Re: [LFS Trac] #4500: vim-9.1.???? (Update before release)

#4500: vim-9.1.???? (Update before release)
-------------------------+-----------------------
 Reporter:  Bruce Dubbs  |       Owner:  lfs-book
     Type:  task         |      Status:  new
 Priority:  high         |   Milestone:  Hold
Component:  Book         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+-----------------------
Changes (by Joe Locash):

 * priority:  normal => high

Comment:

 Reported earlier today:

 {{{
 buffer overflow in helpfile option handling affects Vim <9.1.2132
 =================================================================
 Date: 05.02.2026
 Severity: Medium
 CVE: *not yet assigned*
 CWE: Heap-based Buffer Overflow (CWE-122)

 ### Summary
 A heap buffer overflow vulnerability exists in Vim's tag file resolution
 logic when processing the 'helpfile' option, affecting all versions prior
 to version v9.1.2132.

 ### Description
 The vulnerability is located in the `get_tagfname()` function in
 `src/tag.c`.
 When processing help file tags, Vim copies the user-controlled
 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1
 bytes
 (typically 4097 bytes) using an unsafe `STRCPY()` operation without any
 bounds checking.

 The vulnerable code path is triggered when:
 1. A user or attacker sets the 'helpfile' option to a string exceeding
    MAXPATHL bytes
 2. The `:help` command is executed
 3. The call chain `ex_help()` → `find_help_tags()` → `find_tags()` →
    `get_tagfname()` is invoked
 4. The unchecked `STRCPY(buf, p_hf)` overflows the heap-allocated buffer.

 Since the 'helpfile' option has no length validation when set, arbitrarily
 long values can be assigned and subsequently copied, causing heap memory
 corruption when the buffer overflow occurs.

 ### Impact
 The vulnerability allows heap buffer overflow with the following potential
 impacts:

 - **Denial of Service**: Heap corruption causes immediate application
 crashes
 - **Memory Corruption**: Adjacent heap allocations and heap metadata can
   be overwritten
 - **Potential Code Execution**: Depending on heap layout and exploitation
   techniques, this could potentially be leveraged for arbitrary code
   execution, though this would be non-trivial

 The vulnerability requires user interaction (executing the `:help` command
 and setting the 'helpfile' option value) and is therefore rated
 **medium** but has the potential for code execution.

 This issue was confirmed using AddressSanitizer, which detected a
 heap-buffer-overflow with writes significantly exceeding the allocated
 buffer size.

 ### Acknowledgements
 The Vim project would like to thank Rahul Hoysala (github handle
 @rahulhoysala)
 for reporting this issue and providing detailed proof-of-concept code
 demonstrating the vulnerability.

 ### References
 The issue has been fixed as of Vim patch v9.1.2132.

 https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9
 https://github.com/vim/vim/security/advisories/GHSA-5w93-4g67-mm43
 }}}
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/lfs/ticket/4500#comment:48>
LFS Trac <https://wiki.linuxfromscratch.org/lfs/>
Linux From Scratch: Your Distro, Your Rules.

-- 
http://lists.linuxfromscratch.org/sympa/info/lfs-book
Unsubscribe: See the above information page