CVE-2023-1127: Divide By Zero (CWE-369)
value: Divide By Zero in GitHub repository vim/vim prior to 9.0.1367.
CWE description: The product divides a value by zero.
CVSS v3 base score: 7.8
Published: 2023-03-01T19:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/move.c, src/testdir/test_window_cmd.vim, src/version.c
Commit date: 2023-03-01 17:55:31 +0000
Commit message: patch 9.0.1367: divide by zero in zero-width window

Problem:    Divide by zero in zero-width window.
Solution:   Check the width is positive.

Diff: diff --git a/src/move.c b/src/move.c
index 921fec6fbfc9..0550ef5d1eca 100644
--- a/src/move.c
+++ b/src/move.c
@@ -1732,11 +1732,11 @@ scrolldown(
 	if (col >= width1)
 	{
 	    col -= width1;
 	    ++row;
 	}
-	if (col > width2)
+	if (col > width2 && width2 > 0)
 	{
 	    row += col / width2;
 	    col = col % width2;
 	}
 	if (row >= curwin->w_height)
diff --git a/src/testdir/test_window_cmd.vim b/src/testdir/test_window_cmd.vim
index 969edff26fcb..3d29266505ba 100644
--- a/src/testdir/test_window_cmd.vim
+++ b/src/testdir/test_window_cmd.vim
@@ -1770,11 +1770,11 @@ func Test_splitkeep_options()
   set equalalways&
   set splitkeep&
   let &t_WS = save_WS
 endfunc
 
-function Test_splitkeep_cmdwin_cursor_position()
+func Test_splitkeep_cmdwin_cursor_position()
   set splitkeep=screen
   call setline(1, range(&lines))
 
   " No scroll when cursor is at near bottom of window and cusor position
   " recompution (done by line('w0') in this test) happens while in cmdwin.
@@ -1795,13 +1795,13 @@ function Test_splitkeep_cmdwin_cursor_position()
   call assert_equal(1, line('.'))
   call assert_equal(1, col('.'))
 
   %bwipeout!
   set splitkeep&
-endfunction
+endfunc
 
-function Test_splitkeep_misc()
+func Test_splitkeep_misc()
   set splitkeep=screen
   set splitbelow
 
   call setline(1, range(1, &lines))
   norm Gzz
@@ -1830,11 +1830,11 @@ function Test_splitkeep_misc()
   %bwipeout!
   set splitbelow&
   set splitkeep&
 endfunc
 
-function Test_splitkeep_callback()
+func Test_splitkeep_callback()
   CheckScreendump
   let lines =<< trim END
     set splitkeep=screen
     call setline(1, range(&lines))
     function C1(a, b)
@@ -1863,11 +1863,11 @@ function Test_splitkeep_callback()
   call VerifyScreenDump(buf, 'Test_splitkeep_callback_4', {})
 
   call StopVimInTerminal(buf)
 endfunc
 
-function Test_splitkeep_fold()
+func Test_splitkeep_fold()
   CheckScreendump
 
   let lines =<< trim END
     set splitkeep=screen
     set foldmethod=marker
@@ -1893,13 +1893,13 @@ function Test_splitkeep_fold()
 
   call term_sendkeys(buf, ":wincmd k\<CR>:quit\<CR>")
   call VerifyScreenDump(buf, 'Test_splitkeep_fold_4', {})
 
   call StopVimInTerminal(buf)
-endfunction
+endfunc
 
-function Test_splitkeep_status()
+func Test_splitkeep_status()
   CheckScreendump
 
   let lines =<< trim END
     call setline(1, ['a', 'b', 'c'])
     set nomodified
@@ -1913,21 +1913,40 @@ function Test_splitkeep_status()
 
   call term_sendkeys(buf, ":call win_move_statusline(win, 1)\<CR>")
   call VerifyScreenDump(buf, 'Test_splitkeep_status_1', {})
 
   call StopVimInTerminal(buf)
-endfunction
+endfunc
 
-function Test_new_help_window_on_error()
+func Test_new_help_window_on_error()
   help change.txt
   execute "normal! /CTRL-@\<CR>"
   silent! execute "normal! \<C-W>]"
 
   let wincount = winnr('$')
   help 'mod'
 
   call assert_equal(wincount, winnr('$'))
   call assert_equal(expand("<cword>"), "'mod'")
-endfunction
+endfunc
+
+func Test_smoothscroll_in_zero_width_window()
+  let save_lines = &lines
+  let save_columns = &columns
+
+  winsize 0 24
+  set cpo+=n
+  exe "noremap 0 \<C-W>n\<C-W>L"
+  norm 000000
+  set number smoothscroll
+  exe "norm \<C-Y>"
+
+  only!
+  let &lines = save_lines
+  let &columns = save_columns
+  set cpo-=n
+  unmap 0
+  set nonumber nosmoothscroll
+endfunc
 
 
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 200779dcdc56..a370b3b11ebf 100644
--- a/src/version.c
+++ b/src/version.c
@@ -693,10 +693,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1367,
 /**/
     1366,
 /**/
     1365,
 /**/

Vulnerable code: 	if (col > width2)
function Test_splitkeep_cmdwin_cursor_position()
endfunction
function Test_splitkeep_misc()
function Test_splitkeep_callback()
function Test_splitkeep_fold()
endfunction
function Test_splitkeep_status()
endfunction
function Test_new_help_window_on_error()
endfunction
Fixed code: 	if (col > width2 && width2 > 0)
func Test_splitkeep_cmdwin_cursor_position()
endfunc
func Test_splitkeep_misc()
func Test_splitkeep_callback()
func Test_splitkeep_fold()
endfunc
func Test_splitkeep_status()
endfunc
func Test_new_help_window_on_error()
endfunc

func Test_smoothscroll_in_zero_width_window()
  let save_lines = &lines
  let save_columns = &columns

  winsize 0 24
  set cpo+=n
  exe "noremap 0 \<C-W>n\<C-W>L"
  norm 000000
  set number smoothscroll
  exe "norm \<C-Y>"

  only!
  let &lines = save_lines
  let &columns = save_columns
  set cpo-=n
  unmap 0
  set nonumber nosmoothscroll
endfunc
/**/
    1367,