Browse code
Fix CVE-2016-1248 - vim
Change-Id: I3f7f0dc570d7515e415804d71e48e8c4275fe6d6
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/1768
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Sharath George
suezzelur authored on 2016/11/29 10:09:30Showing 2 changed files
| 1 | 1 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,62 @@ |
| 0 |
+diff -rup vim74/src/option.c vim74-new/src/option.c |
|
| 1 |
+--- vim74/src/option.c 2013-07-17 12:39:13.000000000 -0700 |
|
| 2 |
+@@ -5653,6 +5653,21 @@ set_string_option(opt_idx, value, opt_fl |
|
| 3 |
+ } |
|
| 4 |
+ |
|
| 5 |
+ /* |
|
| 6 |
++ * Return TRUE if "val" is a valid 'filetype' name. |
|
| 7 |
++ * Also used for 'syntax' and 'keymap'. |
|
| 8 |
++ */ |
|
| 9 |
++ static int |
|
| 10 |
++valid_filetype(char_u *val) |
|
| 11 |
++{
|
|
| 12 |
++ char_u *s; |
|
| 13 |
++ |
|
| 14 |
++ for (s = val; *s != NUL; ++s) |
|
| 15 |
++ if (!ASCII_ISALNUM(*s) && vim_strchr((char_u *)".-_", *s) == NULL) |
|
| 16 |
++ return FALSE; |
|
| 17 |
++ return TRUE; |
|
| 18 |
++} |
|
| 19 |
++ |
|
| 20 |
++/* |
|
| 21 |
+ * Handle string options that need some action to perform when changed. |
|
| 22 |
+ * Returns NULL for success, or an error message for an error. |
|
| 23 |
+ */ |
|
| 24 |
+@@ -6043,8 +6058,11 @@ did_set_string_option(opt_idx, varp, new |
|
| 25 |
+ #ifdef FEAT_KEYMAP |
|
| 26 |
+ else if (varp == &curbuf->b_p_keymap) |
|
| 27 |
+ {
|
|
| 28 |
+- /* load or unload key mapping tables */ |
|
| 29 |
+- errmsg = keymap_init(); |
|
| 30 |
++ if (!valid_filetype(*varp)) |
|
| 31 |
++ errmsg = e_invarg; |
|
| 32 |
++ else |
|
| 33 |
++ /* load or unload key mapping tables */ |
|
| 34 |
++ errmsg = keymap_init(); |
|
| 35 |
+ |
|
| 36 |
+ if (errmsg == NULL) |
|
| 37 |
+ {
|
|
| 38 |
+@@ -6990,6 +7008,22 @@ did_set_string_option(opt_idx, varp, new |
|
| 39 |
+ } |
|
| 40 |
+ #endif |
|
| 41 |
+ |
|
| 42 |
++#ifdef FEAT_AUTOCMD |
|
| 43 |
++ else if (gvarp == &p_ft) |
|
| 44 |
++ {
|
|
| 45 |
++ if (!valid_filetype(*varp)) |
|
| 46 |
++ errmsg = e_invarg; |
|
| 47 |
++ } |
|
| 48 |
++#endif |
|
| 49 |
++ |
|
| 50 |
++#ifdef FEAT_SYN_HL |
|
| 51 |
++ else if (gvarp == &p_syn) |
|
| 52 |
++ {
|
|
| 53 |
++ if (!valid_filetype(*varp)) |
|
| 54 |
++ errmsg = e_invarg; |
|
| 55 |
++ } |
|
| 56 |
++#endif |
|
| 57 |
++ |
|
| 58 |
+ /* Options that are a list of flags. */ |
|
| 59 |
+ else |
|
| 60 |
+ {
|
| ... | ... |
@@ -1,37 +1,39 @@ |
| 1 | 1 |
%define debug_package %{nil}
|
| 2 | 2 |
|
| 3 |
-Summary: Text editor |
|
| 4 |
-Name: vim |
|
