From: Siddharth Doshi <[email protected]> Picking patch as per [1], and same patch is mentioned in [2]
References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-28422 [2] https://security-tracker.debian.org/tracker/CVE-2026-28422 Signed-off-by: Siddharth Doshi <[email protected]> --- .../vim/files/CVE-2026-28422.patch | 44 +++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 45 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-28422.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-28422.patch b/meta/recipes-support/vim/files/CVE-2026-28422.patch new file mode 100644 index 0000000000..89f219ccf6 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-28422.patch @@ -0,0 +1,44 @@ +From fcf19885004325f5a52db6bd6893cb5b387799d3 Mon Sep 17 00:00:00 2001 +From: Christian Brabandt <[email protected]> +Date: Tue, 24 Feb 2026 20:29:20 +0000 +Subject: [PATCH 01/17] patch 9.2.0078: [security]: stack-buffer-overflow in + build_stl_str_hl() + +Problem: A stack-buffer-overflow occurs when rendering a statusline + with a multi-byte fill character on a very wide terminal. + The size check in build_stl_str_hl() uses the cell width + rather than the byte length, allowing the subsequent fill + loop to write beyond the 4096-byte MAXPATHL buffer + (ehdgks0627, un3xploitable). +Solution: Update the size check to account for the byte length of + the fill character (using MB_CHAR2LEN). + +Github Advisory: +https://github.com/vim/vim/security/advisories/GHSA-gmqx-prf2-8mwf + +Signed-off-by: Christian Brabandt <[email protected]> + +Upstream-Status: Backport [https://github.com/vim/vim/commit/4e5b9e31cb7484ad156fba995fdce3c9b075b5fd] +CVE: CVE-2026-28422 +Signed-off-by: Siddharth Doshi <[email protected]> +--- + src/buffer.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/buffer.c b/src/buffer.c +index 0feafc590d..363dd0e04a 100644 +--- a/src/buffer.c ++++ b/src/buffer.c +@@ -5293,7 +5293,8 @@ build_stl_str_hl( + } + width = maxwidth; + } +- else if (width < maxwidth && outputlen + maxwidth - width + 1 < outlen) ++ else if (width < maxwidth && ++ outputlen + (maxwidth - width) * MB_CHAR2LEN(fillchar) + 1 < outlen) + { + // Find how many separators there are, which we will use when + // figuring out how many groups there are. +-- +2.44.4 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 9a4b21f530..16edebf1e9 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -33,6 +33,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \ file://CVE-2026-45130.patch \ file://CVE-2026-46483.patch \ file://CVE-2026-28420.patch \ + file://CVE-2026-28422.patch \ " PV .= ".1683" -- 2.34.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241745): https://lists.openembedded.org/g/openembedded-core/message/241745 Mute This Topic: https://lists.openembedded.org/mt/120400848/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
