CVE-2022-3705: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: A vulnerability was found in vim and classified as problematic. Affected by this issue is the function qf_update_buffer of the file quickfix.c of the component autocmd Handler. The manipulation leads to use after free. The attack may be launched remotely. Upgrading to version 9.0.0805 is able to address this issue. The name of the patch is d0fab10ed2a86698937e3c3fed2f10bd9bb5e731. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-212324.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.5
Published: 2022-10-26T20:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/quickfix.c, src/testdir/test_quickfix.vim, src/version.c
Commit date: 2022-10-20 16:03:33 +0100
Commit message: patch 9.0.0805: filetype autocmd may cause freed memory access

Problem:    Filetype autocmd may cause freed memory access.
Solution:   Set the quickfix-busy flag while filling the buffer.

Diff: diff --git a/src/quickfix.c b/src/quickfix.c
index a90611475ab..f85fff56f23 100644
--- a/src/quickfix.c
+++ b/src/quickfix.c
@@ -4593,10 +4593,13 @@ qf_update_buffer(qf_info_T *qi, qfline_T *old_last)
 		    return;
 	    }
 	    qf_winid = win->w_id;
 	}
 
+	// autocommands may cause trouble
+	incr_quickfix_busy();
+
 	if (old_last == NULL)
 	    // set curwin/curbuf to buf and save a few things
 	    aucmd_prepbuf(&aco, buf);
 
 	qf_update_win_titlevar(qi);
@@ -4614,10 +4617,13 @@ qf_update_buffer(qf_info_T *qi, qfline_T *old_last)
 
 	// Only redraw when added lines are visible.  This avoids flickering
 	// when the added lines are not visible.
 	if ((win = qf_find_win(qi)) != NULL && old_line_count < win->w_botline)
 	    redraw_buf_later(buf, UPD_NOT_VALID);
+
+	// always called after incr_quickfix_busy()
+	decr_quickfix_busy();
     }
 }
 
 /*
  * Add an error line to the quickfix buffer.
diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
index 2ee754b3969..bcaef5da175 100644
--- a/src/testdir/test_quickfix.vim
+++ b/src/testdir/test_quickfix.vim
@@ -3453,10 +3453,25 @@ func Test_resize_from_copen()
     augroup END
     augroup! QF_Test
   endtry
 endfunc
 
+func Test_filetype_autocmd()
+  " this changes the location list while it is in use to fill a buffer
+  lexpr ''
+  lopen
+  augroup FT_loclist
+    au FileType * call setloclist(0, [], 'f')
+  augroup END
+  silent! lolder
+  lexpr ''
+
+  augroup FT_loclist
+    au! FileType
+  augroup END
+endfunc
+
 func Test_vimgrep_with_textlock()
   new
 
   " Simple way to execute something with "textlock" set.
   " Check that vimgrep without jumping can be executed.
@@ -6370,6 +6385,7 @@ func Test_info_line_with_space()
         \ ' 2:    20 |     Afunc():', ' 3:  ', ' 4:       |            ^'], l)
 
   call setqflist([], 'f')
 endfunc
 
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index b4756ca0493..7f72a2c473b 100644
--- a/src/version.c
+++ b/src/version.c
@@ -693,10 +693,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    805,
 /**/
     804,
 /**/
     803,
 /**/

Fixed code: 	// autocommands may cause trouble
	incr_quickfix_busy();


	// always called after incr_quickfix_busy()
	decr_quickfix_busy();
func Test_filetype_autocmd()
  " this changes the location list while it is in use to fill a buffer
  lexpr ''
  lopen
  augroup FT_loclist
    au FileType * call setloclist(0, [], 'f')
  augroup END
  silent! lolder
  lexpr ''

  augroup FT_loclist
    au! FileType
  augroup END
endfunc


/**/
    805,