From 91128d04d1e00553983c716843abe14747e5f6bf Mon Sep 17 00:00:00 2001
From: pkgagent <pkgagent@tencent.com>
Date: Fri, 28 Aug 2026 12:24:46 +0800
Subject: [PATCH] =?UTF-8?q?Fix=20CVE-2026-73073:=20arbitrary=20Ex=20comman?=
 =?UTF-8?q?d=20execution=20via=20unescaped=20typeref/typename=20during=20C?=
 =?UTF-8?q?=20omni-com=E2=80=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 vim-9.0.2092-CVE-2026-73073.patch | 47 +++++++++++++++++++++++++++++++
 vim.spec                          |  8 +++++-
 2 files changed, 54 insertions(+), 1 deletion(-)
 create mode 100644 vim-9.0.2092-CVE-2026-73073.patch

diff --git a/vim-9.0.2092-CVE-2026-73073.patch b/vim-9.0.2092-CVE-2026-73073.patch
new file mode 100644
index 0000000..f9ea136
--- /dev/null
+++ b/vim-9.0.2092-CVE-2026-73073.patch
@@ -0,0 +1,47 @@
+From 2f628d8104958fa7421664f792ca6d4f7a39a10f Mon Sep 17 00:00:00 2001
+From: Yasuhiro Matsumoto <mattn.jp@gmail.com>
+Date: Fri, 17 Jul 2026 09:11:42 +0900
+Subject: [PATCH] patch 9.2.0845: [security]: arbitrary Ex command execution
+ during C omni-completion
+
+Problem:  [security]: arbitrary Ex command execution during C
+          omni-completion (Threonine)
+Solution: Match tags typeref literally to block Ex command injection
+          (Yasuhiro Matsumoto).
+
+Escaping only "/" and "\" left the typeref able to break out of the
+:vimgrep pattern without a "/": an unclosed "[" makes vimgrep's pattern
+skipping fail, and the parser then treats a following "|" as a command
+separator, so the tag value runs as Ex commands during C omni-completion.
+Match the field literally with \V so no regex metacharacter can affect
+pattern parsing.
+
+Github Security Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-cx73-phcg-3j5g
+
+Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+
+Adapted-by: PkgAgent/deepseek-v4 (modified to adapt to opencloudos-stream)
+
+---
+ runtime/autoload/ccomplete.vim |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/runtime/autoload/ccomplete.vim b/runtime/autoload/ccomplete.vim
+index 7096dcf..80e4f13 100644
+--- a/runtime/autoload/ccomplete.vim
++++ b/runtime/autoload/ccomplete.vim
+@@ -559,8 +559,11 @@ def StructMembers( # {{{1
+   endif
+   if !cached
+     while 1
++      # Match "typename" literally (\V): escaping alone is not enough, as e.g.
++      # an unclosed "[" makes vimgrep's pattern skipping fail and the rest of
++      # the tag value is then parsed as Ex commands.
+       execute 'silent! keepjumps noautocmd '
+-        .. n .. 'vimgrep ' .. '/\t' .. typename .. '\(\t\|$\)/j '
++        .. n .. 'vimgrep ' .. '/\t\V' .. escape(typename, '/\') .. '\m\(\t\|$\)/j '
+         .. fnames
+ 
+       qflist = getqflist()
diff --git a/vim.spec b/vim.spec
index d8c3ebe..330949d 100644
--- a/vim.spec
+++ b/vim.spec
@@ -28,7 +28,7 @@ Summary:  The VIM editor
 URL:      http://www.vim.org/
 Name:     vim
 Version:  9.0.2092
-Release:  23%{?dist}
+Release:  24%{?dist}
 License:  Vim and MIT and GPL v2+
 Source0:  https://github.com/vim/vim/archive/refs/tags/v%{version}.tar.gz
 Source1:  virc
@@ -128,6 +128,8 @@ Patch0046: vim-9.0.2092-CVE-2026-73074.patch
 Patch0047: vim-9.0.2092-CVE-2026-73071.patch
 # CVE-2026-73072
 Patch0048: vim-9.0.2092-CVE-2026-73072.patch
+# CVE-2026-73073
+Patch0049: vim-9.0.2092-CVE-2026-73073.patch
 
 Patch3000: vim-7.3-manpage-typo-668894-675480.patch
 Patch3001: vim-manpagefixes-948566.patch
@@ -929,6 +931,10 @@ LC_ALL=en_US.UTF-8  make test || echo "Warning: tests have failure."
 
 
 %changelog
+* Fri Aug 28 2026 PkgAgent Robot <pkgagent@opencloudos.tech> - 9.0.2092-24
+- [Type] security
+- [DESC] Fix CVE-2026-73073: arbitrary Ex command execution via unescaped typeref/typename during C omni-completion
+
 * Fri Aug 21 2026 PkgAgent Robot <pkgagent@opencloudos.tech> - 9.0.2092-23
 - [Type] security
 - [DESC] Fix CVE-2026-43961, CVE-2026-73074, CVE-2026-73071, CVE-2026-73072
-- 
Gitee