CVE-2022-2000: Out-of-bounds Write (CWE-787)
value: Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2022-06-09T16:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/ex_docmd.c, src/testdir/test_cmdline.vim, src/version.c
Commit date: 2022-06-06 15:38:21 +0100
Commit message: patch 8.2.5063: error for a command may go over the end of IObuff

Problem:    Error for a command may go over the end of IObuff.
Solution:   Truncate the message.

Diff: diff --git a/src/ex_docmd.c b/src/ex_docmd.c
index cfb40e8d5cfa..634a1bcef566 100644
--- a/src/ex_docmd.c
+++ b/src/ex_docmd.c
@@ -3439,13 +3439,21 @@ theend:
  * invisible otherwise.
  */
     static void
 append_command(char_u *cmd)
 {
-    char_u *s = cmd;
-    char_u *d;
+    size_t  len = STRLEN(IObuff);
+    char_u  *s = cmd;
+    char_u  *d;
 
+    if (len > IOSIZE - 100)
+    {
+	// Not enough space, truncate and put in "...".
+	d = IObuff + IOSIZE - 100;
+	d -= mb_head_off(IObuff, d);
+	STRCPY(d, "...");
+    }
     STRCAT(IObuff, ": ");
     d = IObuff + STRLEN(IObuff);
     while (*s != NUL && d - IObuff + 5 < IOSIZE)
     {
 	if (enc_utf8 ? (s[0] == 0xc2 && s[1] == 0xa0) : *s == 0xa0)
diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
index 77965b3f65a3..2289c343e9f8 100644
--- a/src/testdir/test_cmdline.vim
+++ b/src/testdir/test_cmdline.vim
@@ -3411,6 +3411,11 @@ func Test_recursive_register()
     let caught = 'yes'
   endtry
   call assert_equal('yes', caught)
 endfunc
 
+func Test_long_error_message()
+  " the error should be truncated, not overrun IObuff
+  silent! norm Q00000000000000     000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000                                                                                                                                                                                                                        
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 542028606dde..dd585c81afe9 100644
--- a/src/version.c
+++ b/src/version.c
@@ -732,10 +732,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    5063,
 /**/
     5062,
 /**/
     5061,
 /**/

Vulnerable code:     char_u *s = cmd;
    char_u *d;
Fixed code:     size_t  len = STRLEN(IObuff);
    char_u  *s = cmd;
    char_u  *d;
    if (len > IOSIZE - 100)
    {
	// Not enough space, truncate and put in "...".
	d = IObuff + IOSIZE - 100;
	d -= mb_head_off(IObuff, d);
	STRCPY(d, "...");
    }
func Test_long_error_message()
  " the error should be truncated, not overrun IObuff
  silent! norm Q00000000000000     000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000                                                                                                                                                                                                                        
endfunc

/**/
    5063,