CVE-2023-4781: Heap-based Buffer Overflow (CWE-122)
value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 7.8
Published: 2023-09-05T19:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/ex_cmds.c, src/testdir/test_crash.vim, src/version.c, src/window.c
Commit date: 2023-09-05 20:18:06 +0200
Commit message: patch 9.0.1873: [security] heap-buffer-overflow in vim_regsub_both

Problem:  heap-buffer-overflow in vim_regsub_both
Solution: Disallow exchanging windows when textlock is active

Signed-off-by: Christian Brabandt <cb@256bit.org>

Diff: diff --git a/src/ex_cmds.c b/src/ex_cmds.c
index 4f1d93244f02..566ed7dad32d 100644
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -4517,10 +4517,13 @@ ex_substitute(exarg_T *eap)
 		// go beyond the last line of the buffer.
 		if (nmatch > curbuf->b_ml.ml_line_count - sub_firstlnum + 1)
 		{
 		    nmatch = curbuf->b_ml.ml_line_count - sub_firstlnum + 1;
 		    skip_match = TRUE;
+		    // safety check
+		    if (nmatch < 0)
+			goto skip;
 		}
 
 		// Need room for:
 		// - result so far in new_start (not for first sub in line)
 		// - original text up to match
diff --git a/src/testdir/crash/vim_regsub_both_poc b/src/testdir/crash/vim_regsub_both_poc
new file mode 100644
index 000000000000..19a57114be60
Binary files /dev/null and b/src/testdir/crash/vim_regsub_both_poc differ
diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim
index e0884e5a058e..f7b528c3e98d 100644
--- a/src/testdir/test_crash.vim
+++ b/src/testdir/test_crash.vim
@@ -44,10 +44,11 @@ func Test_crash1()
   " This test takes a bit longer
   call TermWait(buf, 1000)
 
   let file = 'crash/poc_tagfunc.vim'
   let args = printf(cmn_args, vim, file)
+  " using || because this poc causes vim to exit with exitstatus != 0
   call term_sendkeys(buf, args ..
     \ '  || echo "crash 5: [OK]" >> X_crash1_result.txt' .. "\<cr>")
 
   call TermWait(buf, 100)
 
@@ -57,10 +58,17 @@ func Test_crash1()
     \ '  && echo "crash 6: [OK]" >> X_crash1_result.txt' .. "\<cr>")
   " clean up
   call delete('X')
   call TermWait(buf, 3000)
 
+  let file = 'crash/vim_regsub_both_poc'
+  let args = printf(cmn_args, vim, file)
+  " using || because this poc causes vim to exit with exitstatus != 0
+  call term_sendkeys(buf, args ..
+    \ '  && echo "crash 7: [OK]" >> X_crash1_result.txt' .. "\<cr>")
+  call TermWait(buf, 1000)
+
   " clean up
   exe buf .. "bw!"
 
   sp X_crash1_result.txt
 
@@ -69,10 +77,11 @@ func Test_crash1()
       \ 'crash 2: [OK]',
       \ 'crash 3: [OK]',
       \ 'crash 4: [OK]',
       \ 'crash 5: [OK]',
       \ 'crash 6: [OK]',
+      \ 'crash 7: [OK]',
       \ ]
 
   call assert_equal(expected, getline(1, '$'))
   bw!
 
diff --git a/src/version.c b/src/version.c
index a5e570e9314f..2faa9e668ec6 100644
--- a/src/version.c
+++ b/src/version.c
@@ -697,10 +697,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1873,
 /**/
     1872,
 /**/
     1871,
 /**/
diff --git a/src/window.c b/src/window.c
index 1af2395df8b9..f77ede330d30 100644
--- a/src/window.c
+++ b/src/window.c
@@ -1731,10 +1731,15 @@ win_exchange(long Prenum)
     if (ONE_WINDOW)	    // just one window
     {
 	beep_flush();
 	return;
     }
+    if (text_or_buf_locked())
+    {
+	beep_flush();
+	return;
+    }
 
 #ifdef FEAT_GUI
     need_mouse_correct = TRUE;
 #endif
 

Fixed code: 		    // safety check
		    if (nmatch < 0)
			goto skip;
  " using || because this poc causes vim to exit with exitstatus != 0
  let file = 'crash/vim_regsub_both_poc'
  let args = printf(cmn_args, vim, file)
  " using || because this poc causes vim to exit with exitstatus != 0
  call term_sendkeys(buf, args ..
    \ '  && echo "crash 7: [OK]" >> X_crash1_result.txt' .. "\<cr>")
  call TermWait(buf, 1000)

      \ 'crash 7: [OK]',
/**/
    1873,
    if (text_or_buf_locked())
    {
	beep_flush();
	return;
    }