CVE-2022-2874: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-08-18T16:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/testdir/test_vim9_script.vim, src/version.c, src/vim9compile.c
Commit date: 2022-08-17 15:55:51 +0100
Commit message: patch 9.0.0224: Using NULL pointer when skipping compiled code

Problem:    Using NULL pointer when skipping compiled code.
Solution:   Check for skipping.

Diff: diff --git a/src/testdir/test_vim9_script.vim b/src/testdir/test_vim9_script.vim
index 3199ac395374..56a39efcf79b 100644
--- a/src/testdir/test_vim9_script.vim
+++ b/src/testdir/test_vim9_script.vim
@@ -2095,10 +2095,23 @@ def Test_for_skipped_block()
     BuildDiagrams()
   END
   v9.CheckDefAndScriptSuccess(lines)
 enddef
 
+def Test_skipped_redir()
+  var lines =<< trim END
+      def T()
+        if 0
+          redir =>l[0]
+          redir END
+        endif
+      enddef
+      defcompile
+  END
+  v9.CheckScriptSuccess(lines)
+enddef
+
 def Test_for_loop()
   var lines =<< trim END
       var result = ''
       for cnt in range(7)
         if cnt == 4
diff --git a/src/version.c b/src/version.c
index 1566e4dfcfcf..e477f9e315d0 100644
--- a/src/version.c
+++ b/src/version.c
@@ -729,10 +729,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    224,
 /**/
     223,
 /**/
     222,
 /**/
diff --git a/src/vim9compile.c b/src/vim9compile.c
index d1e2c87fd82c..d8596e99effb 100644
--- a/src/vim9compile.c
+++ b/src/vim9compile.c
@@ -1163,15 +1163,18 @@ generate_loadvar(
 	    break;
 	case dest_vimvar:
 	    generate_LOADV(cctx, name + 2);
 	    break;
 	case dest_local:
-	    if (lvar->lv_from_outer > 0)
-		generate_LOADOUTER(cctx, lvar->lv_idx, lvar->lv_from_outer,
+	    if (cctx->ctx_skip != SKIP_YES)
+	    {
+		if (lvar->lv_from_outer > 0)
+		    generate_LOADOUTER(cctx, lvar->lv_idx, lvar->lv_from_outer,
 									 type);
-	    else
-		generate_LOAD(cctx, ISN_LOAD, lvar->lv_idx, NULL, type);
+		else
+		    generate_LOAD(cctx, ISN_LOAD, lvar->lv_idx, NULL, type);
+	    }
 	    break;
 	case dest_expr:
 	    // list or dict value should already be on the stack.
 	    break;
     }
@@ -1950,10 +1953,13 @@ compile_assign_unlet(
 					    -1, 0, cctx, FALSE, FALSE) == FAIL)
 		return FAIL;
 	}
     }
 
+    if (cctx->ctx_skip == SKIP_YES)
+	return OK;
+
     // Load the dict or list.  On the stack we then have:
     // - value (for assignment, not for :unlet)
     // - index
     // - for [a : b] second index
     // - variable

Vulnerable code: 	    if (lvar->lv_from_outer > 0)
		generate_LOADOUTER(cctx, lvar->lv_idx, lvar->lv_from_outer,
	    else
		generate_LOAD(cctx, ISN_LOAD, lvar->lv_idx, NULL, type);
Fixed code: def Test_skipped_redir()
  var lines =<< trim END
      def T()
        if 0
          redir =>l[0]
          redir END
        endif
      enddef
      defcompile
  END
  v9.CheckScriptSuccess(lines)
enddef

/**/
    224,
	    if (cctx->ctx_skip != SKIP_YES)
	    {
		if (lvar->lv_from_outer > 0)
		    generate_LOADOUTER(cctx, lvar->lv_idx, lvar->lv_from_outer,
		else
		    generate_LOAD(cctx, ISN_LOAD, lvar->lv_idx, NULL, type);
	    }
    if (cctx->ctx_skip == SKIP_YES)
	return OK;