CVE-2022-1381: Heap-based Buffer Overflow (CWE-122)
value: global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 7.8
Published: 2022-04-18T01:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/ex_docmd.c, src/testdir/test_ex_mode.vim, src/version.c
Commit date: 2022-04-16 18:52:17 +0100
Commit message: patch 8.2.4763: using invalid pointer with "V:" in Ex mode

Problem:    Using invalid pointer with "V:" in Ex mode.
Solution:   Correctly handle the command being changed to "+".

Diff: diff --git a/src/ex_docmd.c b/src/ex_docmd.c
index 47a12fd2cf82..58df97a9aa61 100644
--- a/src/ex_docmd.c
+++ b/src/ex_docmd.c
@@ -2781,11 +2781,13 @@ parse_command_modifiers(
 	exarg_T	    *eap,
 	char	    **errormsg,
 	cmdmod_T    *cmod,
 	int	    skip_only)
 {
+    char_u  *orig_cmd = eap->cmd;
     char_u  *cmd_start = NULL;
+    int	    did_plus_cmd = FALSE;
     char_u  *p;
     int	    starts_with_colon = FALSE;
     int	    vim9script = in_vim9script();
     int	    has_visual_range = FALSE;
 
@@ -2817,10 +2819,11 @@ parse_command_modifiers(
 		   && (getline_equal(eap->getline, eap->cookie, getexmodeline)
 		       || getline_equal(eap->getline, eap->cookie, getexline))
 			&& curwin->w_cursor.lnum < curbuf->b_ml.ml_line_count)
 	{
 	    eap->cmd = (char_u *)"+";
+	    did_plus_cmd = TRUE;
 	    if (!skip_only)
 		ex_pressedreturn = TRUE;
 	}
 
 	// ignore comment and empty lines
@@ -3103,17 +3106,33 @@ parse_command_modifiers(
 	{
 	    // Move the '<,'> range to after the modifiers and insert a colon.
 	    // Since the modifiers have been parsed put the colon on top of the
 	    // space: "'<,'>mod cmd" -> "mod:'<,'>cmd
 	    // Put eap->cmd after the colon.
-	    mch_memmove(cmd_start - 5, cmd_start, eap->cmd - cmd_start);
-	    eap->cmd -= 5;
-	    mch_memmove(eap->cmd - 1, ":'<,'>", 6);
+	    if (did_plus_cmd)
+	    {
+		size_t len = STRLEN(cmd_start);
+
+		// Special case: empty command may have been changed to "+":
+		//  "'<,'>mod" -> "mod'<,'>+
+		mch_memmove(orig_cmd, cmd_start, len);
+		STRCPY(orig_cmd + len, "'<,'>+");
+	    }
+	    else
+	    {
+		mch_memmove(cmd_start - 5, cmd_start, eap->cmd - cmd_start);
+		eap->cmd -= 5;
+		mch_memmove(eap->cmd - 1, ":'<,'>", 6);
+	    }
 	}
 	else
-	    // no modifiers, move the pointer back
-	    eap->cmd -= 5;
+	    // No modifiers, move the pointer back.
+	    // Special case: empty command may have been changed to "+".
+	    if (did_plus_cmd)
+		eap->cmd = (char_u *)"'<,'>+";
+	    else
+		eap->cmd = orig_cmd;
     }
 
     return OK;
 }
 
diff --git a/src/testdir/test_ex_mode.vim b/src/testdir/test_ex_mode.vim
index 2642a16d2576..d981ced6b8f6 100644
--- a/src/testdir/test_ex_mode.vim
+++ b/src/testdir/test_ex_mode.vim
@@ -248,7 +248,20 @@ func Test_ex_mode_large_indent()
   exe "normal gQi\<CR>."
   set ts=8 noai
   bwipe!
 endfunc
 
+" This was accessing illegal memory when using "+" for eap->cmd.
+func Test_empty_command_visual_mode()
+  let lines =<< trim END
+      r<sfile>
+      0norm0V:
+      :qall!
+  END
+  call writefile(lines, 'Xexmodescript')
+  call assert_equal(1, RunVim([], [], '-u NONE -e -s -S Xexmodescript'))
+
+  call delete('Xexmodescript')
+endfunc
+
 
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 1cc0d906b134..d6f2ef431437 100644
--- a/src/version.c
+++ b/src/version.c
@@ -744,10 +744,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4763,
 /**/
     4762,
 /**/
     4761,
 /**/

Vulnerable code: 	    mch_memmove(cmd_start - 5, cmd_start, eap->cmd - cmd_start);
	    eap->cmd -= 5;
	    mch_memmove(eap->cmd - 1, ":'<,'>", 6);
	    // no modifiers, move the pointer back
	    eap->cmd -= 5;
Fixed code:     char_u  *orig_cmd = eap->cmd;
    int	    did_plus_cmd = FALSE;
	    did_plus_cmd = TRUE;
	    if (did_plus_cmd)
	    {
		size_t len = STRLEN(cmd_start);

		// Special case: empty command may have been changed to "+":
		//  "'<,'>mod" -> "mod'<,'>+
		mch_memmove(orig_cmd, cmd_start, len);
		STRCPY(orig_cmd + len, "'<,'>+");
	    }
	    else
	    {
		mch_memmove(cmd_start - 5, cmd_start, eap->cmd - cmd_start);
		eap->cmd -= 5;
		mch_memmove(eap->cmd - 1, ":'<,'>", 6);
	    }
	    // No modifiers, move the pointer back.
	    // Special case: empty command may have been changed to "+".
	    if (did_plus_cmd)
		eap->cmd = (char_u *)"'<,'>+";
	    else
		eap->cmd = orig_cmd;
" This was accessing illegal memory when using "+" for eap->cmd.
func Test_empty_command_visual_mode()
  let lines =<< trim END
      r<sfile>
      0norm0V:
      :qall!
  END
  call writefile(lines, 'Xexmodescript')
  call assert_equal(1, RunVim([], [], '-u NONE -e -s -S Xexmodescript'))

  call delete('Xexmodescript')
endfunc

/**/
    4763,