vim: fix CVE-2021-3872 and CVE-2021-3903

Backport 2 patches to fix below CVEs:
 - CVE-2021-3872
 - CVE-2021-3903

(From OE-Core rev: baa351293ed036e63d0e3253f58ad4f2e448852c)

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

1 files changed, 57 insertions, 0 deletions

diff --git a/meta/recipes-support/vim/files/CVE-2021-3872.patch b/meta/recipes-support/vim/files/CVE-2021-3872.patch
new file mode 100644
index 0000000000..f0f30933fa
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2021-3872.patch
@@ -0,0 +1,57 @@
+From 132d060ffbb9651f0d79bd0b6d80cab460235a99 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Fri, 12 Nov 2021 02:56:51 +0000
+Subject: [PATCH] patch 8.2.3487: illegal memory access if buffer name is very
+ long
+
+Problem:    Illegal memory access if buffer name is very long.
+Solution:   Make sure not to go over the end of the buffer.
+
+CVE: CVE-2021-3872
+
+Upstream-Status: Backport [https://github.com/vim/vim/commit/826bfe4bbd7594188e3d74d2539d9707b1c6a14b]
+
+Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
+---
+ src/drawscreen.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/src/drawscreen.c b/src/drawscreen.c
+index 3a88ee979..9acb70552 100644
+--- a/src/drawscreen.c
++++ b/src/drawscreen.c
+@@ -446,13 +446,13 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED)
+            *(p + len++) = ' ';
+        if (bt_help(wp->w_buffer))
+        {
+-           STRCPY(p + len, _("[Help]"));
++           vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[Help]"));
+            len += (int)STRLEN(p + len);
+        }
+ #ifdef FEAT_QUICKFIX
+        if (wp->w_p_pvw)
+        {
+-           STRCPY(p + len, _("[Preview]"));
++           vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[Preview]"));
+            len += (int)STRLEN(p + len);
+        }
+ #endif
+@@ -462,12 +462,12 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED)
+ #endif
+                )
+        {
+-           STRCPY(p + len, "[+]");
+-           len += 3;
++           vim_snprintf((char *)p + len, MAXPATHL - len, "%s", "[+]");
++           len += (int)STRLEN(p + len);
+        }
+        if (wp->w_buffer->b_p_ro)
+        {
+-           STRCPY(p + len, _("[RO]"));
++           vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[RO]"));
+            len += (int)STRLEN(p + len);
+        }
+ 
+-- 
+2.31.1
+