From 72b9214ff00f615cd258f01d4a8bf9339c7650eb Mon Sep 17 00:00:00 2001 From: wangjiang Date: Tue, 10 Oct 2023 09:00:34 +0800 Subject: [PATCH] fix CVE-2023-5344 --- backport-CVE-2023-5344.patch | 47 ++++++++++++++++++++++++++++++++++++ vim.spec | 9 ++++++- 2 files changed, 55 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2023-5344.patch diff --git a/backport-CVE-2023-5344.patch b/backport-CVE-2023-5344.patch new file mode 100644 index 0000000..6994b5c --- /dev/null +++ b/backport-CVE-2023-5344.patch @@ -0,0 +1,47 @@ +From 3bd7fa12e146c6051490d048a4acbfba974eeb04 Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Mon, 2 Oct 2023 20:59:08 +0200 +Subject: [PATCH 2156/2205] patch 9.0.1969: [security] buffer-overflow in + trunc_string() + +Problem: buffer-overflow in trunc_string() +Solution: Add NULL at end of buffer + +Currently trunc_string() assumes that when the string is too long, +buf[e-1] will always be writeable. But that assumption may not always be +true. The condition currently looks like this + + else if (e + 3 < buflen) + [...] + else + { + // can't fit in the "...", just truncate it + buf[e - 1] = NUL; + } + +but this means, we may run into the last else clause with e still being +larger than buflen. So a buffer overflow occurs. + +So instead of using `buf[e - 1]`, let's just always +truncate at `buf[buflen - 1]` which should always be writable. + +Signed-off-by: Christian Brabandt +--- + src/message.c | 2 +- + 1 files changed, 1 insertions(+), 1 deletion(-) + +diff --git a/src/message.c b/src/message.c +index 2fc6cefa9..83c8b4f4a 100644 +--- a/src/message.c ++++ b/src/message.c +@@ -353,7 +353,7 @@ trunc_string( + else + { + // can't fit in the "...", just truncate it +- buf[e - 1] = NUL; ++ buf[buflen - 1] = NUL; + } + } + +-- +2.27.0 diff --git a/vim.spec b/vim.spec index 2fd0b11..fa47b8c 100644 --- a/vim.spec +++ b/vim.spec @@ -12,7 +12,7 @@ Name: vim Epoch: 2 Version: 9.0 -Release: 36 +Release: 37 Summary: Vim is a highly configurable text editor for efficiently creating and changing any kind of text. License: Vim and MIT URL: http://www.vim.org @@ -108,6 +108,7 @@ Patch6077: backport-CVE-2023-4738.patch Patch6078: backport-CVE-2023-4750.patch Patch6079: backport-CVE-2023-4752.patch Patch6080: backport-CVE-2023-4781.patch +Patch6081: backport-CVE-2023-5344.patch Patch9000: bugfix-rm-modify-info-version.patch @@ -515,6 +516,12 @@ LC_ALL=en_US.UTF-8 make -j1 test %{_mandir}/man1/evim.* %changelog +* Tue Oct 10 2023 wangjiang - 2:9.0-37 +- Type:CVE +- ID:CVE-2023-5344 +- SUG:NA +- DESC:fix CVE-2023-5344 + * Tue Sep 12 2023 wangjiang - 2:9.0-36 - Type:CVE - ID:CVE-2023-4738 CVE-2023-4750 CVE-2023-4752 CVE-2023-4781 -- Gitee