Re: [OE-core] [scarthgap] [PATCH V2 1/2] vim: Fix CVE-2026-25749

["Yoann Congal" <yoann.congal@smile.fr>]

On Mon Mar 30, 2026 at 8:21 PM CEST, Anil Dongare -X (adongare - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> Hi Yoann,
>
> Thank you for reviewing the patch. I have double-checked the formatting against the upstream repository.
>
> The context lines starting with tabs rather than a single space exactly match the original upstream source code indentation in src/tag.c for that specific block. I kept the formatting identical to the upstream commit to ensure consistency and avoid introducing any unintended whitespace or indentation issues.

Hello,

I think I was not clear enough. Let me be more precise.
I'm not talking about indentation style in the upstream file tag.c
(those can be either spaces or tabs, that is perfectly fine).

I'm talking about the format of the patch modifying this file. For
example, your CVE-2026-25749.patch file:

As per
https://www.gnu.org/software/diffutils/manual/html_node/Detailed-Unified.html:
> The lines common to both files begin with a space character. The lines
> that actually differ between the two files have one of the following
> indicator characters in the left print column:

But, in you patch you actually got a tab instead of the space meaning
that both before/after state have the same line (in another word: context).

Using "cat -t" to display tab:
 $ cat -nt meta/recipes-support/vim/files/CVE-2026-25749.patch
    33	--- a/src/tag.c
    34	+++ b/src/tag.c
    35	@@ -3348,7 +3348,7 @@ get_tagfname(
    36	^I    if (tnp->tn_hf_idx > tag_fnames.ga_len || *p_hf == NUL)
        ^ Here, there is a tab where the format says it should be a
		space to indicate context.

But some lines later this is fine:
    44	diff --git a/src/testdir/test_help.vim b/src/testdir/test_help.vim
    45	index dac153d86..f9e4686bb 100644
    46	--- a/src/testdir/test_help.vim
    47	+++ b/src/testdir/test_help.vim
    48	@@ -222,4 +222,13 @@ func Test_helptag_navigation()
    49	 endfunc
	    ^ here, this is a space to indicate that this line is context.
		(Like every other patch you will find in the oe-core repository)

Is this more clear?

> Please let me know if you would still prefer me to modify it!

Yes, I still like a properly formatted patch please.

I don't know how you generated this patch but I recommend using devtool:
https://docs.yoctoproject.org/dev/ref-manual/devtool-reference.html#updating-a-recipe

Regards,

>
> Thanks, Anil

-- 
Yoann Congal
Smile ECS