Patched `vim` for CVE-2023-5344 (#6372) (#6377)

Co-authored-by: Mitch Zhu <mitchzhu@microsoft.com>

SPECS/vim/CVE-2023-5344.patch

@@ -0,0 +1,51 @@
+From 0e4c8fad86f128cefaa8f74b1322c29a8bb62c46 Mon Sep 17 00:00:00 2001
+From: Mitch Zhu <zhumc11@gmail.com>
+Date: Mon, 9 Oct 2023 13:26:04 -0700
+Subject: [PATCH] patch 9.0.1897: [security] buffer-overflow in trunc_string()
+
+---
+ src/message.c              | 2 +-
+ src/testdir/test_crash.vim | 7 +++++++
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/src/message.c b/src/message.c
+index 98a3624..72bba11 100644
+--- a/src/message.c
++++ b/src/message.c
+@@ -353,7 +353,7 @@ trunc_string(
+     else
+     {
+ 	// can't fit in the "...", just truncate it
+-	buf[e - 1] = NUL;
++	buf[buflen - 1] = NUL;
+     }
+ }
+ 
+diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim
+index a1da68e..5c83e3a 100644
+--- a/src/testdir/test_crash.vim
++++ b/src/testdir/test_crash.vim
+@@ -66,6 +66,12 @@ func Test_crash1()
+     \ '  && echo "crash 7: [OK]" >> X_crash1_result.txt' .. "\<cr>")
+   call TermWait(buf, 3000)
+ 
++  let file = 'crash/vim_msg_trunc_poc'
++  let args = printf(cmn_args, vim, file)
++  call term_sendkeys(buf, args ..
++    \ '  || echo "crash 8: [OK]" >> X_crash1_result.txt' .. "\<cr>")
++  call TermWait(buf, 3000)
++
+   " clean up
+   exe buf .. "bw!"
+ 
+@@ -79,6 +85,7 @@ func Test_crash1()
+       \ 'crash 5: [OK]',
+       \ 'crash 6: [OK]',
+       \ 'crash 7: [OK]',
++      \ 'crash 8: [OK]',
+       \ ]
+ 
+   call assert_equal(expected, getline(1, '$'))
+-- 
+2.34.1
+

SPECS/vim/vim.spec

@@ -2,13 +2,14 @@
 Summary:        Text editor
 Name:           vim
 Version:        9.0.1897
-Release:        1%{?dist}
+Release:        2%{?dist}
 License:        Vim
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
 Group:          Applications/Editors
 URL:            https://www.vim.org
 Source0:        https://github.com/%{name}/%{name}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
+Patch0:         CVE-2023-5344.patch
 BuildRequires:  ncurses-devel
 BuildRequires:  python3-devel
 Requires(post): sed
@@ -197,6 +198,9 @@ fi
 %{_bindir}/vimdiff
 
 %changelog
+* Mon Oct 09 2023 Mitch Zhu <mitchzhu@microsoft.com> - 9.0.1897-2
+- Patch CVE-2023-5344
+
 * Tue Sep 12 2023 Henry Li <lihl@microsoft.com> - 9.0.1897-1
 - Upgrade version to resolve CVE-2023-4738, CVE-2023-4750, CVE-2023-4781,
   CVE-2023-4752 and CVE-2023-4733