diff options
| -rw-r--r-- | gnu/local.mk | 1 | ||||
| -rw-r--r-- | gnu/packages/patches/vim-CVE-2017-5953.patch | 24 | ||||
| -rw-r--r-- | gnu/packages/vim.scm | 1 |
3 files changed, 26 insertions, 0 deletions
diff --git a/gnu/local.mk b/gnu/local.mk index 26f6bbf0d7..060de25357 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -954,6 +954,7 @@ dist_patch_DATA = \ %D%/packages/patches/util-linux-tests.patch \ %D%/packages/patches/upower-builddir.patch \ %D%/packages/patches/valgrind-enable-arm.patch \ + %D%/packages/patches/vim-CVE-2017-5953.patch \ %D%/packages/patches/vorbis-tools-CVE-2014-9638+CVE-2014-9639.patch \ %D%/packages/patches/vorbis-tools-CVE-2014-9640.patch \ %D%/packages/patches/vorbis-tools-CVE-2015-6749.patch \ diff --git a/gnu/packages/patches/vim-CVE-2017-5953.patch b/gnu/packages/patches/vim-CVE-2017-5953.patch new file mode 100644 index 0000000000..7b66f1bf16 --- /dev/null +++ b/gnu/packages/patches/vim-CVE-2017-5953.patch @@ -0,0 +1,24 @@ +Fix CVE-2017-5953: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5953 +https://groups.google.com/forum/#!topic/vim_dev/t-3RSdEnrHY + +Patch adapted from upstream commit, correcting the transcription error +in the bounds check: + +https://github.com/vim/vim/commit/399c297aa93afe2c0a39e2a1b3f972aebba44c9d + +diff --git a/src/spellfile.c b/src/spellfile.c +index c7d87c6..8b1a3a6 100644 +--- a/src/spellfile.c ++++ b/src/spellfile.c +@@ -1595,6 +1595,9 @@ spell_read_tree( + len = get4c(fd); + if (len < 0) + return SP_TRUNCERROR; ++ if (len >= 0x3fffffff) ++ /* Invalid length, multiply with sizeof(int) would overflow. */ ++ return SP_FORMERROR; + if (len > 0) + { + /* Allocate the byte array. */ diff --git a/gnu/packages/vim.scm b/gnu/packages/vim.scm index f042aba931..cdb32ac7eb 100644 --- a/gnu/packages/vim.scm +++ b/gnu/packages/vim.scm @@ -63,6 +63,7 @@ (uri (string-append "https://github.com/vim/vim/archive/v" version ".tar.gz")) (file-name (string-append name "-" version ".tar.gz")) + (patches (search-patches "vim-CVE-2017-5953.patch")) (sha256 (base32 "04samk2bakyixbxyc3p0g6ypls45105sikibg0wc6lmak9bqjs85")))) |