Re: [OE-core][wrynose][patch 05/10] vim: Fix CVE-2026-57454

["Yoann Congal" <yoann.congal@smile.fr>]

On Wed Jul 22, 2026 at 2:33 PM CEST, Vijay Anusuri via lists.openembedded.org wrote:
> Pick patch per [1].
>
> [1] https://nvd.nist.gov/vuln/detail/CVE-2026-57454
> [2] https://security-tracker.debian.org/tracker/CVE-2026-57454
>
> Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> ---
>  .../vim/files/CVE-2026-57454.patch            | 188 ++++++++++++++++++
>  meta/recipes-support/vim/vim.inc              |   1 +
>  2 files changed, 189 insertions(+)
>  create mode 100644 meta/recipes-support/vim/files/CVE-2026-57454.patch
>
> diff --git a/meta/recipes-support/vim/files/CVE-2026-57454.patch b/meta/recipes-support/vim/files/CVE-2026-57454.patch
> new file mode 100644
> index 0000000000..579ffbf11b
> --- /dev/null
> +++ b/meta/recipes-support/vim/files/CVE-2026-57454.patch
> @@ -0,0 +1,188 @@
> +From b3faeecc976d3031d7c0675623516ec60c30f949 Mon Sep 17 00:00:00 2001
> +From: Hirohito Higashi <h.east.727@gmail.com>
> +Date: Sat, 20 Jun 2026 16:06:58 +0000
> +Subject: [PATCH] patch 9.2.0679: [security]: Out-of-bounds read with text
> + property virtual text
> +
> +Problem:  [security]: Out-of-bounds read with text property virtual text.
> +          A crafted undo file can declare a virtual-text property whose
> +          offset points outside the line's property data, so reading the
> +          virtual text reads out of bounds.  This completes the count-only
> +          check added in 9.2.0670.
> +Solution: Validate the virtual-text offset and length of each property
> +          against the available property data before turning the offset
> +          into a pointer.
> +
> +Github Security Advisory:
> +https://github.com/vim/vim/security/advisories/GHSA-ww8h-47xp-hp4w
> +
> +Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
> +Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
> +Signed-off-by: Christian Brabandt <cb@256bit.org>
> +
> +Upstream-Status: Backport [https://github.com/vim/vim/commit/b3faeecc976d3031d7c0675623516ec60c30f949]
> +CVE: CVE-2026-57454
> +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> +---
> + src/proto/textprop.pro         |  1 +
> + src/testdir/test_textprop2.vim | 60 ++++++++++++++++++++++++++++++----
> + src/textprop.c                 | 36 ++++++++++++++++++++
> + 3 files changed, 90 insertions(+), 7 deletions(-)

This patch also has indentation changes between upstream patch and this
patch.

I'll hold the whole series and let you check and correct the patches.

Please send a v2 of the whole series.

Thanks!
-- 
Yoann Congal
Smile ECS