| 5 |
-Version: 7.4 |
|
| 6 |
-Release: 7%{?dist}
|
|
| 7 |
-License: Charityware |
|
| 8 |
-URL: http://www.vim.org |
|
| 9 |
-Group: Applications/Editors |
|
| 10 |
-Vendor: VMware, Inc. |
|
| 11 |
-Distribution: Photon |
|
| 12 |
-Source0: %{name}-%{version}.tar.bz2
|
|
| 3 |
+Summary: Text editor |
|
| 4 |
+Name: vim |
|
| 5 |
+Version: 7.4 |
|
| 6 |
+Release: 8%{?dist}
|
|
| 7 |
+License: Charityware |
|
| 8 |
+URL: http://www.vim.org |
|
| 9 |
+Group: Applications/Editors |
|
| 10 |
+Vendor: VMware, Inc. |
|
| 11 |
+Distribution: Photon |
|
| 12 |
+Source0: %{name}-%{version}.tar.bz2
|
|
| 13 | 13 |
%define sha1 vim=601abf7cc2b5ab186f40d8790e542f86afca86b7 |
| 14 |
-BuildRequires: ncurses-devel |
|
| 15 |
-Requires: tcsh |
|
| 14 |
+Patch0: vim-CVE-2016-1248.patch |
|
| 15 |
+BuildRequires: ncurses-devel |
|
| 16 |
+Requires: tcsh |
|
| 16 | 17 |
|
| 17 | 18 |
%description |
| 18 | 19 |
The Vim package contains a powerful text editor. |
| 19 | 20 |
|
| 20 |
-%package extra |
|
| 21 |
-Summary: Extra files for Vim text editor |
|
| 22 |
-Group: Applications/Editors |
|
| 23 |
-Requires: tcsh |
|
| 21 |
+%package extra |
|
| 22 |
+Summary: Extra files for Vim text editor |
|
| 23 |
+Group: Applications/Editors |
|
| 24 |
+Requires: tcsh |
|
| 24 | 25 |
|
| 25 | 26 |
%description extra |
| 26 | 27 |
The vim extra package contains a extra files for powerful text editor. |
| 27 | 28 |
|
| 28 | 29 |
%prep |
| 29 | 30 |
%setup -q -n %{name}74
|
| 31 |
+%patch0 -p1 |
|
| 30 | 32 |
echo '#define SYS_VIMRC_FILE "/etc/vimrc"' >> src/feature.h |
| 31 | 33 |
%build |
| 32 | 34 |
./configure \ |
| 33 |
- --prefix=%{_prefix} \
|
|
| 34 |
- --enable-multibyte |
|
| 35 |
+ --prefix=%{_prefix} \
|
|
| 36 |
+ --enable-multibyte |
|
| 35 | 37 |
make VERBOSE=1 %{?_smp_mflags}
|
| 36 | 38 |
%install |
| 37 | 39 |
cd %{_builddir}/%{name}74
|
| ... | ... |
@@ -155,8 +157,10 @@ make test |
| 155 | 155 |
%{_bindir}/vimdiff
|
| 156 | 156 |
|
| 157 | 157 |
%changelog |
| 158 |
-* Wed Oct 05 2016 ChangLee <changlee@vmware.com> 7.4-7 |
|
| 159 |
-- Modified %check |
|
| 158 |
+* Fri Nov 18 2016 Anish Swaminathan <anishs@vmware.com> 7.4-8 |
|
| 159 |
+- Fix for CVE-2016-1248 |
|
| 160 |
+* Wed Oct 05 2016 ChangLee <changlee@vmware.com> 7.4-7 |
|
| 161 |
+- Modified %check |
|
| 160 | 162 |
* Wed Aug 24 2016 Alexey Makhalov <amakhalov@vmware.com> 7.4-6 |
| 161 | 163 |
- vimrc: Added tags search, tab->spaces and some bindings |
| 162 | 164 |
* Tue May 24 2016 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 7.4-5 |