CVE-2022-1771: Uncontrolled Recursion (CWE-674)
value: Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975.
CWE description: The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
CVSS v3 base score: 5.5
Published: 2022-05-18T20:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/ex_getln.c, src/testdir/test_cmdline.vim, src/version.c
Commit date: 2022-05-17 20:11:02 +0100
Commit message: patch 8.2.4975: recursive command line loop may cause a crash

Problem:    Recursive command line loop may cause a crash.
Solution:   Limit recursion of getcmdline().

Diff: diff --git a/src/ex_getln.c b/src/ex_getln.c
index cbddfea00375..6462b00f732f 100644
--- a/src/ex_getln.c
+++ b/src/ex_getln.c
@@ -1579,10 +1579,11 @@ getcmdline_int(
     int		firstc,
     long	count UNUSED,	// only used for incremental search
     int		indent,		// indent for inside conditionals
     int		clear_ccline)	// clear ccline first
 {
+    static int	depth = 0;	    // call depth
     int		c;
     int		i;
     int		j;
     int		gotesc = FALSE;		// TRUE when <ESC> just typed
     int		do_abbr;		// when TRUE check for abbr.
@@ -1609,10 +1610,13 @@ getcmdline_int(
     cmdline_info_T save_ccline;
     int		did_save_ccline = FALSE;
     int		cmdline_type;
     int		wild_type;
 
+    // one recursion level deeper
+    ++depth;
+
     if (ccline.cmdbuff != NULL)
     {
 	// Being called recursively.  Since ccline is global, we need to save
 	// the current buffer and restore it when returning.
 	save_cmdline(&save_ccline);
@@ -1639,10 +1643,17 @@ getcmdline_int(
 #endif
 
     if (init_ccline(firstc, indent) != OK)
 	goto theend;	// out of memory
 
+    if (depth == 50)
+    {
+	// Somehow got into a loop recursively calling getcmdline(), bail out.
+	emsg(_(e_command_too_recursive));
+	goto theend;
+    }
+
     ExpandInit(&xpc);
     ccline.xpc = &xpc;
 
 #ifdef FEAT_RIGHTLEFT
     if (curwin->w_p_rl && *curwin->w_p_rlc == 's'
@@ -2574,10 +2585,11 @@ returncmd:
 
 theend:
     {
 	char_u *p = ccline.cmdbuff;
 
+	--depth;
 	if (did_save_ccline)
 	    restore_cmdline(&save_ccline);
 	else
 	    ccline.cmdbuff = NULL;
 	return p;
diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
index e944f8d24d02..cc7fe54d6067 100644
--- a/src/testdir/test_cmdline.vim
+++ b/src/testdir/test_cmdline.vim
@@ -3390,6 +3390,18 @@ endfunc
 
 func Test_screenpos_and_completion()
   call feedkeys(":let a\<C-R>=Check_completion()\<CR>\<Esc>", "xt")
 endfunc
 
+func Test_recursive_register()
+  let @= = ''
+  silent! ?e/
+  let caught = 'no'
+  try
+    normal // 
+  catch /E169:/
+    let caught = 'yes'
+  endtry
+  call assert_equal('yes', caught)
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 98bb40d1166d..8d901e4cc42b 100644
--- a/src/version.c
+++ b/src/version.c
@@ -744,10 +744,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4975,
 /**/
     4974,
 /**/
     4973,
 /**/

Fixed code:     static int	depth = 0;	    // call depth
    // one recursion level deeper
    ++depth;

    if (depth == 50)
    {
	// Somehow got into a loop recursively calling getcmdline(), bail out.
	emsg(_(e_command_too_recursive));
	goto theend;
    }

	--depth;
func Test_recursive_register()
  let @= = ''
  silent! ?e/
  let caught = 'no'
  try
    normal // 
  catch /E169:/
    let caught = 'yes'
  endtry
  call assert_equal('yes', caught)
endfunc

/**/
    4975,