CVE-2022-1420: Use of Out-of-range Pointer Offset (CWE-823)
value: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774.
CWE description: The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.
CVSS v3 base score: 5.5
Published: 2022-04-21T11:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/errors.h, src/eval.c, src/testdir/test_lambda.vim, src/version.c
Commit date: 2022-04-17 15:06:35 +0100
Commit message: patch 8.2.4774: crash when using a number for lambda name

Problem:    Crash when using a number for lambda name.
Solution:   Check the type of the lambda reference.

Diff: diff --git a/src/errors.h b/src/errors.h
index b95644a1009f..0c6134034d94 100644
--- a/src/errors.h
+++ b/src/errors.h
@@ -3257,5 +3257,9 @@ EXTERN char e_using_type_not_in_script_context_str[]
 #endif
 EXTERN char e_nfa_regexp_missing_value_in_chr[]
 	INIT(= N_("E1273: (NFA regexp) missing value in '\\%%%c'"));
 EXTERN char e_no_script_file_name_to_substitute_for_script[]
 	INIT(= N_("E1274: No script file name to substitute for \"<script>\""));
+#ifdef FEAT_EVAL
+EXTERN char e_string_or_function_required_for_arrow_parens_expr[]
+	INIT(= N_("E1275: String or function required for ->(expr)"));
+#endif
diff --git a/src/eval.c b/src/eval.c
index cad6887751c2..61b09fb6b0cd 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -4100,23 +4100,27 @@ eval_lambda(
     {
 	// ->(lambda)()
 	++*arg;
 	ret = eval1(arg, rettv, evalarg);
 	*arg = skipwhite_and_linebreak(*arg, evalarg);
-	if (**arg == ')')
+	if (**arg != ')')
 	{
-	    ++*arg;
+	    emsg(_(e_missing_closing_paren));
+	    return FAIL;
 	}
-	else
+	if (rettv->v_type != VAR_STRING && rettv->v_type != VAR_FUNC
+					       && rettv->v_type != VAR_PARTIAL)
 	{
-	    emsg(_(e_missing_closing_paren));
-	    ret = FAIL;
+	    emsg(_(e_string_or_function_required_for_arrow_parens_expr));
+	    return FAIL;
 	}
+	++*arg;
     }
     if (ret != OK)
 	return FAIL;
-    else if (**arg != '(')
+
+    if (**arg != '(')
     {
 	if (verbose)
 	{
 	    if (*skipwhite(*arg) == '(')
 		emsg(_(e_no_white_space_allowed_before_parenthesis));
diff --git a/src/testdir/test_lambda.vim b/src/testdir/test_lambda.vim
index e6dcb6774c37..8d06e5973c18 100644
--- a/src/testdir/test_lambda.vim
+++ b/src/testdir/test_lambda.vim
@@ -64,10 +64,14 @@ function Test_lambda_fails()
   call assert_fails('echo {a, a -> a + a}(1, 2)', 'E853:')
   call assert_fails('echo {a, b -> a + b)}(1, 2)', 'E451:')
   echo assert_fails('echo 10->{a -> a + 2}', 'E107:')
 
   call assert_fails('eval 0->(', "E110: Missing ')'")
+  call assert_fails('eval 0->(3)()', "E1275:")
+  call assert_fails('eval 0->([3])()', "E1275:")
+  call assert_fails('eval 0->({"a": 3})()', "E1275:")
+  call assert_fails('eval 0->(xxx)()', "E121:")
 endfunc
 
 func Test_not_lamda()
   let x = {'>' : 'foo'}
   call assert_equal('foo', x['>'])
diff --git a/src/version.c b/src/version.c
index bdefc25f31e6..43e85e7a7cd5 100644
--- a/src/version.c
+++ b/src/version.c
@@ -744,10 +744,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4774,
 /**/
     4773,
 /**/
     4772,
 /**/

Vulnerable code: 	if (**arg == ')')
	    ++*arg;
	else
	    emsg(_(e_missing_closing_paren));
	    ret = FAIL;
    else if (**arg != '(')
Fixed code: #ifdef FEAT_EVAL
EXTERN char e_string_or_function_required_for_arrow_parens_expr[]
	INIT(= N_("E1275: String or function required for ->(expr)"));
#endif
	if (**arg != ')')
	    emsg(_(e_missing_closing_paren));
	    return FAIL;
	if (rettv->v_type != VAR_STRING && rettv->v_type != VAR_FUNC
					       && rettv->v_type != VAR_PARTIAL)
	    emsg(_(e_string_or_function_required_for_arrow_parens_expr));
	    return FAIL;
	++*arg;

    if (**arg != '(')
  call assert_fails('eval 0->(3)()', "E1275:")
  call assert_fails('eval 0->([3])()', "E1275:")
  call assert_fails('eval 0->({"a": 3})()', "E1275:")
  call assert_fails('eval 0->(xxx)()', "E121:")
/**/
    4774,