++" vim: shiftwidth=2 sts=2 expandtab +diff --git a/src/version.c b/src/version.c +index ceea0d5e7..92cd53129 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -736,6 +736,8 @@ static int included_patches[] = + { /* Add new patch number below this line */ + /**/ + 736, ++/**/ ++ 735, + /**/ + 725, + /**/ +-- +2.53.0 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 9e2338fcb0..1da47d9243 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -38,6 +38,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV} file://CVE-2026-57456.patch \ file://CVE-2026-59856.patch \ file://CVE-2026-59857.patch \ + file://CVE-2026-59858.patch \ " PV .= ".0340"