CVE-2022-3234: Heap-based Buffer Overflow (CWE-122)
value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 7.8
Published: 2022-09-17T22:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/ops.c, src/testdir/test_virtualedit.vim, src/version.c
Commit date: 2022-09-16 22:16:59 +0100
Commit message: patch 9.0.0483: illegal memory access when replacing in virtualedit mode

Problem:    Illegal memory access when replacing in virtualedit mode.
Solution:   Check for replacing NUL after Tab.

Diff: diff --git a/src/ops.c b/src/ops.c
index 88d85f8e0b31..99a5d5cdfd4d 100644
--- a/src/ops.c
+++ b/src/ops.c
@@ -1171,10 +1171,12 @@ op_replace(oparg_T *oap, int c)
 	else if (!oap->inclusive)
 	    dec(&(oap->end));
 
 	while (LTOREQ_POS(curwin->w_cursor, oap->end))
 	{
+	    int done = FALSE;
+
 	    n = gchar_cursor();
 	    if (n != NUL)
 	    {
 		int new_byte_len = (*mb_char2len)(c);
 		int old_byte_len = mb_ptr2len(ml_get_cursor());
@@ -1184,10 +1186,11 @@ op_replace(oparg_T *oap, int c)
 		    // This is slow, but it handles replacing a single-byte
 		    // with a multi-byte and the other way around.
 		    if (curwin->w_cursor.lnum == oap->end.lnum)
 			oap->end.col += new_byte_len - old_byte_len;
 		    replace_character(c);
+		    done = TRUE;
 		}
 		else
 		{
 		    if (n == TAB)
 		    {
@@ -1202,14 +1205,19 @@ op_replace(oparg_T *oap, int c)
 			}
 			coladvance_force(getviscol());
 			if (curwin->w_cursor.lnum == oap->end.lnum)
 			    getvpos(&oap->end, end_vcol);
 		    }
-		    PBYTE(curwin->w_cursor, c);
+		    // with "coladd" set may move to just after a TAB
+		    if (gchar_cursor() != NUL)
+		    {
+			PBYTE(curwin->w_cursor, c);
+			done = TRUE;
+		    }
 		}
 	    }
-	    else if (virtual_op && curwin->w_cursor.lnum == oap->end.lnum)
+	    if (!done && virtual_op && curwin->w_cursor.lnum == oap->end.lnum)
 	    {
 		int virtcols = oap->end.coladd;
 
 		if (curwin->w_cursor.lnum == oap->start.lnum
 			&& oap->start.col == oap->end.col && oap->start.coladd)
diff --git a/src/testdir/test_virtualedit.vim b/src/testdir/test_virtualedit.vim
index 8fd6d984470f..8ca81a777d26 100644
--- a/src/testdir/test_virtualedit.vim
+++ b/src/testdir/test_virtualedit.vim
@@ -570,6 +570,20 @@ func Test_virtualedit_mouse()
   bwipe!
   let &mouse = save_mouse
   set virtualedit&
 endfunc
 
+" this was replacing the NUL at the end of the line 
+func Test_virtualedit_replace_after_tab()
+  new
+  s/\v/	0
+  set ve=all
+  let @" = ''
+  sil! norm vPvr0
+  
+  call assert_equal("\t0", getline(1))
+  set ve&
+  bwipe!
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 19f9e00ec97d..8b6367ac9373 100644
--- a/src/version.c
+++ b/src/version.c
@@ -701,10 +701,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    483,
 /**/
     482,
 /**/
     481,
 /**/

Vulnerable code: 		    PBYTE(curwin->w_cursor, c);
	    else if (virtual_op && curwin->w_cursor.lnum == oap->end.lnum)
Fixed code: 	    int done = FALSE;

		    done = TRUE;
		    // with "coladd" set may move to just after a TAB
		    if (gchar_cursor() != NUL)
		    {
			PBYTE(curwin->w_cursor, c);
			done = TRUE;
		    }
	    if (!done && virtual_op && curwin->w_cursor.lnum == oap->end.lnum)
" this was replacing the NUL at the end of the line 
func Test_virtualedit_replace_after_tab()
  new
  s/\v/	0
  set ve=all
  let @" = ''
  sil! norm vPvr0
  
  call assert_equal("\t0", getline(1))
  set ve&
  bwipe!
endfunc


/**/
    483,