CVE-2022-4293: Floating Point Comparison with Incorrect Operator (CWE-1077)
value: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
CWE description: The code performs a comparison such as an
        equality test between two float (floating point) values, but
        it uses comparison operators that do not account for the
        possibility of loss of precision.
CVSS v3 base score: 5.5
Published: 2022-12-05T19:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/eval.c, src/testdir/test_expr.vim, src/version.c
Commit date: 2022-10-20 14:17:18 +0100
Commit message: patch 9.0.0804: crash when trying to divide a number by -1

Problem:    Crash when trying to divice the largest negative number by -1.
Solution:   Handle this case specifically.

Diff: diff --git a/src/eval.c b/src/eval.c
index 1652fcb4ae4..062fab0ac94 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -64,10 +64,16 @@ num_divide(varnumber_T n1, varnumber_T n2, int *failed)
 	else if (n1 < 0)
 	    result = -VARNUM_MAX;
 	else
 	    result = VARNUM_MAX;
     }
+    else if (n1 == VARNUM_MIN && n2 == -1)
+    {
+	// specific case: trying to do VARNUM_MIN / -1 results in a positive
+	// number that doesn't fit in varnumber_T and causes an FPE
+	result = VARNUM_MAX;
+    }
     else
 	result = n1 / n2;
 
     return result;
 }
@@ -6021,11 +6027,11 @@ var2fpos(
 	semsg(_(e_invalid_value_for_line_number_str), name);
     return NULL;
 }
 
 /*
- * Convert list in "arg" into position "psop" and optional file number "fnump".
+ * Convert list in "arg" into position "posp" and optional file number "fnump".
  * When "fnump" is NULL there is no file number, only 3 items: [lnum, col, off]
  * Note that the column is passed on as-is, the caller may want to decrement
  * it to use 1 for the first column.
  * If "charcol" is TRUE use the column as the character index instead of the
  * byte index.
diff --git a/src/testdir/test_expr.vim b/src/testdir/test_expr.vim
index b47896340f6..e1fed369b74 100644
--- a/src/testdir/test_expr.vim
+++ b/src/testdir/test_expr.vim
@@ -759,10 +759,16 @@ func Test_eval_after_if()
   endfunc
   if 0 | eval SetVal('a') | endif | call SetVal('b')
   call assert_equal('b', s:val)
 endfunc
 
+func Test_divide_by_zero()
+  " only tests that this doesn't crash, the result is not important
+  echo 0 / 0
+  echo 0 / 0 / -1
+endfunc
+
 " Test for command-line completion of expressions
 func Test_expr_completion()
   CheckFeature cmdline_compl
   for cmd in [
 	\ 'let a = ',
diff --git a/src/version.c b/src/version.c
index 0de044e3cea..b4756ca0493 100644
--- a/src/version.c
+++ b/src/version.c
@@ -693,10 +693,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    804,
 /**/
     803,
 /**/
     802,
 /**/

Vulnerable code:  * Convert list in "arg" into position "psop" and optional file number "fnump".
Fixed code:     else if (n1 == VARNUM_MIN && n2 == -1)
    {
	// specific case: trying to do VARNUM_MIN / -1 results in a positive
	// number that doesn't fit in varnumber_T and causes an FPE
	result = VARNUM_MAX;
    }
 * Convert list in "arg" into position "posp" and optional file number "fnump".
func Test_divide_by_zero()
  " only tests that this doesn't crash, the result is not important
  echo 0 / 0
  echo 0 / 0 / -1
endfunc

/**/
    804,