diff options
Diffstat (limited to 'poky/meta/recipes-support')
10 files changed, 508 insertions, 0 deletions
diff --git a/poky/meta/recipes-support/boost/boost/0001-BoostConfig.cmake-allow-searching-for-python310.patch b/poky/meta/recipes-support/boost/boost/0001-BoostConfig.cmake-allow-searching-for-python310.patch new file mode 100644 index 0000000000..0a9ee2cc95 --- /dev/null +++ b/poky/meta/recipes-support/boost/boost/0001-BoostConfig.cmake-allow-searching-for-python310.patch @@ -0,0 +1,50 @@ +From e193f080c7d209516ac9b712fa0c50bb08026fa2 Mon Sep 17 00:00:00 2001 +From: Martin Jansa <Martin.Jansa@gmail.com> +Date: Tue, 19 Oct 2021 12:24:31 +0000 +Subject: [PATCH] BoostConfig.cmake: allow searching for python310 + +* accept double digits in Python3_VERSION_MINOR + +* if someone is using e.g.: + find_package(Python3 REQUIRED) + find_package(Boost REQUIRED python${Python3_VERSION_MAJOR}${Python3_VERSION_MINOR}) + + with python-3.10 then it currently fails with: + + -- Found PythonLibs: /usr/lib/libpython3.10.so (found version "3.10.0") + -- Found Python3: -native/usr/bin/python3-native/python3 (found version "3.10.0") found components: Interpreter + CMake Error at /usr/lib/cmake/Boost-1.77.0/BoostConfig.cmake:141 (find_package): + Could not find a package configuration file provided by "boost_python310" + (requested version 1.77.0) with any of the following names: + + boost_python310Config.cmake + boost_python310-config.cmake + + Add the installation prefix of "boost_python310" to CMAKE_PREFIX_PATH or + set "boost_python310_DIR" to a directory containing one of the above files. + If "boost_python310" provides a separate development package or SDK, be + sure it has been installed. + Call Stack (most recent call first): + /usr/lib/cmake/Boost-1.77.0/BoostConfig.cmake:258 (boost_find_component) + /usr/share/cmake-3.21/Modules/FindBoost.cmake:594 (find_package) + CMakeLists.txt:18 (find_package) + +Upstream-Status: Submitted [https://github.com/boostorg/boost_install/pull/53] +Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> +--- + tools/boost_install/BoostConfig.cmake | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/boost_install/BoostConfig.cmake b/tools/boost_install/BoostConfig.cmake +index fd17821..5dffa58 100644 +--- a/tools/boost_install/BoostConfig.cmake ++++ b/tools/boost_install/BoostConfig.cmake +@@ -113,7 +113,7 @@ macro(boost_find_component comp required quiet) + set(_BOOST_REQUIRED REQUIRED) + endif() + +- if("${comp}" MATCHES "^(python|numpy|mpi_python)([1-9])([0-9])$") ++ if("${comp}" MATCHES "^(python|numpy|mpi_python)([1-9])([0-9][0-9]?)$") + + # handle pythonXY and numpyXY versioned components for compatibility + diff --git a/poky/meta/recipes-support/boost/boost/0002-math-allow-definition-of-boost_math_no_atomic_int-on-the-command-line.patch b/poky/meta/recipes-support/boost/boost/0002-math-allow-definition-of-boost_math_no_atomic_int-on-the-command-line.patch new file mode 100644 index 0000000000..b05b795084 --- /dev/null +++ b/poky/meta/recipes-support/boost/boost/0002-math-allow-definition-of-boost_math_no_atomic_int-on-the-command-line.patch @@ -0,0 +1,53 @@ +From 32bd6197353f6ea8e5bef01f09e25c944141acfc Mon Sep 17 00:00:00 2001 +From: jzmaddock <john@johnmaddock.co.uk> +Date: Wed, 1 Sep 2021 18:54:54 +0100 +Subject: [PATCH] Allow definition