Re: [OE-core][wrynose][patch 04/10] vim: Fix CVE-2026-57451

["Yoann Congal" <yoann.congal@smile.fr>]

On Wed Jul 22, 2026 at 2:33 PM CEST, Vijay Anusuri via lists.openembedded.org wrote:
> Pick patch per [1].
>
> [1] https://nvd.nist.gov/vuln/detail/CVE-2026-57451
> [2] https://github.com/vim/vim/security/advisories/GHSA-f36c-2qcp-7gpw
>
> Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> ---
>  .../vim/files/CVE-2026-57451.patch            | 177 ++++++++++++++++++
>  meta/recipes-support/vim/vim.inc              |   1 +
>  2 files changed, 178 insertions(+)
>  create mode 100644 meta/recipes-support/vim/files/CVE-2026-57451.patch
>
> diff --git a/meta/recipes-support/vim/files/CVE-2026-57451.patch b/meta/recipes-support/vim/files/CVE-2026-57451.patch
> new file mode 100644
> index 0000000000..22a0cfc03e
> --- /dev/null
> +++ b/meta/recipes-support/vim/files/CVE-2026-57451.patch
> @@ -0,0 +1,177 @@
> +From b2338ca90643e2f01ecb6547c1172716aaec4f79 Mon Sep 17 00:00:00 2001
> +From: Yasuhiro Matsumoto <mattn.jp@gmail.com>
> +Date: Wed, 17 Jun 2026 21:06:59 +0000
> +Subject: [PATCH] patch 9.2.0670: [security]: Out-of-bounds read with text
> + properties
> +
> +Problem:  [security]: Out-of-bounds read with text properties
> +          (cipher-creator)
> +Solution: Add out-of-bound checks (Yasuhiro Matsumoto)
> +
> +Github Security Advisory:
> +https://github.com/vim/vim/security/advisories/GHSA-f36c-2qcp-7gpw
> +
> +Supported by AI
> +
> +Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
> +Signed-off-by: Christian Brabandt <cb@256bit.org>
> +
> +Upstream-Status: Backport [https://github.com/vim/vim/commit/b2338ca90643e2f01ecb6547c1172716aaec4f79]
> +CVE: CVE-2026-57451
> +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> +---
> + src/memline.c                  |  7 ++++
> + src/proto/textprop.pro         |  1 +
> + src/testdir/test_textprop2.vim | 59 ++++++++++++++++++++++++++++++++++
> + src/textprop.c                 | 20 ++++++++++++
> + 4 files changed, 87 insertions(+)

Indentation was changed between upstream patch and this patch.
Don't keep the upstream indentation. (Even if unfortunate I admit...)

Regards,
-- 
Yoann Congal
Smile ECS