Import Debian changes 2:8.2.3995-1ubuntu2.19

vim (2:8.2.3995-1ubuntu2.19) jammy-security; urgency=medium

  * SECURITY UPDATE: buffer overflow
    - debian/patches/CVE-2024-43802.patch: check buflen before advancing
      offset.
    - CVE-2024-43802

debian/changelog

@@ -1,3 +1,12 @@
+vim (2:8.2.3995-1ubuntu2.19) jammy-security; urgency=medium
+
+  * SECURITY UPDATE: buffer overflow
+    - debian/patches/CVE-2024-43802.patch: check buflen before advancing
+      offset.
+    - CVE-2024-43802
+
+ -- Vyom Yadav <vyom.yadav@canonical.com>  Wed, 25 Sep 2024 11:00:01 +0530
+
 vim (2:8.2.3995-1ubuntu2.18) jammy-security; urgency=medium
 
   * SECURITY UPDATE: use after free

debian/patches/CVE-2024-43802.patch

@@ -0,0 +1,35 @@
+Description: heap-buffer-overflow in ins_typebuf
+ Problem:  heap-buffer-overflow in ins_typebuf
+           (SuyueGuo)
+ Solution: When flushing the typeahead buffer, validate that there
+           is enough space left
+Author: Christian Brabandt <cb@256bit.org>
+Origin: upstream, https://github.com/vim/vim/commit/322ba9108612bead5eb
+---
+
+Index: vim-8.2.3995/src/getchar.c
+===================================================================
+--- vim-8.2.3995.orig/src/getchar.c
++++ vim-8.2.3995/src/getchar.c
+@@ -432,9 +432,18 @@ flush_buffers(flush_buffers_T flush_type
+
+     if (flush_typeahead == FLUSH_MINIMAL)
+     {
+-	// remove mapped characters at the start only
+-	typebuf.tb_off += typebuf.tb_maplen;
+-	typebuf.tb_len -= typebuf.tb_maplen;
++	// remove mapped characters at the start only,
++	// but only when enough space left in typebuf
++	if (typebuf.tb_off + typebuf.tb_maplen >= typebuf.tb_buflen)
++	{
++	    typebuf.tb_off = MAXMAPLEN;
++	    typebuf.tb_len = 0;
++	}
++	else
++	{
++	    typebuf.tb_off += typebuf.tb_maplen;
++	    typebuf.tb_len -= typebuf.tb_maplen;
++	}
+ #if defined(FEAT_CLIENTSERVER) || defined(FEAT_EVAL)
+ 	if (typebuf.tb_len == 0)
+ 	    typebuf_was_filled = FALSE;

debian/patches/series

@@ -158,3 +158,4 @@ remove-flaky-matchfuzzy-test.patch
 ubuntu-codenames.patch
 CVE-2024-41957.patch
 CVE-2024-43374.patch
+CVE-2024-43802.patch