CVE-2022-0318: Out-of-bounds Write (CWE-787)
value: Heap-based Buffer Overflow in vim/vim prior to 8.2.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2022-01-21T12:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/ops.c, src/testdir/test_visual.vim, src/version.c
Commit date: 2022-01-20 12:10:48 +0000
Commit message: patch 8.2.4151: reading beyond the end of a line

Problem:    Reading beyond the end of a line.
Solution:   For block insert only use the offset for correcting the length.

Diff: diff --git a/src/ops.c b/src/ops.c
index a9968024901..e0fa344d8ee 100644
--- a/src/ops.c
+++ b/src/ops.c
@@ -527,28 +527,13 @@ block_insert(
 		offset = bdp->textcol + bdp->textlen;
 	    }
 	}
 
 	if (has_mbyte && spaces > 0)
-	{
-	    int off;
+	    // avoid copying part of a multi-byte character
+	    offset -= (*mb_head_off)(oldp, oldp + offset);
 
-	    // Avoid starting halfway a multi-byte character.
-	    if (b_insert)
-	    {
-		off = (*mb_head_off)(oldp, oldp + offset + spaces);
-		spaces -= off;
-		count -= off;
-	    }
-	    else
-	    {
-		// spaces fill the gap, the character that's at the edge moves
-		// right
-		off = (*mb_head_off)(oldp, oldp + offset);
-		offset -= off;
-	    }
-	}
 	if (spaces < 0)  // can happen when the cursor was moved
 	    spaces = 0;
 
 	// Make sure the allocated size matches what is actually copied below.
 	newp = alloc(STRLEN(oldp) + spaces + s_len
diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
index b438fa1e66c..a187aa8e085 100644
--- a/src/testdir/test_visual.vim
+++ b/src/testdir/test_visual.vim
@@ -1307,7 +1307,16 @@ func Test_visual_reselect_with_count()
 
   bwipe!
   call delete('XvisualReselect')
 endfunc
 
+func Test_visual_block_insert_round_off()
+  new
+  " The number of characters are tuned to fill a 4096 byte allocated block,
+  " so that valgrind reports going over the end.
+  call setline(1, ['xxxxx', repeat('0', 1350), "\t", repeat('x', 60)])
+  exe "normal gg0\<C-V>GI" .. repeat('0', 1320) .. "\<Esc>"
+  bwipe!
+endfunc
+
 
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 53f1619f94d..227eaa958e2 100644
--- a/src/version.c
+++ b/src/version.c
@@ -748,10 +748,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4151,
 /**/
     4150,
 /**/
     4149,
 /**/

Vulnerable code: 	{
	    int off;
	    // Avoid starting halfway a multi-byte character.
	    if (b_insert)
	    {
		off = (*mb_head_off)(oldp, oldp + offset + spaces);
		spaces -= off;
		count -= off;
	    }
	    else
	    {
		// spaces fill the gap, the character that's at the edge moves
		// right
		off = (*mb_head_off)(oldp, oldp + offset);
		offset -= off;
	    }
	}
Fixed code: 	    // avoid copying part of a multi-byte character
	    offset -= (*mb_head_off)(oldp, oldp + offset);
func Test_visual_block_insert_round_off()
  new
  " The number of characters are tuned to fill a 4096 byte allocated block,
  " so that valgrind reports going over the end.
  call setline(1, ['xxxxx', repeat('0', 1350), "\t", repeat('x', 60)])
  exe "normal gg0\<C-V>GI" .. repeat('0', 1320) .. "\<Esc>"
  bwipe!
endfunc

/**/
    4151,