CVE-2022-4292: Use After Free (CWE-416)
value: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.8
Published: 2022-12-05T19:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/spell.c, src/testdir/test_spell.vim, src/version.c
Commit date: 2022-11-14 20:52:14 +0000
Commit message: patch 9.0.0882: using freed memory after SpellFileMissing autocmd uses bwipe

Problem:    Using freed memory after SpellFileMissing autocmd uses bwipe.
Solution:   Bail out if the window no longer exists.

Diff: diff --git a/src/spell.c b/src/spell.c
index 508c3ba38b5..7d8ffe63d8b 100644
--- a/src/spell.c
+++ b/src/spell.c
@@ -2108,12 +2108,12 @@ did_set_spelllang(win_T *wp)
 		(void)spell_load_file(lang, lang, NULL, FALSE);
 	    else
 	    {
 		spell_load_lang(lang);
 		// SpellFileMissing autocommands may do anything, including
-		// destroying the buffer we are using...
-		if (!bufref_valid(&bufref))
+		// destroying the buffer we are using or closing the window.
+		if (!bufref_valid(&bufref) || !win_valid_any_tab(wp))
 		{
 		    ret_msg = N_(e_spellfilemising_autocommand_deleted_buffer);
 		    goto theend;
 		}
 	    }
diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
index 4a7a46c5b39..bd387f11d22 100644
--- a/src/testdir/test_spell.vim
+++ b/src/testdir/test_spell.vim
@@ -157,10 +157,23 @@ func Test_spell_file_missing()
   unlet s:spell_file_missing
   set spell& spelllang&
   %bwipe!
 endfunc
 
+func Test_spell_file_missing_bwipe()
+  " this was using a window that was wiped out in a SpellFileMissing autocmd
+  set spelllang=xy
+  au SpellFileMissing * n0
+  set spell
+  au SpellFileMissing * bw
+  snext somefile
+
+  au! SpellFileMissing
+  bwipe!
+  set nospell spelllang=en
+endfunc
+
 func Test_spelldump()
   " In case the spell file is not found avoid getting the download dialog, we
   " would get stuck at the prompt.
   let g:en_not_found = 0
   augroup TestSpellFileMissing
diff --git a/src/version.c b/src/version.c
index c5e78389a5f..a35a172acee 100644
--- a/src/version.c
+++ b/src/version.c
@@ -693,10 +693,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    882,
 /**/
     881,
 /**/
     880,
 /**/

Vulnerable code: 		// destroying the buffer we are using...
		if (!bufref_valid(&bufref))
Fixed code: 		// destroying the buffer we are using or closing the window.
		if (!bufref_valid(&bufref) || !win_valid_any_tab(wp))
func Test_spell_file_missing_bwipe()
  " this was using a window that was wiped out in a SpellFileMissing autocmd
  set spelllang=xy
  au SpellFileMissing * n0
  set spell
  au SpellFileMissing * bw
  snext somefile

  au! SpellFileMissing
  bwipe!
  set nospell spelllang=en
endfunc

/**/
    882,