diff --git a/backport-9.0.0581-adding-a-character-for-incsearch-fails-at-end-of-line.patch b/backport-9.0.0581-adding-a-character-for-incsearch-fails-at-end-of-line.patch index a14c3672239be9c2ccc2472e770e5546a500ea39..815ad4b22f2fd9bc7931684fb3d31ce2d4a3a595 100644 --- a/backport-9.0.0581-adding-a-character-for-incsearch-fails-at-end-of-line.patch +++ b/backport-9.0.0581-adding-a-character-for-incsearch-fails-at-end-of-line.patch @@ -11,7 +11,7 @@ Solution: Only check cursor line number. 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/move.c b/src/move.c -index 6c654ac..4123ca8 100644 +index 1d7bcfb..3760042 100644 --- a/src/move.c +++ b/src/move.c @@ -652,7 +652,7 @@ cursor_valid(void) @@ -24,5 +24,5 @@ index 6c654ac..4123ca8 100644 if ((curwin->w_valid & (VALID_WCOL|VALID_WROW)) != (VALID_WCOL|VALID_WROW)) curs_columns(TRUE); -- -2.27.0 +2.33.0 diff --git a/backport-CVE-2022-2264.patch b/backport-CVE-2022-2264.patch index 4803c92cd15aa1873eeedfc81d0e5cb0768c105d..532eda401a79126a9c94cc256247993d7dc2a03f 100644 --- a/backport-CVE-2022-2264.patch +++ b/backport-CVE-2022-2264.patch @@ -12,7 +12,7 @@ Solution: Adjust the end mark position. 2 files changed, 14 insertions(+) diff --git a/src/register.c b/src/register.c -index 93860ba..30e2001 100644 +index 87689f7..51c14b8 100644 --- a/src/register.c +++ b/src/register.c @@ -1918,6 +1918,8 @@ do_put( @@ -25,7 +25,7 @@ index 93860ba..30e2001 100644 // may insert some spaces after the new text diff --git a/src/testdir/test_put.vim b/src/testdir/test_put.vim -index aa5aa2b..66438bd 100644 +index 6df04cf..c8d306a 100644 --- a/src/testdir/test_put.vim +++ b/src/testdir/test_put.vim @@ -219,5 +219,17 @@ func Test_put_empty_register() diff --git a/fix-CVE-2024-47814.patch b/fix-CVE-2024-47814.patch new file mode 100644 index 0000000000000000000000000000000000000000..a37ad88d9f464819f8ecf12e5f1fdc9ad5cfdfdb --- /dev/null +++ b/fix-CVE-2024-47814.patch @@ -0,0 +1,118 @@ +From 51b62387be93c65fa56bbabe1c3c1ea5df187641 Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Tue, 8 Oct 2024 09:09:11 +0800 +Subject: [PATCH] fix CVE-2024-47814 + +Problem: [security]: use-after-free when closing a buffer +Solution: When splitting the window and editing a new buffer, + check whether the newly to be edited buffer has been marked + for deletion and abort in this case + +Github Advisory: +https://github.com/vim/vim/security/advisories/GHSA-rj48-v4mq-j4vg + +Signed-off-by: Christian Brabandt + +--- + src/buffer.c | 7 +++++++ + src/ex_cmds.c | 12 ++++++++++++ + src/proto/buffer.pro | 1 + + src/testdir/test_autocmd.vim | 19 +++++++++++++++++++ + src/version.c | 2 ++ + 5 files changed, 41 insertions(+) + +diff --git a/src/buffer.c b/src/buffer.c +index 8ea57f7..1f71e38 100644 +--- a/src/buffer.c ++++ b/src/buffer.c +@@ -470,6 +470,13 @@ can_unload_buffer(buf_T *buf) + return can_unload; + } + ++ int ++buf_locked(buf_T *buf) ++{ ++ return buf->b_locked || buf->b_locked_split; ++} ++ ++ + /* + * Close the link to a buffer. + * "action" is used when there is no longer a window for the buffer. +diff --git a/src/ex_cmds.c b/src/ex_cmds.c +index 853df4b..92b5e9f 100644 +--- a/src/ex_cmds.c ++++ b/src/ex_cmds.c +@@ -2692,6 +2692,18 @@ do_ecmd( + } + if (buf == NULL) + goto theend; ++ // autocommands try to edit a file that is goind to be removed, ++ // abort ++ if (buf_locked(buf)) ++ { ++ // window was split, but not editing the new buffer, ++ // reset b_nwindows again ++ if (oldwin == NULL ++ && curwin->w_buffer != NULL ++ && curwin->w_buffer->b_nwindows > 1) ++ --curwin->w_buffer->b_nwindows; ++ goto theend; ++ } + if (curwin->w_alt_fnum == buf->b_fnum && prev_alt_fnum != 0) + // reusing the buffer, keep the old alternate file + curwin->w_alt_fnum = prev_alt_fnum; +diff --git a/src/proto/buffer.pro b/src/proto/buffer.pro +index 094feed..031e64a 100644 +--- a/src/proto/buffer.pro ++++ b/src/proto/buffer.pro +@@ -70,4 +70,5 @@ char_u *buf_get_fname(buf_T *buf); + void set_buflisted(int on); + int buf_contents_changed(buf_T *buf); + void wipe_buffer(buf_T *buf, int aucmd); ++int buf_locked(buf_T *buf); + /* vim: set ft=c : */ +diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim +index d8738c8..e251112 100644 +--- a/src/testdir/test_autocmd.vim ++++ b/src/testdir/test_autocmd.vim +@@ -3633,4 +3633,23 @@ func Test_autocmd_split_dummy() + call delete('Xerr') + endfunc + ++" This was using freed memory ++func Test_autocmd_BufWinLeave_with_vsp() ++ new ++ let fname = 'XXXBufWinLeaveUAF.txt' ++ let dummy = 'XXXDummy.txt' ++ call writefile([], fname) ++ call writefile([], dummy) ++ defer delete(fname) ++ defer delete(dummy) ++ exe "e " fname ++ vsp ++ augroup testing ++ exe "au BufWinLeave " .. fname .. " :e " dummy .. "| vsp " .. fname ++ augroup END ++ bw ++ call CleanUpTestAuGroup() ++ exe "bw! " .. dummy ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab +diff --git a/src/version.c b/src/version.c +index 2de8fd2..5946644 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -735,6 +735,8 @@ static char *(features[]) = + + static int included_patches[] = + { /* Add new patch number below this line */ ++/**/ ++ 679, + /**/ + 678, + /**/ +-- +2.43.0 + diff --git a/vim-Add-sw64-architecture.patch b/vim-Add-sw64-architecture.patch new file mode 100644 index 0000000000000000000000000000000000000000..0d235fb366f07c5a3642c1a8b2df7785491a5869 --- /dev/null +++ b/vim-Add-sw64-architecture.patch @@ -0,0 +1,42 @@ +From 5c8a08bf2260585ffd0202f3506456e53b74e987 Mon Sep 17 00:00:00 2001 +From: wzx +Date: Thu, 24 Nov 2022 14:10:28 +0800 +Subject: [PATCH] Add sw64 architecture + +Add sw64 architecture in file runtime/syntax/debcontrol.vim and src/osdef1.h.in to support sw64 architecture. + +Signed-off-by: wzx +--- + runtime/syntax/debcontrol.vim | 2 +- + src/osdef1.h.in | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/runtime/syntax/debcontrol.vim