CVE-2022-1720: Buffer Over-read (CWE-126)
value: Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.
CWE description: The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
CVSS v3 base score: 7.8
Published: 2022-06-20T15:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/normal.c, src/testdir/test_gf.vim, src/version.c
Commit date: 2022-05-14 21:29:44 +0100
Commit message: patch 8.2.4956: reading past end of line with "gf" in Visual block mode

Problem:    Reading past end of line with "gf" in Visual block mode.
Solution:   Do not include the NUL in the length.

Diff: diff --git a/src/normal.c b/src/normal.c
index 1baf68a1453a..bc3e29e1abaa 100644
--- a/src/normal.c
+++ b/src/normal.c
@@ -3669,13 +3669,20 @@ get_visual_text(
 	    *pp = ml_get_pos(&VIsual);
 	    *lenp = curwin->w_cursor.col - VIsual.col + 1;
 	}
 	if (**pp == NUL)
 	    *lenp = 0;
-	if (has_mbyte && *lenp > 0)
-	    // Correct the length to include all bytes of the last character.
-	    *lenp += (*mb_ptr2len)(*pp + (*lenp - 1)) - 1;
+	if (*lenp > 0)
+	{
+	    if (has_mbyte)
+		// Correct the length to include all bytes of the last
+		// character.
+		*lenp += (*mb_ptr2len)(*pp + (*lenp - 1)) - 1;
+	    else if ((*pp)[*lenp - 1] == NUL)
+		// Do not include a trailing NUL.
+		*lenp -= 1;
+	}
     }
     reset_VIsual_and_resel();
     return OK;
 }
 
diff --git a/src/testdir/test_gf.vim b/src/testdir/test_gf.vim
index 3602ba010e8c..1b3b139810ec 100644
--- a/src/testdir/test_gf.vim
+++ b/src/testdir/test_gf.vim
@@ -136,10 +136,25 @@ func Test_gf_visual()
   call setline(1, 'XXXtest_gf_visual:3XXX')
   norm! 0ttvt:gF
   call assert_equal('Xtest_gf_visual', bufname('%'))
   call assert_equal(3, getcurpos()[1])
 
+  " do not include the NUL at the end 
+  call writefile(['x'], 'X')
+  let save_enc = &enc
+  for enc in ['latin1', 'utf-8']
+    exe "set enc=" .. enc
+    new
+    call setline(1, 'X')
+    set nomodified
+    exe "normal \<C-V>$gf"
+    call assert_equal('X', bufname())
+    bwipe!
+  endfor
+  let &enc = save_enc
+  call delete('X')
+
   " line number in visual area is used for file name
   if has('unix')
     bwipe!
     call writefile([], "Xtest_gf_visual:3")
     new
diff --git a/src/version.c b/src/version.c
index 62e2b0af6941..821f3680e2fb 100644
--- a/src/version.c
+++ b/src/version.c
@@ -744,10 +744,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4956,
 /**/
     4955,
 /**/
     4954,
 /**/

Vulnerable code: 	if (has_mbyte && *lenp > 0)
	    // Correct the length to include all bytes of the last character.
	    *lenp += (*mb_ptr2len)(*pp + (*lenp - 1)) - 1;
Fixed code: 	if (*lenp > 0)
	{
	    if (has_mbyte)
		// Correct the length to include all bytes of the last
		// character.
		*lenp += (*mb_ptr2len)(*pp + (*lenp - 1)) - 1;
	    else if ((*pp)[*lenp - 1] == NUL)
		// Do not include a trailing NUL.
		*lenp -= 1;
	}
  " do not include the NUL at the end 
  call writefile(['x'], 'X')
  let save_enc = &enc
  for enc in ['latin1', 'utf-8']
    exe "set enc=" .. enc
    new
    call setline(1, 'X')
    set nomodified
    exe "normal \<C-V>$gf"
    call assert_equal('X', bufname())
    bwipe!
  endfor
  let &enc = save_enc
  call delete('X')

/**/
    4956,