CVE-2022-1927: Buffer Over-read (CWE-126)
value: Buffer Over-read in GitHub repository vim/vim prior to 8.2.
CWE description: The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
CVSS v3 base score: 7.8
Published: 2022-05-29T14:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/ex_docmd.c, src/testdir/test_excmd.vim, src/version.c
Commit date: 2022-05-28 14:25:35 +0100
Commit message: patch 8.2.5037: cursor position may be invalid after "0;" range

Problem:    Cursor position may be invalid after "0;" range.
Solution:   Check the cursor position when it was set by ";" in the range.

Diff: diff --git a/src/ex_docmd.c b/src/ex_docmd.c
index cbf75059e82c..cfb40e8d5cfa 100644
--- a/src/ex_docmd.c
+++ b/src/ex_docmd.c
@@ -3278,21 +3278,23 @@ undo_cmdmod(cmdmod_T *cmod)
     int
 parse_cmd_address(exarg_T *eap, char **errormsg, int silent)
 {
     int		address_count = 1;
     linenr_T	lnum;
+    int		need_check_cursor = FALSE;
+    int		ret = FAIL;
 
     // Repeat for all ',' or ';' separated addresses.
     for (;;)
     {
 	eap->line1 = eap->line2;
 	eap->line2 = default_address(eap);
 	eap->cmd = skipwhite(eap->cmd);
 	lnum = get_address(eap, &eap->cmd, eap->addr_type, eap->skip, silent,
 					eap->addr_count == 0, address_count++);
 	if (eap->cmd == NULL)	// error detected
-	    return FAIL;
+	    goto theend;
 	if (lnum == MAXLNUM)
 	{
 	    if (*eap->cmd == '%')   // '%' - all lines
 	    {
 		++eap->cmd;
@@ -3333,18 +3335,18 @@ parse_cmd_address(exarg_T *eap, char **errormsg, int silent)
 			else
 			{
 			    // there is no Vim command which uses '%' and
 			    // ADDR_WINDOWS or ADDR_TABS
 			    *errormsg = _(e_invalid_range);
-			    return FAIL;
+			    goto theend;
 			}
 			break;
 		    case ADDR_TABS_RELATIVE:
 		    case ADDR_UNSIGNED:
 		    case ADDR_QUICKFIX:
 			*errormsg = _(e_invalid_range);
-			return FAIL;
+			goto theend;
 		    case ADDR_ARGUMENTS:
 			if (ARGCOUNT == 0)
 			    eap->line1 = eap->line2 = 0;
 			else
 			{
@@ -3372,23 +3374,23 @@ parse_cmd_address(exarg_T *eap, char **errormsg, int silent)
 
 		// '*' - visual area
 		if (eap->addr_type != ADDR_LINES)
 		{
 		    *errormsg = _(e_invalid_range);
-		    return FAIL;
+		    goto theend;
 		}
 
 		++eap->cmd;
 		if (!eap->skip)
 		{
 		    fp = getmark('<', FALSE);
 		    if (check_mark(fp) == FAIL)
-			return FAIL;
+			goto theend;
 		    eap->line1 = fp->lnum;
 		    fp = getmark('>', FALSE);
 		    if (check_mark(fp) == FAIL)
-			return FAIL;
+			goto theend;
 		    eap->line2 = fp->lnum;
 		    ++eap->addr_count;
 		}
 	    }
 	}
@@ -3399,14 +3401,17 @@ parse_cmd_address(exarg_T *eap, char **errormsg, int silent)
 	if (*eap->cmd == ';')
 	{
 	    if (!eap->skip)
 	    {
 		curwin->w_cursor.lnum = eap->line2;
+
 		// Don't leave the cursor on an illegal line or column, but do
 		// accept zero as address, so 0;/PATTERN/ works correctly.
+		// Check the cursor position before returning.
 		if (eap->line2 > 0)
 		    check_cursor();
+		need_check_cursor = TRUE;
 	    }
 	}
 	else if (*eap->cmd != ',')
 	    break;
 	++eap->cmd;
@@ -3418,11 +3423,16 @@ parse_cmd_address(exarg_T *eap, char **errormsg, int silent)
 	eap->line1 = eap->line2;
 	// ... but only implicit: really no address given
 	if (lnum == MAXLNUM)
 	    eap->addr_count = 0;
     }
-    return OK;
+    ret = OK;
+
+theend:
+    if (need_check_cursor)
+	check_cursor();
+    return ret;
 }
 
 /*
  * Append "cmd" to the error message in IObuff.
  * Takes care of limiting the length and handling 0xa0, which would be
diff --git a/src/testdir/test_excmd.vim b/src/testdir/test_excmd.vim
index 16d435bf0e66..f55e6a51cf9f 100644
--- a/src/testdir/test_excmd.vim
+++ b/src/testdir/test_excmd.vim
@@ -715,7 +715,15 @@ func Test_address_line_overflow()
   call assert_equal("99\n", @")
 
   bwipe!
 endfunc
 
+" This was leaving the cursor in line zero
+func Test_using_zero_in_range()
+  new
+  norm o00
+  silent!  0;s/\%')
+  bwipe!
+endfunc
+
 
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index ff2ea1acdd2b..6a5b3ccd512f 100644
--- a/src/version.c
+++ b/src/version.c
@@ -732,10 +732,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    5037,
 /**/
     5036,
 /**/
     5035,
 /**/

Vulnerable code: 	    return FAIL;
			    return FAIL;
			return FAIL;
		    return FAIL;
			return FAIL;
			return FAIL;
    return OK;
Fixed code:     int		need_check_cursor = FALSE;
    int		ret = FAIL;
	    goto theend;
			    goto theend;
			goto theend;
		    goto theend;
			goto theend;
			goto theend;

		// Check the cursor position before returning.
		need_check_cursor = TRUE;
    ret = OK;

theend:
    if (need_check_cursor)
	check_cursor();
    return ret;
" This was leaving the cursor in line zero
func Test_using_zero_in_range()
  new
  norm o00
  silent!  0;s/\%')
  bwipe!
endfunc

/**/
    5037,