CVE-2023-0512: Divide By Zero (CWE-369)
value: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247.
CWE description: The product divides a value by zero.
CVSS v3 base score: 7.8
Published: 2023-01-30T16:15Z
Repository: https://github.com/vim/vim
Language: Other
Files changed: src/move.c, src/testdir/dumps/Test_smoothscroll_zero_1.dump, src/testdir/dumps/Test_smoothscroll_zero_2.dump, src/testdir/test_scroll_opt.vim, src/version.c
Commit date: 2023-01-26 14:14:43 +0000
Commit message: patch 9.0.1247: divide by zero with 'smoothscroll' set and a narrow window

Problem:    Divide by zero with 'smoothscroll' set and a narrow window.
Solution:   Bail out when the window is too narrow.

Diff: diff --git a/src/move.c b/src/move.c
index d3648df8b62..3c50d258c56 100644
--- a/src/move.c
+++ b/src/move.c
@@ -1931,10 +1931,13 @@ adjust_skipcol(void)
 	    || !curwin->w_p_sms
 	    || curwin->w_cursor.lnum != curwin->w_topline)
 	return;
 
     int	    width1 = curwin->w_width - curwin_col_off();
+    if (width1 <= 0)
+	return;  // no text will be displayed
+
     int	    width2 = width1 + curwin_col_off2();
     long    so = get_scrolloff_value();
     int	    scrolloff_cols = so == 0 ? 0 : width1 + (so - 1) * width2;
     int	    scrolled = FALSE;
 
diff --git a/src/testdir/dumps/Test_smoothscroll_zero_1.dump b/src/testdir/dumps/Test_smoothscroll_zero_1.dump
new file mode 100644
index 00000000000..5a99f571e38
--- /dev/null
+++ b/src/testdir/dumps/Test_smoothscroll_zero_1.dump
@@ -0,0 +1,6 @@
+> +0&#ffffff0@59
+@60
+@60
+@60
+@60
+@60
diff --git a/src/testdir/dumps/Test_smoothscroll_zero_2.dump b/src/testdir/dumps/Test_smoothscroll_zero_2.dump
new file mode 100644
index 00000000000..1879381c532
--- /dev/null
+++ b/src/testdir/dumps/Test_smoothscroll_zero_2.dump
@@ -0,0 +1,6 @@
+|:+0&#ffffff0|s|i|l| |n|o|r|m| |^|W|^|N| @45
+> @59
+@60
+@60
+@60
+@60
diff --git a/src/testdir/test_scroll_opt.vim b/src/testdir/test_scroll_opt.vim
index 2fa91682d8d..58344f9a925 100644
--- a/src/testdir/test_scroll_opt.vim
+++ b/src/testdir/test_scroll_opt.vim
@@ -558,7 +558,34 @@ func Test_smoothscroll_mouse_pos()
   let &mouse = save_mouse
   let &term = save_term
   let &ttymouse = save_ttymouse
 endfunc
 
+" this was dividing by zero
+func Test_smoothscrol_zero_width()
+  CheckScreendump
+
+  let lines =<< trim END
+      winsize 0 0
+      vsplit
+      vsplit
+      vsplit
+      vsplit
+      vsplit
+      sil norm H
+      set wrap
+      set smoothscroll
+      set number
+  END
+  call writefile(lines, 'XSmoothScrollZero', 'D')
+  let buf = RunVimInTerminal('-u NONE -i NONE -n -m -X -Z -e -s -S XSmoothScrollZero', #{rows: 6, cols: 60, wait_for_ruler: 0})
+  call TermWait(buf, 3000)
+  call VerifyScreenDump(buf, 'Test_smoothscroll_zero_1', {})
+
+  call term_sendkeys(buf, ":sil norm \<C-V>\<C-W>\<C-V>\<C-N>\<CR>")
+  call VerifyScreenDump(buf, 'Test_smoothscroll_zero_2', {})
+
+  call StopVimInTerminal(buf)
+endfunc
+
 
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 12f444a8c70..79f021b9661 100644
--- a/src/version.c
+++ b/src/version.c
@@ -693,10 +693,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1247,
 /**/
     1246,
 /**/
     1245,
 /**/

Fixed code:     if (width1 <= 0)
	return;  // no text will be displayed

> +0&#ffffff0@59
@60
@60
@60
@60
@60
|:+0&#ffffff0|s|i|l| |n|o|r|m| |^|W|^|N| @45
> @59
@60
@60
@60
@60
" this was dividing by zero
func Test_smoothscrol_zero_width()
  CheckScreendump

  let lines =<< trim END
      winsize 0 0
      vsplit
      vsplit
      vsplit
      vsplit
      vsplit
      sil norm H
      set wrap
      set smoothscroll
      set number
  END
  call writefile(lines, 'XSmoothScrollZero', 'D')
  let buf = RunVimInTerminal('-u NONE -i NONE -n -m -X -Z -e -s -S XSmoothScrollZero', #{rows: 6, cols: 60, wait_for_ruler: 0})
  call TermWait(buf, 3000)
  call VerifyScreenDump(buf, 'Test_smoothscroll_zero_1', {})

  call term_sendkeys(buf, ":sil norm \<C-V>\<C-W>\<C-V>\<C-N>\<CR>")
  call VerifyScreenDump(buf, 'Test_smoothscroll_zero_2', {})

  call StopVimInTerminal(buf)
endfunc

/**/
    1247,