Commit: patch 9.2.0846: [security]: heap buffer overflow in set_sofo()
Christian Brabandt <[email protected]>
| Newsgroups | gmane.editors.vim.devel |
|---|---|
| Message-ID | <[email protected]> |
patch 9.2.0846: [security]: heap buffer overflow in set_sofo() Commit: https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a Author: Yasuhiro Matsumoto <[email protected]> Date: Fri Jul 24 00:58:37 2026 +0900 patch 9.2.0846: [security]: heap buffer overflow in set_sofo() Problem: [security]: heap buffer overflow in set_sofo() (Yazan Balawneh) Solution: Reset sl_sal_first (Yasuhiro Matsumoto). A crafted spell file with an empty SN_SAL section before an SN_SOFO section reaches set_sofo() with sl_sal_first[] already set to -1 by set_sal_first(). The counting loop then under-counts colliding multi-byte "from" characters, allocates an undersized list and writes past its end. Github Security Advisory: https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64 Signed-off-by: Yasuhiro Matsumoto <[email protected]> Signed-off-by: Christian Brabandt <[email protected]> diff --git a/src/spellfile.c b/src/spellfile.c index 8000cdb55..e90c89b73 100644 --- a/src/spellfile.c +++ b/src/spellfile.c @@ -1434,7 +1434,9 @@ set_sofo(slang_T *lp, char_u *from, char_u *to) lp->sl_sofo = TRUE; // First count the number of items for each list. Temporarily use - // sl_sal_first[] for this. + // sl_sal_first[] for this. Reset it first: a preceding SN_SAL section + // may have set the entries to -1 via set_sal_first(). + vim_memset(lp->sl_sal_first, 0, sizeof(salfirst_T) * 256); for (p = from, s = to; *p != NUL && *s != NUL; ) { c = mb_cptr2char_adv(&p); diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim index fa3fb14fd..b8e710eb6 100644 --- a/src/testdir/test_spellfile.vim +++ b/src/testdir/test_spellfile.vim @@ -319,6 +319,11 @@ func Test_spellfile_format_error() " SN_SOFO: multi-byte characters in sofofrom and sofoto call Spellfile_Test(0z0600000000080002CF810002CF82FF000000000000000000000000, '') + " SN_SAL (empty) followed by SN_SOFO with two multi-byte 'from' characters + " sharing the same low byte. A preceding SN_SAL poisons sl_sal_first[], so + " without a reset set_sofo() under-counts and writes out of bounds. + call Spellfile_Test(0z05000000000300000006000000000A0004CAABCEAB00024142FF000000000000000000000000, '') + " SN_COMPOUND: compmax is less than 2 call Spellfile_Test(0z08000000000101, 'E759:') diff --git a/src/version.c b/src/version.c index a93ef0384..5547cf4d5 100644 --- a/src/version.c +++ b/src/version.c @@ -758,6 +758,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 846, /**/ 845, /**/ -- -- You received this message from the "vim_dev" maillist. Do not top-post! Type your reply below the text you are replying to. For more information, visit http://www.vim.org/maillist.php --- You received this message because you are subscribed to the Google Groups "vim_dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/d/msgid/vim_dev/E1wnLMO-00C1b9-US%40256bit.org.