CVE-2022-3153: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-09-08T15:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/testdir/test_assert.vim, src/testing.c, src/version.c
Commit date: 2022-09-07 15:20:26 +0100
Commit message: patch 9.0.0404: crash when passing invalid arguments to assert_fails()

Problem:    Crash when passing invalid arguments to assert_fails().
Solution:   Check for NULL string.

Diff: diff --git a/src/testdir/test_assert.vim b/src/testdir/test_assert.vim
index 01e7718bb6c5..5d4abaa8a981 100644
--- a/src/testdir/test_assert.vim
+++ b/src/testdir/test_assert.vim
@@ -273,10 +273,25 @@ func Test_assert_fail_fails()
   catch
     let exp = v:exception
   endtry
   call assert_match("E1222: String or List required for argument 2", exp)
 
+  try
+    call assert_equal(0, assert_fails('xxx', [#{one: 1}]))
+  catch
+    let exp = v:exception
+  endtry
+  call assert_match("E731: Using a Dictionary as a String", exp)
+
+  let exp = ''
+  try
+    call assert_equal(0, assert_fails('xxx', ['E492', #{one: 1}]))
+  catch
+    let exp = v:exception
+  endtry
+  call assert_match("E731: Using a Dictionary as a String", exp)
+
   try
     call assert_equal(1, assert_fails('xxx', 'E492', '', 'burp'))
   catch
     let exp = v:exception
   endtry
@@ -287,12 +302,12 @@ func Test_assert_fail_fails()
   catch
     let exp = v:exception
   endtry
   call assert_match("E1174: String required for argument 5", exp)
 
-  call assert_equal(1, assert_fails('c0', ['', '\1']))
-  call assert_match("Expected '\\\\\\\\1' but got 'E939: Positive count required: c0': c0", v:errors[0])
+  call assert_equal(1, assert_fails('c0', ['', '\(.\)\1']))
+  call assert_match("Expected '\\\\\\\\(.\\\\\\\\)\\\\\\\\1' but got 'E939: Positive count required: c0': c0", v:errors[0])
   call remove(v:errors, 0)
 endfunc
 
 func Test_assert_fails_in_try_block()
   try
diff --git a/src/testing.c b/src/testing.c
index 8c682cf6bce1..fb5c9ab4cc49 100644
--- a/src/testing.c
+++ b/src/testing.c
@@ -614,10 +614,15 @@ f_assert_fails(typval_T *argvars, typval_T *rettv)
     trylevel = 0;
     suppress_errthrow = TRUE;
     in_assert_fails = TRUE;
 
     do_cmdline_cmd(cmd);
+
+    // reset here for any errors reported below
+    trylevel = save_trylevel;
+    suppress_errthrow = FALSE;
+
     if (called_emsg == called_emsg_before)
     {
 	prepare_assert_error(&ga);
 	ga_concat(&ga, (char_u *)"command did not fail: ");
 	assert_append_cmd_or_arg(&ga, argvars, cmd);
@@ -652,10 +657,12 @@ f_assert_fails(typval_T *argvars, typval_T *rettv)
 		goto theend;
 	    }
 	    CHECK_LIST_MATERIALIZE(list);
 	    tv = &list->lv_first->li_tv;
 	    expected = tv_get_string_buf_chk(tv, buf);
+	    if (expected == NULL)
+		goto theend;
 	    if (!pattern_match(expected, actual, FALSE))
 	    {
 		error_found = TRUE;
 		expected_str = expected;
 	    }
@@ -665,10 +672,12 @@ f_assert_fails(typval_T *argvars, typval_T *rettv)
 		tofree = actual = vim_strsave(get_vim_var_str(VV_ERRMSG));
 		if (actual != NULL)
 		{
 		    tv = &list->lv_u.mat.lv_last->li_tv;
 		    expected = tv_get_string_buf_chk(tv, buf);
+		    if (expected == NULL)
+			goto theend;
 		    if (!pattern_match(expected, actual, FALSE))
 		    {
 			error_found = TRUE;
 			expected_str = expected;
 		    }
diff --git a/src/version.c b/src/version.c
index db1a1dec54ad..36ce07ef9cc8 100644
--- a/src/version.c
+++ b/src/version.c
@@ -701,10 +701,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    404,
 /**/
     403,
 /**/
     402,
 /**/

Vulnerable code:   call assert_equal(1, assert_fails('c0', ['', '\1']))
  call assert_match("Expected '\\\\\\\\1' but got 'E939: Positive count required: c0': c0", v:errors[0])
Fixed code:   try
    call assert_equal(0, assert_fails('xxx', [#{one: 1}]))
  catch
    let exp = v:exception
  endtry
  call assert_match("E731: Using a Dictionary as a String", exp)

  let exp = ''
  try
    call assert_equal(0, assert_fails('xxx', ['E492', #{one: 1}]))
  catch
    let exp = v:exception
  endtry
  call assert_match("E731: Using a Dictionary as a String", exp)

  call assert_equal(1, assert_fails('c0', ['', '\(.\)\1']))
  call assert_match("Expected '\\\\\\\\(.\\\\\\\\)\\\\\\\\1' but got 'E939: Positive count required: c0': c0", v:errors[0])

    // reset here for any errors reported below
    trylevel = save_trylevel;
    suppress_errthrow = FALSE;

	    if (expected == NULL)
		goto theend;
		    if (expected == NULL)
			goto theend;
/**/
    404,