of BOOST_MATH_NO_ATOMIC_INT on the command + line. Allows us to test/emulate platforms with no atomic integers. + +[buildroot@heine.tech: + - backport from boostorg/math 32bd6197353f6ea8e5bef01f09e25c944141acfc + - alter path to match boost release +] +Signed-off-by: Michael Nosthoff <buildroot@heine.tech> +--- +Upstream-Status: Backport [https://github.com/boostorg/math/pull/684/commits/32bd6197353f6ea8e5bef01f09e25c944141acfc] + boost/math/tools/atomic.hpp | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/boost/math/tools/atomic.hpp b/boost/math/tools/atomic.hpp +index cc76ed269f..e3cbf5db89 100644 +--- a/boost/math/tools/atomic.hpp ++++ b/boost/math/tools/atomic.hpp +@@ -16,27 +16,27 @@ + namespace boost { + namespace math { + namespace detail { +-#if ATOMIC_INT_LOCK_FREE == 2 ++#if (ATOMIC_INT_LOCK_FREE == 2) && !defined(BOOST_MATH_NO_ATOMIC_INT) + typedef std::atomic<int> atomic_counter_type; + typedef std::atomic<unsigned> atomic_unsigned_type; + typedef int atomic_integer_type; + typedef unsigned atomic_unsigned_integer_type; +-#elif ATOMIC_SHORT_LOCK_FREE == 2 ++#elif (ATOMIC_SHORT_LOCK_FREE == 2) && !defined(BOOST_MATH_NO_ATOMIC_INT) + typedef std::atomic<short> atomic_counter_type; + typedef std::atomic<unsigned short> atomic_unsigned_type; + typedef short atomic_integer_type; + typedef unsigned short atomic_unsigned_type; +-#elif ATOMIC_LONG_LOCK_FREE == 2 ++#elif (ATOMIC_LONG_LOCK_FREE == 2) && !defined(BOOST_MATH_NO_ATOMIC_INT) + typedef std::atomic<long> atomic_unsigned_integer_type; + typedef std::atomic<unsigned long> atomic_unsigned_type; + typedef unsigned long atomic_unsigned_type; + typedef long atomic_integer_type; +-#elif ATOMIC_LLONG_LOCK_FREE == 2 ++#elif (ATOMIC_LLONG_LOCK_FREE == 2) && !defined(BOOST_MATH_NO_ATOMIC_INT) + typedef std::atomic<long long> atomic_unsigned_integer_type; + typedef std::atomic<unsigned long long> atomic_unsigned_type; + typedef long long atomic_integer_type; + typedef unsigned long long atomic_unsigned_integer_type; +-#else ++#elif !defined(BOOST_MATH_NO_ATOMIC_INT) + # define BOOST_MATH_NO_ATOMIC_INT + #endif + } // Namespace detail diff --git a/poky/meta/recipes-support/boost/boost/0003-math-make-no-atomics-a-soft-failure-in-bernoulli_details_hpp.patch b/poky/meta/recipes-support/boost/boost/0003-math-make-no-atomics-a-soft-failure-in-bernoulli_details_hpp.patch new file mode 100644 index 0000000000..f69e4f21f3 --- /dev/null +++ b/poky/meta/recipes-support/boost/boost/0003-math-make-no-atomics-a-soft-failure-in-bernoulli_details_hpp.patch @@ -0,0 +1,151 @@ +From 7d482f6ebc356e6ec455ccb5f51a23971bf6ce5b Mon Sep 17 00:00:00 2001 +From: jzmaddock <john@johnmaddock.co.uk> +Date: Wed, 1 Sep 2021 20:31:53 +0100 +Subject: [PATCH] Make no atomics a soft failure in bernoulli_details.hpp. + Include an "escape macro" so thread safety can be disabled if certain + bernoulli features are to be used in a no-atomics environment. Fixes + https://github.com/boostorg/math/issues/673. + +[buildroot@heine.tech: + - backport from boostorg/math 7d482f6ebc356e6ec455ccb5f51a23971bf6ce5b + - alter path to match boost release +] +Signed-off-by: Michael Nosthoff <buildroot@heine.tech> +--- +Upstream-Status: Backport [https://github.com/boostorg/math/pull/684/commits/7d482f6ebc356e6ec455ccb5f51a23971bf6ce5b] + .../detail/bernoulli_details.hpp | 