Package: vim Version: 2:9.1.1230-2 Severity: normal X-Debbugs-Cc: [email protected]
Hi James, while working on the fix for CVE-2026-52859 for trixie I noticed that the test that patch adds also passes on an unfixed vim: the out-of-bounds read lands in adjacent struct memory, so on a normal build the output is unchanged. It only fails on an instrumented build (I verified the unfixed read with valgrind; upstream's CI catches it in their ASAN+UBSAN job, which is what these regression tests are really written for). Skimming other security fixes, several of their tests have the same property: they trigger the buggy code path but can only fail under a sanitizer. On our plain builds they're effectively no-ops as regression tests, both at build time and in autopkgtest. My current thinking is an autopkgtest with @builddeps@ that builds vim with -fsanitize=address,undefined from the packaged source and runs (a subset of) the test suite against that binary. What's your opinion? Greets, Lee -- Package-specific info: --- real paths of main Vim binaries --- /usr/bin/vi is /usr/bin/vim.basic /usr/bin/vim is /usr/bin/vim.basic -- System Information: Debian Release: 13.6 APT prefers stable-updates APT policy: (990, 'stable-updates'), (990, 'stable-security'), (990, 'proposed-updates'), (990, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 6.12.94+deb13-amd64 (SMP w/8 CPU threads; PREEMPT) Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages vim depends on: ii libacl1 2.3.2-2+b1 ii libc6 2.41-12+deb13u3 ii libgpm2 1.20.7-11+b2 ii libselinux1 3.8.1-1 ii libsodium23 1.0.18-1+deb13u1 ii libtinfo6 6.5+20250216-2 ii vim-common 2:9.1.1230-2 ii vim-runtime 2:9.1.1230-2 vim recommends no packages. Versions of packages vim suggests: ii exuberant-ctags [ctags] 1:5.9~svn20110310-19 ii universal-ctags [ctags] 5.9.20210829.0-2 ii vim-doc 2:9.1.1230-2 pn vim-scripts <none> -- no debconf information
