CVE-2022-1785: Out-of-bounds Write (CWE-787)
value: Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.4977.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2022-05-19T13:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/ex_cmds.c, src/testdir/test_substitute.vim, src/version.c
Commit date: 2022-05-18 13:11:57 +0100
Commit message: patch 8.2.4977: memory access error when substitute expression changes window

Problem:    Memory access error when substitute expression changes window.
Solution:   Disallow changing window in substitute expression.

Diff: diff --git a/src/ex_cmds.c b/src/ex_cmds.c
index 7e730becb48f..210e21fe7a5b 100644
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -4410,16 +4410,21 @@ ex_substitute(exarg_T *eap)
 		    sandbox++;
 		}
 		// Save flags for recursion.  They can change for e.g.
 		// :s/^/\=execute("s#^##gn")
 		subflags_save = subflags;
+
+		// Disallow changing text or switching window in an expression.
+		++textwinlock;
 #endif
 		// get length of substitution part
 		sublen = vim_regsub_multi(&regmatch,
 				    sub_firstlnum - regmatch.startpos[0].lnum,
 			       sub, sub_firstline, FALSE, magic_isset(), TRUE);
 #ifdef FEAT_EVAL
+		--textwinlock;
+
 		// If getting the substitute string caused an error, don't do
 		// the replacement.
 		// Don't keep flags set by a recursive call.
 		subflags = subflags_save;
 		if (aborting() || subflags.do_count)
@@ -4516,13 +4521,19 @@ ex_substitute(exarg_T *eap)
 		 * copy the text up to the part that matched
 		 */
 		mch_memmove(new_end, sub_firstline + copycol, (size_t)copy_len);
 		new_end += copy_len;
 
+#ifdef FEAT_EVAL
+		++textwinlock;
+#endif
 		(void)vim_regsub_multi(&regmatch,
 				    sub_firstlnum - regmatch.startpos[0].lnum,
 				      sub, new_end, TRUE, magic_isset(), TRUE);
+#ifdef FEAT_EVAL
+		--textwinlock;
+#endif
 		sub_nsubs++;
 		did_sub = TRUE;
 
 		// Move the cursor to the start of the line, to avoid that it
 		// is beyond the end of the line after the substitution.
diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
index f3fd7ab1ce77..a1c324ed8d20 100644
--- a/src/testdir/test_substitute.vim
+++ b/src/testdir/test_substitute.vim
@@ -998,10 +998,23 @@ func Test_using_old_sub()
   delfunc Repl
   bwipe!
   set nocompatible
 endfunc
 
+" This was switching windows in between computing the length and using it.
+func Test_sub_change_window()
+  silent! lfile
+  sil! norm o0000000000000000000000000000000000000000000000000000
+  func Repl()
+    lopen
+  endfunc
+  silent!  s/\%')/\=Repl()
+  bwipe!
+  bwipe!
+  delfunc Repl
+endfunc
+
 " Test for the 2-letter and 3-letter :substitute commands
 func Test_substitute_short_cmd()
   new
   call setline(1, ['one', 'one one one'])
   s/one/two
diff --git a/src/version.c b/src/version.c
index 4c63ea0771ad..782642b5d5a1 100644
--- a/src/version.c
+++ b/src/version.c
@@ -744,10 +744,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4977,
 /**/
     4976,
 /**/
     4975,
 /**/

Fixed code: 
		// Disallow changing text or switching window in an expression.
		++textwinlock;
		--textwinlock;

#ifdef FEAT_EVAL
		++textwinlock;
#endif
#ifdef FEAT_EVAL
		--textwinlock;
#endif
" This was switching windows in between computing the length and using it.
func Test_sub_change_window()
  silent! lfile
  sil! norm o0000000000000000000000000000000000000000000000000000
  func Repl()
    lopen
  endfunc
  silent!  s/\%')/\=Repl()
  bwipe!
  bwipe!
  delfunc Repl
endfunc

/**/
    4977,