diff options
author | Minjae Kim <flowergom@gmail.com> | 2021-09-04 13:08:21 +0900 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2021-10-07 15:10:33 +0100 |
commit | 32308c930f4e5d620a16fbace3be962b3030e7c8 (patch) | |
tree | 23168eba8e58798559a5ecdf48659487bd758429 /meta/recipes-support/vim/files | |
parent | 28f080629b5151ffaedc6ea493063eb8480c3664 (diff) | |
download | poky-32308c930f4e5d620a16fbace3be962b3030e7c8.tar.gz |
vim: fix CVE-2021-3778
vim is vulnerable to Heap-based Buffer Overflow
reference:
https://github.com/vim/vim/commit/65b605665997fad54ef39a93199e305af2fe4d7f
(From OE-Core rev: 0fb9be3925f258a7e8009c581c1cf93ace2a498b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-support/vim/files')
-rw-r--r-- | meta/recipes-support/vim/files/CVE-2021-3778.patch | 49 |
1 files changed, 49 insertions, 0 deletions
diff --git a/meta/recipes-support/vim/files/CVE-2021-3778.patch b/meta/recipes-support/vim/files/CVE-2021-3778.patch new file mode 100644 index 0000000000..9e1c4d29be --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2021-3778.patch | |||
@@ -0,0 +1,49 @@ | |||
1 | From eb41373c8c88b0789e5cf04669d6116f9a199264 Mon Sep 17 00:00:00 2001 | ||
2 | From: Minjae Kim <flowergom@gmail.com> | ||
3 | Date: Sun, 26 Sep 2021 23:48:00 +0000 | ||
4 | Subject: [PATCH] patch 8.2.3409: reading beyond end of line with invalid utf-8 | ||
5 | character | ||
6 | |||
7 | Problem: Reading beyond end of line with invalid utf-8 character. | ||
8 | Solution: Check for NUL when advancing. | ||
9 | |||
10 | Upstream-Status: Accepted [https://github.com/vim/vim/commit/65b605665997fad54ef39a93199e305af2fe4d7f] | ||
11 | CVE: CVE-2021-3778 | ||
12 | Signed-off-by: Minjae Kim <flowergom@gmail.com> | ||
13 | --- | ||
14 | src/regexp_nfa.c | 3 ++- | ||
15 | src/testdir/test_regexp_utf8.vim | 7 +++++++ | ||
16 | 2 files changed, 9 insertions(+), 1 deletion(-) | ||
17 | |||
18 | diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c | ||
19 | index fb512f961..4d337f1f1 100644 | ||
20 | --- a/src/regexp_nfa.c | ||
21 | +++ b/src/regexp_nfa.c | ||
22 | @@ -5455,7 +5455,8 @@ find_match_text(colnr_T startcol, int regstart, char_u *match_text) | ||
23 | match = FALSE; | ||
24 | break; | ||
25 | } | ||
26 | - len2 += MB_CHAR2LEN(c2); | ||
27 | + len2 += enc_utf8 ? utf_ptr2len(rex.line + col + len2) | ||
28 | + : MB_CHAR2LEN(c2); | ||
29 | } | ||
30 | if (match | ||
31 | // check that no composing char follows | ||
32 | diff --git a/src/testdir/test_regexp_utf8.vim b/src/testdir/test_regexp_utf8.vim | ||
33 | index 19ff882be..e0665818b 100644 | ||
34 | --- a/src/testdir/test_regexp_utf8.vim | ||
35 | +++ b/src/testdir/test_regexp_utf8.vim | ||
36 | @@ -215,3 +215,10 @@ func Test_optmatch_toolong() | ||
37 | set re=0 | ||
38 | endfunc | ||
39 | |||
40 | +func Test_match_invalid_byte() | ||
41 | + call writefile(0z630a.765d30aa0a.2e0a.790a.4030, 'Xinvalid') | ||
42 | + new | ||
43 | + source Xinvalid | ||
44 | + bwipe! | ||
45 | + call delete('Xinvalid') | ||
46 | +endfunc | ||
47 | -- | ||
48 | 2.17.1 | ||
49 | |||