10 +++++++--- + libs/math/test/Jamfile.v2 | 3 +++ + test/compile_test/bernoulli_no_atomic_d.cpp | 14 ++++++++++++++ + test/compile_test/bernoulli_no_atomic_fail.cpp | 15 +++++++++++++++ + test/compile_test/bernoulli_no_atomic_mp.cpp | 16 ++++++++++++++++ + 5 files changed, 55 insertions(+), 3 deletions(-) + create mode 100644 test/compile_test/bernoulli_no_atomic_d.cpp + create mode 100644 test/compile_test/bernoulli_no_atomic_fail.cpp + create mode 100644 test/compile_test/bernoulli_no_atomic_mp.cpp + +diff --git a/boost/math/special_functions/detail/bernoulli_details.hpp b/boost/math/special_functions/detail/bernoulli_details.hpp +index cf35545264..8519b7c89c 100644 +--- a/boost/math/special_functions/detail/bernoulli_details.hpp ++++ b/boost/math/special_functions/detail/bernoulli_details.hpp +@@ -360,7 +360,7 @@ class bernoulli_numbers_cache + return out; + } + +- #ifndef BOOST_HAS_THREADS ++ #if !defined(BOOST_HAS_THREADS) || defined(BOOST_MATH_BERNOULLI_UNTHREADED) + // + // Single threaded code, very simple: + // +@@ -382,6 +382,8 @@ class bernoulli_numbers_cache + *out = (i >= m_overflow_limit) ? policies::raise_overflow_error<T>("boost::math::bernoulli_b2n<%1%>(std::size_t)", 0, T(i), pol) : bn[i]; + ++out; + } ++ #elif defined(BOOST_MATH_NO_ATOMIC_INT) ++ static_assert(sizeof(T) == 1, "Unsupported configuration: your platform appears to have no atomic integers. If you are happy with thread-unsafe code, then you may define BOOST_MATH_BERNOULLI_UNTHREADED to suppress this error."); + #else + // + // Double-checked locking pattern, lets us access cached already cached values +@@ -464,7 +466,7 @@ class bernoulli_numbers_cache + return out; + } + +- #ifndef BOOST_HAS_THREADS ++ #if !defined(BOOST_HAS_THREADS) || defined(BOOST_MATH_BERNOULLI_UNTHREADED) + // + // Single threaded code, very simple: + // +@@ -494,6 +496,8 @@ class bernoulli_numbers_cache + } + ++out; + } ++ #elif defined(BOOST_MATH_NO_ATOMIC_INT) ++ static_assert(sizeof(T) == 1, "Unsupported configuration: your platform appears to have no atomic integers. If you are happy with thread-unsafe code, then you may define BOOST_MATH_BERNOULLI_UNTHREADED to suppress this error."); + #else + // + // Double-checked locking pattern, lets us access cached already cached values +@@ -555,7 +559,7 @@ class bernoulli_numbers_cache + // The value at which we know overflow has already occurred for the Bn: + std::size_t m_overflow_limit; + +- #ifdef BOOST_HAS_THREADS ++ #if defined(BOOST_HAS_THREADS) && !defined(BOOST_MATH_NO_ATOMIC_INT) + std::mutex m_mutex; + atomic_counter_type m_counter, m_current_precision; + #else +diff --git a/libs/math/test/Jamfile.v2 b/libs/math/test/Jamfile.v2 +index 52fb87f5e5..3ac63f9279 100644 +--- a/libs/math/test/Jamfile.v2 ++++ b/libs/math/test/Jamfile.v2 +@@ -1137,6 +1137,9 @@ test-suite misc : + + # [ run __temporary_test.cpp test_instances//test_instances : : : <test-info>always_show_run_output <pch>off ] + [ compile test_no_long_double_policy.cpp ] ++ [ compile compile_test/bernoulli_no_atomic_d.cpp ] ++ [ compile compile_test/bernoulli_no_atomic_mp.cpp ] ++ [ compile-fail compile_test/bernoulli_no_atomic_fail.cpp ] + ; + + test-suite interpolators : +diff --git a/test/compile_test/bernoulli_no_atomic_d.cpp b/test/compile_test/bernoulli_no_atomic_d.cpp +new file mode 100644 +index 