CVE-2022-4141: Heap-based Buffer Overflow (CWE-122)
value: Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 7.8
Published: 2022-11-25T14:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/normal.c, src/proto/normal.pro, src/testdir/test_substitute.vim, src/version.c, src/window.c
Commit date: 2022-11-25 13:03:31 +0000
Commit message: patch 9.0.0947: invalid memory access in substitute with function

Problem:    Invalid memory access in substitute with function that goes to
            another file.
Solution:   Check for text locked in CTRL-W gf.

Diff: diff --git a/src/normal.c b/src/normal.c
index 938ae718efa..0d1eba759e6 100644
--- a/src/normal.c
+++ b/src/normal.c
@@ -186,17 +186,37 @@ find_command(int cmdchar)
     static int
 check_text_locked(oparg_T *oap)
 {
     if (text_locked())
     {
-	clearopbeep(oap);
+	if (oap != NULL)
+	    clearopbeep(oap);
 	text_locked_msg();
 	return TRUE;
     }
     return FALSE;
 }
 
+/*
+ * If text is locked, "curbuf_lock" or "allbuf_lock" is set:
+ * Give an error message, possibly beep and return TRUE.
+ * "oap" may be NULL.
+ */
+    int
+check_text_or_curbuf_locked(oparg_T *oap)
+{
+    if (check_text_locked(oap))
+	return TRUE;
+    if (curbuf_locked())
+    {
+	if (oap != NULL)
+	    clearop(oap);
+	return TRUE;
+    }
+    return FALSE;
+}
+
 /*
  * Handle the count before a normal command and set cap->count0.
  */
     static int
 normal_cmd_get_count(
@@ -796,12 +816,11 @@ normal_cmd(
 	// Not a known command: beep.
 	clearopbeep(oap);
 	goto normal_end;
     }
 
-    if ((nv_cmds[idx].cmd_flags & NV_NCW)
-				&& (check_text_locked(oap) || curbuf_locked()))
+    if ((nv_cmds[idx].cmd_flags & NV_NCW) && check_text_or_curbuf_locked(oap))
 	// this command is not allowed now
 	goto normal_end;
 
     // In Visual/Select mode, a few keys are handled in a special way.
     if (VIsual_active)
@@ -4024,17 +4043,13 @@ nv_down(cmdarg_T *cap)
 nv_gotofile(cmdarg_T *cap)
 {
     char_u	*ptr;
     linenr_T	lnum = -1;
 
-    if (check_text_locked(cap->oap))
-	return;
-    if (curbuf_locked())
-    {
-	clearop(cap->oap);
+    if (check_text_or_curbuf_locked(cap->oap))
 	return;
-    }
+
 #ifdef FEAT_PROP_POPUP
     if (ERROR_IF_TERM_POPUP_WINDOW)
 	return;
 #endif
 
diff --git a/src/proto/normal.pro b/src/proto/normal.pro
index 106d0e1395b..eff08dfa8b7 100644
--- a/src/proto/normal.pro
+++ b/src/proto/normal.pro
@@ -1,6 +1,7 @@
 /* normal.c */
+int check_text_or_curbuf_locked(oparg_T *oap);
 void normal_cmd(oparg_T *oap, int toplevel);
 void check_visual_highlight(void);
 void end_visual_mode(void);
 void end_visual_mode_keep_button(void);
 void reset_VIsual_and_resel(void);
diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
index 67df60ff907..25132233720 100644
--- a/src/testdir/test_substitute.vim
+++ b/src/testdir/test_substitute.vim
@@ -1094,10 +1094,29 @@ func Test_sub_edit_scriptfile()
 
   delfunc EditScript
   bwipe!
 endfunc
 
+" This was editing another file from the expression.
+func Test_sub_expr_goto_other_file()
+  call writefile([''], 'Xfileone', 'D')
+  enew!
+  call setline(1, ['a', 'b', 'c', 'd',
+	\ 'Xfileone zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz'])
+
+  func g:SplitGotoFile()
+    exe "sil! norm 0\<C-W>gf"
+    return ''
+  endfunc
+
+  $
+  s/\%')/\=g:SplitGotoFile()
+
+  delfunc g:SplitGotoFile
+  bwipe!
+endfunc
+
 " Test for the 2-letter and 3-letter :substitute commands
 func Test_substitute_short_cmd()
   new
   call setline(1, ['one', 'one one one'])
   s/one/two
diff --git a/src/version.c b/src/version.c
index 0c3194c05dc..5686005f34d 100644
--- a/src/version.c
+++ b/src/version.c
@@ -693,10 +693,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    947,
 /**/
     946,
 /**/
     945,
 /**/
diff --git a/src/window.c b/src/window.c
index 97cc77035f9..a2bebcaea4d 100644
--- a/src/window.c
+++ b/src/window.c
@@ -565,10 +565,12 @@ newwindow:
     case 'f':
     case 'F':
     case Ctrl_F:
 wingotofile:
 		CHECK_CMDWIN;
+		if (check_text_or_curbuf_locked(NULL))
+		    break;
 
 		ptr = grab_file_name(Prenum1, &lnum);
 		if (ptr != NULL)
 		{
 		    tabpage_T	*oldtab = curtab;
@@ -883,11 +885,11 @@ win_split(int size, int flags)
 
 /*
  * When "new_wp" is NULL: split the current window in two.
  * When "new_wp" is not NULL: insert this window at the far
  * top/left/right/bottom.
- * return FAIL for failure, OK otherwise
+ * Return FAIL for failure, OK otherwise.
  */
     int
 win_split_ins(
     int		size,
     int		flags,

Vulnerable code: 	clearopbeep(oap);
    if ((nv_cmds[idx].cmd_flags & NV_NCW)
				&& (check_text_locked(oap) || curbuf_locked()))
    if (check_text_locked(cap->oap))
	return;
    if (curbuf_locked())
    {
	clearop(cap->oap);
    }
 * return FAIL for failure, OK otherwise
Fixed code: 	if (oap != NULL)
	    clearopbeep(oap);
/*
 * If text is locked, "curbuf_lock" or "allbuf_lock" is set:
 * Give an error message, possibly beep and return TRUE.
 * "oap" may be NULL.
 */
    int
check_text_or_curbuf_locked(oparg_T *oap)
{
    if (check_text_locked(oap))
	return TRUE;
    if (curbuf_locked())
    {
	if (oap != NULL)
	    clearop(oap);
	return TRUE;
    }
    return FALSE;
}

    if ((nv_cmds[idx].cmd_flags & NV_NCW) && check_text_or_curbuf_locked(oap))
    if (check_text_or_curbuf_locked(cap->oap))

int check_text_or_curbuf_locked(oparg_T *oap);
" This was editing another file from the expression.
func Test_sub_expr_goto_other_file()
  call writefile([''], 'Xfileone', 'D')
  enew!
  call setline(1, ['a', 'b', 'c', 'd',
	\ 'Xfileone zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz'])

  func g:SplitGotoFile()
    exe "sil! norm 0\<C-W>gf"
    return ''
  endfunc

  $
  s/\%')/\=g:SplitGotoFile()

  delfunc g:SplitGotoFile
  bwipe!
endfunc

/**/
    947,
		if (check_text_or_curbuf_locked(NULL))
		    break;
 * Return FAIL for failure, OK otherwise.