b/runtime/syntax/debcontrol.vim +index 9085cd0..5c945c4 100644 +--- a/runtime/syntax/debcontrol.vim ++++ b/runtime/syntax/debcontrol.vim +@@ -28,7 +28,7 @@ syn match debControlSpace "[ \t]" + + let s:kernels = ['linux', 'hurd', 'kfreebsd', 'knetbsd', 'kopensolaris', 'netbsd'] + let s:archs = [ +- \ 'alpha', 'amd64', 'armeb', 'armel', 'armhf', 'arm64', 'avr32', 'hppa' ++ \ 'alpha', 'sw_64', 'amd64', 'armeb', 'armel', 'armhf', 'arm64', 'avr32', 'hppa' + \, 'i386', 'ia64', 'lpia', 'm32r', 'm68k', 'mipsel', 'mips64el', 'mips' + \, 'powerpcspe', 'powerpc', 'ppc64el', 'ppc64', 'riscv64', 's390x', 's390', 'sh3eb' + \, 'sh3', 'sh4eb', 'sh4', 'sh', 'sparc64', 'sparc', 'x32' +diff --git a/src/osdef1.h.in b/src/osdef1.h.in +index 825fe94..f8c3b9d 100644 +--- a/src/osdef1.h.in ++++ b/src/osdef1.h.in +@@ -132,7 +132,7 @@ extern char *getcwd(char *, int); + #else + extern char *getwd(char *); + #endif +-#ifndef __alpha /* suggested by Campbell */ ++#if !defined __alpha && !defined __sw_64 /* suggested by Campbell */ + extern int ioctl(int, int, ...); + #endif + extern int chmod(const char *, mode_t); +-- +2.33.0 + diff --git a/vim.spec b/vim.spec index 7fbdf78e5e5eaa3c3b7c6718e735c9af24a410a7..3abf177c187fa0f159a1f96102394c43d044be5b 100644 --- a/vim.spec +++ b/vim.spec @@ -12,7 +12,7 @@ Name: vim Epoch: 2 Version: 9.0 -Release: 26 +Release: 28 Summary: Vim is a highly configurable text editor for efficiently creating and changing any kind of text. License: Vim and MIT URL: http://www.vim.org @@ -128,6 +128,8 @@ Patch6098: backport-CVE-2024-43374.patch Patch6099: backport-CVE-2024-43802.patch Patch9000: bugfix-rm-modify-info-version.patch +Patch9001: vim-Add-sw64-architecture.patch +Patch9002: fix-CVE-2024-47814.patch BuildRequires: autoconf python3-devel ncurses-devel gettext perl-devel perl-generators gcc BuildRequires: perl(ExtUtils::Embed) perl(ExtUtils::ParseXS) libacl-devel gpm-devel file @@ -414,7 +416,7 @@ touch %{buildroot}%{_datadir}/%{name}/vimfiles/doc/tags chrpath -d %{buildroot}%{_bindir}/vim chrpath -d %{buildroot}%{_bindir}/xxd - + mkdir -p %{buildroot}/etc/ld.so.conf.d echo "%{_libdir}/perl5/CORE" > %{buildroot}/etc/ld.so.conf.d/%{name}-%{_arch}.conf @@ -432,7 +434,7 @@ popd %check %if "%{_gpg_name}" == "private OBS" export TERM=xterm -LC_ALL=en_US.UTF-8 make -j1 test +LANG=en_US.UTF-8 make -j1 test %endif %files common @@ -535,6 +537,12 @@ LC_ALL=en_US.UTF-8 make -j1 test %{_mandir}/man1/evim.* %changelog +* Tue Oct 08 2024 changtao - 2:9.0-28 +- Type:CVE +- ID:CVE-2024-47814 +- SUG:NA +- DESC:fix CVE-2024-47814 + * Thu Aug 29 2024 wangjiang - 2:9.0-26 - Type:CVE - ID:CVE-2024-43802 diff --git a/vim.yaml b/vim.yaml new file mode 100644 index 0000000000000000000000000000000000000000..706d40e18bcbf62c9189bfda18b28d4ab578f604 --- /dev/null +++ b/vim.yaml @@ -0,0 +1,4 @@ +version_control: github +src_repo: vim/vim +tag_prefix: ^v +seperator: . \ No newline at end of file