0000000000..61926f7e1f +--- /dev/null ++++ b/test/compile_test/bernoulli_no_atomic_d.cpp +@@ -0,0 +1,14 @@ ++// (C) Copyright John Maddock 2021. ++// Use, modification and distribution are subject to the ++// Boost Software License, Version 1.0. (See accompanying file ++// LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt) ++ ++#define BOOST_MATH_NO_ATOMIC_INT ++ ++#include <boost/math/special_functions/bernoulli.hpp> ++#include "test_compile_result.hpp" ++ ++void compile_and_link_test() ++{ ++ check_result<double>(boost::math::bernoulli_b2n<double>(4)); ++} +diff --git a/test/compile_test/bernoulli_no_atomic_fail.cpp b/test/compile_test/bernoulli_no_atomic_fail.cpp +new file mode 100644 +index 0000000000..bbd7152412 +--- /dev/null ++++ b/test/compile_test/bernoulli_no_atomic_fail.cpp +@@ -0,0 +1,15 @@ ++// (C) Copyright John Maddock 2021. ++// Use, modification and distribution are subject to the ++// Boost Software License, Version 1.0. (See accompanying file ++// LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt) ++ ++#define BOOST_MATH_NO_ATOMIC_INT ++ ++#include <boost/math/special_functions/bernoulli.hpp> ++#include <boost/multiprecision/cpp_bin_float.hpp> ++#include "test_compile_result.hpp" ++ ++void compile_and_link_test() ++{ ++ check_result<boost::multiprecision::cpp_bin_float_50>(boost::math::bernoulli_b2n<boost::multiprecision::cpp_bin_float_50>(4)); ++} +diff --git a/test/compile_test/bernoulli_no_atomic_mp.cpp b/test/compile_test/bernoulli_no_atomic_mp.cpp +new file mode 100644 +index 0000000000..8d5a6e78e6 +--- /dev/null ++++ b/test/compile_test/bernoulli_no_atomic_mp.cpp +@@ -0,0 +1,16 @@ ++// (C) Copyright John Maddock 2021. ++// Use, modification and distribution are subject to the ++// Boost Software License, Version 1.0. (See accompanying file ++// LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt) ++ ++#define BOOST_MATH_NO_ATOMIC_INT ++#define BOOST_MATH_BERNOULLI_UNTHREADED ++ ++#include <boost/math/special_functions/bernoulli.hpp> ++#include <boost/multiprecision/cpp_bin_float.hpp> ++#include "test_compile_result.hpp" ++ ++void compile_and_link_test() ++{ ++ check_result<boost::multiprecision::cpp_bin_float_50>(boost::math::bernoulli_b2n<boost::multiprecision::cpp_bin_float_50>(4)); ++} diff --git a/poky/meta/recipes-support/boost/boost_1.77.0.bb b/poky/meta/recipes-support/boost/boost_1.77.0.bb index df8e08ad76..bde6b14a79 100644 --- a/poky/meta/recipes-support/boost/boost_1.77.0.bb +++ b/poky/meta/recipes-support/boost/boost_1.77.0.bb @@ -6,4 +6,7 @@ SRC_URI += "file://boost-CVE-2012-2677.patch \ file://0001-Don-t-set-up-arch-instruction-set-flags-we-do-that-o.patch \ file://0001-dont-setup-compiler-flags-m32-m64.patch \ file://0001-fiber-libs-Define-SYS_futex-if-it-does-not-exist.patch \ + file://0001-BoostConfig.cmake-allow-searching-for-python310.patch \ + file://0002-math-allow-definition-of-boost_math_no_atomic_int-on-the-command-line.patch \ + file://0003-math-make-no-atomics-a-soft-failure-in-bernoulli_details_hpp.patch \ " diff --git a/poky/meta/recipes-support/gmp/gmp/cve-2021-43618.patch b/poky/meta/recipes-support/gmp/gmp/cve-2021-43618.patch new file mode 100644 index 0000000000..095fb21eaa --- /dev/null +++ b/poky/meta/recipes-support/gmp/gmp/cve-2021-43618.patch @@ -0,0 +1,27 @@ +CVE: CVE-2021-43618 +Upstream-Status: Backport +Signed-off-by: Ross Burton <ross.burton@arm.com> + +# HG changeset patch +# User Marco Bodrato <bodrato@mail.dm.unipi.it> +# Date 1634836009 -7200 +# Node ID 561a9c25298e17bb01896801ff353546c6923dbd +# Parent e1fd9db13b475209a864577237ea4b9105b3e96e +mpz/inp_raw.c: Avoid bit size overflows + +diff -r e1fd9db13b47 -r 561a9c25298e mpz/inp_raw.c +--- a/mpz/inp_raw.c Tue Dec 22 23:49:51 2020 +0100 ++++ b/mpz/inp_raw.c Thu Oct 21 19:06:49 2021 +0200 +@@ -88,8 +88,11 @@ + + abs_csize = ABS (csize); + ++ if (UNLIKELY (abs_csize > ~(mp_bitcnt_t) 0 / 8)) ++ return 0; /* Bit size overflows */ ++ + /* round up to a multiple of limbs */ +- abs_xsize = BITS_TO_LIMBS (abs_csize*8); ++ abs_xsize = BITS_TO_LIMBS ((mp_bitcnt_t) abs_csize * 8); + + if (abs_xsize != 0) + { diff --git a/poky/meta/recipes-support/gmp/gmp_6.2.1.bb b/poky/meta/recipes-support/gmp/gmp_6.2.1.bb index d5996abd00..e61582afdf 100644 --- a/poky/meta/recipes-support/gmp/gmp_6.2.1.bb +++ b/poky/meta/recipes-support/gmp/gmp_6.2.1.bb @@ -12,6 +12,7 @@ SRC_URI = "https://gmplib.org/download/${BPN}/${BP}${REVISION}.tar.bz2 \ file://use-includedir.patch \ file://0001-Append-the-user-provided-flags-to-the-auto-detected-.patch \ file://0001-confiure.ac-Believe-the-cflags-from-environment.patch \ + file://cve-2021-43618.patch \ " SRC_URI[md5sum] = "28971fc21cf028042d4897f02fd355ea" SRC_URI[sha256sum] = "eae9326beb4158c386e39a356818031bd28f3124cf915f8c5b1dc4c7a36b4d7c" diff --git a/poky/meta/recipes-support/vim/files/0001-patch-8.2.3581-reading-character-past-end-of-line.patch b/poky/meta/recipes-support/vim/files/0001-patch-8.2.3581-reading-character-past-end-of-line.patch new file mode 100644 index 0000000000..28c61cd782 --- /dev/null +++ b/poky/meta/recipes-support/vim/files/0001-patch-8.2.3581-reading-character-past-end-of-line.patch @@ -0,0 +1,62 @@ +CVE: CVE-2021-3927 +Upstream-Status: Backport +Signed-off-by: Ross Burton <ross.burton@arm.com> + +From 93b427c6e729260d0700c3b2804ec153bc8284fa Mon Sep 17 00:00:00 2001 +From: Bram Moolenaar <Bram@vim.org> +Date: Thu, 4 Nov 2021 15:10:11 +0000 +Subject: [PATCH] patch 8.2.3581: reading character past end of line + +Problem: Reading character past end of line. +Solution: Correct the cursor column. +--- + src/ex_docmd.c | 1 + + src/testdir/test_put.vim | 12 ++++++++++++ + src/version.c | 2 ++ + 3 files changed, 15 insertions(+) + +diff --git a/src/ex_docmd.c b/src/ex_docmd.c +index fde726477..59e245bee 100644 +--- a/src/ex_docmd.c ++++ b/src/ex_docmd.c +@@ -6905,6 +6905,7 @@ ex_put(exarg_T *eap) + eap->forceit = TRUE; + } + curwin->w_cursor.lnum = eap->line2; ++ check_cursor_col(); + do_put(eap->regname, eap->forceit ? BACKWARD : FORWARD, 1L, + PUT_LINE|PUT_CURSLINE); + } +diff --git a/src/testdir/test_put.vim b/src/testdir/test_put.vim +index 225ebd1f3..922e5b269 100644 +--- a/src/testdir/test_put.vim ++++ b/src/testdir/test_put.vim +@@ -113,3 +113,15 @@ func Test_put_p_indent_visual() + call assert_equal('select that text', getline(2)) + bwipe! + endfunc ++ ++func Test_put_above_first_line() ++ new ++ let @" = 'text' ++ silent! normal 0o00 ++ 0put ++ call assert_equal('text', getline(1)) ++ bwipe! ++endfunc ++ ++ ++" vim: shiftwidth=2 sts=2 expandtab +diff --git a/src/version.c b/src/version.c +index a9e8be0e7..df4ec9a47 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -742,6 +742,8 @@ static char *(features[]) = + + static int included_patches[] = + { /* Add new patch number below this line */ ++/**/ ++ 3581, + /**/ + 3564, + /**/ diff --git a/poky/meta/recipes-support/vim/files/0002-patch-8.2.3582-reading-uninitialized-memory-when-giv.patch b/poky/meta/recipes-support/vim/files/0002-patch-8.2.3582-reading-uninitialized-memory-when-giv.patch new file mode 100644 index 0000000000..d117a98893 --- /dev/null +++ b/poky/meta/recipes-support/vim/files/0002-patch-8.2.3582-reading-uninitialized-memory-when-giv.patch @@ -0,0 +1,63 @@ +CVE: CVE-2021-3928 +Upstream-Status: Backport +Signed-off-by: Ross Burton <ross.burton@arm.com> + +From ade0f0481969f1453c60e7c8354b00dfe4238739 Mon Sep 17 00:00:00 2001 +From: Bram Moolenaar <Bram@vim.org> +Date: Thu, 4 Nov 2021 15:46:05 +0000 +Subject: [PATCH] patch 8.2.3582: reading uninitialized memory when giving + spell suggestions + +Problem: Reading uninitialized memory when giving spell suggestions. +Solution: Check that preword is not empty. +--- + src/spellsuggest.c | 2 +- + src/testdir/test_spell.vim | 8 ++++++++ + src/version.c | 2 ++ + 3 files changed, 11 insertions(+), 1 deletion(-) + +diff --git a/src/spellsuggest.c b/src/spellsuggest.c +index 9d6df7930..8615d5280 100644 +--- a/src/spellsuggest.c ++++ b/src/spellsuggest.c +@@ -1600,7 +1600,7 @@ suggest_trie_walk( + // char, e.g., "thes," -> "these". + p = fword + sp->ts_fidx; + MB_PTR_BACK(fword, p); +- if (!spell_iswordp(p, curwin)) ++ if (!spell_iswordp(p, curwin) && *preword != NUL) + { + p = preword + STRLEN(preword); + MB_PTR_BACK(preword, p); +diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim +index 79fb8927c..e435e9172 100644 +--- a/src/testdir/test_spell.vim ++++ b/src/testdir/test_spell.vim +@@ -498,6 +498,14 @@ func Test_spell_screendump() + call delete('XtestSpell') + endfunc + ++func Test_spell_single_word() ++ new ++ silent! norm 0R00 ++ spell! ß ++ silent 0norm 0r$ Dvz= ++ bwipe! ++endfunc ++ + let g:test_data_aff1 = [ + \"SET ISO8859-1", + \"TRY esianrtolcdugmphbyfvkwjkqxz-\xEB\xE9\xE8\xEA\xEF\xEE\xE4\xE0\xE2\xF6\xFC\xFB'ESIANRTOLCDUGMPHBYFVKWJKQXZ", +diff --git a/src/version.c b/src/version.c +index df4ec9a47..e1bc0d09b 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -742,6 +742,8 @@ static char *(features[]) = + + static int included_patches[] = + { /* Add new patch number below this line */ ++/**/ ++ 3582, + /**/ + 3581, + /**/ diff --git a/poky/meta/recipes-support/vim/files/0002-patch-8.2.3611-crash-when-using-CTRL-W-f-without-fin.patch b/poky/meta/recipes-support/vim/files/0002-patch-8.2.3611-crash-when-using-CTRL-W-f-without-fin.patch new file mode 100644 index 0000000000..58d3442677 --- /dev/null +++ b/poky/meta/recipes-support/vim/files/0002-patch-8.2.3611-crash-when-using-CTRL-W-f-without-fin.patch @@ -0,0 +1,92 @@ +CVE: CVE-2021-3973 +Upstream-Status: Backport +Signed-off-by: Ross Burton <ross.burton@arm.com> + +From b6154e9f530544ddc3130d981caae0dabc053757 Mon Sep 17 00:00:00 2001 +From: Bram Moolenaar <Bram@vim.org> +Date: Wed, 17 Nov 2021 18:00:31 +0000 +Subject: [PATCH] patch 8.2.3611: crash when using CTRL-W f without finding a + file name Problem: Crash when using CTRL-W f without finding + a file name. Solution: Bail out when the file name length is zero. + +--- + src/findfile.c | 8 ++++++++ + src/normal.c | 6 ++++-- + src/testdir/test_visual.vim | 8 ++++++++ + src/version.c | 2 ++ + 4 files changed, 22 insertions(+), 2 deletions(-) + +diff --git a/src/findfile.c b/src/findfile.c +index dba547da1..5764fd7b8 100644 +--- a/src/findfile.c ++++ b/src/findfile.c +@@ -1727,6 +1727,9 @@ find_file_in_path_option( + proc->pr_WindowPtr = (APTR)-1L; + # endif + ++ if (len == 0) ++ return NULL; ++ + if (first == TRUE) + { + // copy file name into NameBuff, expanding environment variables +@@ -2094,7 +2097,12 @@ find_file_name_in_path( + int c; + # if defined(FEAT_FIND_ID) && defined(FEAT_EVAL) + char_u *tofree = NULL; ++# endif + ++ if (len == 0) ++ return NULL; ++ ++# if defined(FEAT_FIND_ID) && defined(FEAT_EVAL) + if ((options & FNAME_INCL) && *curbuf->b_p_inex != NUL) + { + tofree = eval_includeexpr(ptr, len); +diff --git a/src/normal.c b/src/normal.c +index 7cb959257..f0084f2ac 100644 +--- a/src/normal.c ++++ b/src/normal.c +@@ -3778,8 +3778,10 @@ get_visual_text( + *pp = ml_get_pos(&VIsual); + *lenp = curwin->w_cursor.col - VIsual.col + 1; + } +- if (has_mbyte) +- // Correct the length to include the whole last character. ++ if (**pp == NUL) ++ *lenp = 0; ++ if (has_mbyte && *lenp > 0) ++ // Correct the length to include all bytes of the last character. + *lenp += (*mb_ptr2len)(*pp + (*lenp - 1)) - 1; + } + reset_VIsual_and_resel(); +diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim +index ae281238e..0705fdb57 100644 +--- a/src/testdir/test_visual.vim ++++ b/src/testdir/test_visual.vim +@@ -894,4 +894,12 @@ func Test_block_insert_replace_tabs() + bwipe! + endfunc + ++func Test_visual_block_ctrl_w_f() ++ " Emtpy block selected in new buffer should not result in an error. ++ au! BufNew foo sil norm f ++ edit foo ++ ++ au! BufNew ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab +diff --git a/src/version.c b/src/version.c +index 52be3c39d..59a314b3a 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -742,6 +742,8 @@ static char *(features[]) = + + static int included_patches[] = + { /* Add new patch number below this line */ ++/**/ ++ 3611, + /**/ + 3582, + /**/ diff --git a/poky/meta/recipes-support/vim/vim.inc b/poky/meta/recipes-support/vim/vim.inc index 943856e07c..6cdf157cb6 100644 --- a/poky/meta/recipes-support/vim/vim.inc +++ b/poky/meta/recipes-support/vim/vim.inc @@ -23,6 +23,9 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \ file://0003-patch-8.2.3487-illegal-memory-access-if-buffer-name-.patch \ file://0004-patch-8.2.3489-ml_get-error-after-search-with-range.patch \ file://0005-patch-8.2.3564-invalid-memory-access-when-scrolling-.patch \ + file://0001-patch-8.2.3581-reading-character-past-end-of-line.patch \ + file://0002-patch-8.2.3582-reading-uninitialized-memory-when-giv.patch \ + file://0002-patch-8.2.3611-crash-when-using-CTRL-W-f-without-fin.patch \ " SRCREV = "98056533b96b6b5d8849641de93185dd7bcadc44" @@ -30,6 +33,9 @@ SRCREV = "98056533b96b6b5d8849641de93185dd7bcadc44" # Do not consider .z in x.y.z, as that is updated with every commit UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>\d+\.\d+)\.0" +# CVE-2021-3968 is related to an issue which was introduced after 8.2, this can be removed after 8.3. +CVE_CHECK_WHITELIST += "CVE-2021-3968" + S = "${WORKDIR}/git" VIMDIR = "vim${@d.getVar('PV').split('.')[0]}${@d.getVar('PV').split('.')[1]}" |