CVE-2022-2522: Heap-based Buffer Overflow (CWE-122)
value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 7.8
Published: 2022-07-25T14:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/autocmd.c, src/proto/window.pro, src/testdir/test_autocmd.vim, src/version.c, src/window.c
Commit date: 2022-07-23 09:06:48 +0100
Commit message: patch 9.0.0061: ml_get error with nested autocommand

Problem:    ml_get error with nested autocommand.
Solution:   Also check line numbers for a nested autocommand. (closes #10761)

Diff: diff --git a/src/autocmd.c b/src/autocmd.c
index 841da146226c..c376f20a2314 100644
--- a/src/autocmd.c
+++ b/src/autocmd.c
@@ -2207,13 +2207,17 @@ apply_autocmds_group(
 	// are added when executing autocommands
 	for (ap = patcmd.curpat; ap->next != NULL; ap = ap->next)
 	    ap->last = FALSE;
 	ap->last = TRUE;
 
+	// Make sure cursor and topline are valid.  The first time the current
+	// values are saved, restored by reset_lnums().  When nested only the
+	// values are corrected when needed.
 	if (nesting == 1)
-	    // make sure cursor and topline are valid
 	    check_lnums(TRUE);
+	else
+	    check_lnums_nested(TRUE);
 
 	save_did_emsg = did_emsg;
 
 	do_cmdline(NULL, getnextac, (void *)&patcmd,
 				     DOCMD_NOWAIT|DOCMD_VERBOSE|DOCMD_REPEAT);
diff --git a/src/proto/window.pro b/src/proto/window.pro
index 9625942feaca..8fa86616855e 100644
--- a/src/proto/window.pro
+++ b/src/proto/window.pro
@@ -75,10 +75,11 @@ void command_height(void);
 void last_status(int morewin);
 int tabline_height(void);
 int min_rows(void);
 int only_one_window(void);
 void check_lnums(int do_curwin);
+void check_lnums_nested(int do_curwin);
 void reset_lnums(void);
 void make_snapshot(int idx);
 void restore_snapshot(int idx, int close_curwin);
 int win_hasvertsplit(void);
 int get_win_number(win_T *wp, win_T *first_win);
diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
index e9a59c29a6b2..1202c058dadc 100644
--- a/src/testdir/test_autocmd.vim
+++ b/src/testdir/test_autocmd.vim
@@ -2299,10 +2299,29 @@ func Test_autocmd_nested()
 
   call assert_fails('au WinNew * ++nested ++nested echo bad', 'E983:')
   call assert_fails('au WinNew * nested nested echo bad', 'E983:')
 endfunc
 
+func Test_autocmd_nested_cursor_invalid()
+  set laststatus=0
+  copen
+  cclose
+  call setline(1, ['foo', 'bar', 'baz'])
+  3
+  augroup nested_inv
+    autocmd User foo ++nested copen
+    autocmd BufAdd * let &laststatus = 2 - &laststatus
+  augroup END
+  doautocmd User foo
+
+  augroup nested_inv
+    au!
+  augroup END
+  set laststatus&
+  bwipe!
+endfunc
+
 func Test_autocmd_once()
   " Without ++once WinNew triggers twice
   let g:did_split = 0
   augroup Testing
     au WinNew * let g:did_split += 1
diff --git a/src/version.c b/src/version.c
index b6e61f50ef16..46d964312fb5 100644
--- a/src/version.c
+++ b/src/version.c
@@ -733,10 +733,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    61,
 /**/
     60,
 /**/
     59,
 /**/
diff --git a/src/window.c b/src/window.c
index c91ebbcfe579..e7b44abd16b6 100644
--- a/src/window.c
+++ b/src/window.c
@@ -6768,38 +6768,59 @@ only_one_window(void)
 	    ++count;
     return (count <= 1);
 }
 
 /*
- * Correct the cursor line number in other windows.  Used after changing the
- * current buffer, and before applying autocommands.
- * When "do_curwin" is TRUE, also check current window.
+ * Implementation of check_lnums() and check_lnums_nested().
  */
-    void
-check_lnums(int do_curwin)
+    static void
+check_lnums_both(int do_curwin, int nested)
 {
     win_T	*wp;
     tabpage_T	*tp;
 
     FOR_ALL_TAB_WINDOWS(tp, wp)
 	if ((do_curwin || wp != curwin) && wp->w_buffer == curbuf)
 	{
-	    // save the original cursor position and topline
-	    wp->w_save_cursor.w_cursor_save = wp->w_cursor;
-	    wp->w_save_cursor.w_topline_save = wp->w_topline;
+	    if (!nested)
+	    {
+		// save the original cursor position and topline
+		wp->w_save_cursor.w_cursor_save = wp->w_cursor;
+		wp->w_save_cursor.w_topline_save = wp->w_topline;
+	    }
 
 	    if (wp->w_cursor.lnum > curbuf->b_ml.ml_line_count)
 		wp->w_cursor.lnum = curbuf->b_ml.ml_line_count;
 	    if (wp->w_topline > curbuf->b_ml.ml_line_count)
 		wp->w_topline = curbuf->b_ml.ml_line_count;
 
-	    // save the corrected cursor position and topline
+	    // save the (corrected) cursor position and topline
 	    wp->w_save_cursor.w_cursor_corr = wp->w_cursor;
 	    wp->w_save_cursor.w_topline_corr = wp->w_topline;
 	}
 }
 
+/*
+ * Correct the cursor line number in other windows.  Used after changing the
+ * current buffer, and before applying autocommands.
+ * When "do_curwin" is TRUE, also check current window.
+ */
+    void
+check_lnums(int do_curwin)
+{
+    check_lnums_both(do_curwin, FALSE);
+}
+
+/*
+ * Like check_lnums() but for when check_lnums() was already called.
+ */
+    void
+check_lnums_nested(int do_curwin)
+{
+    check_lnums_both(do_curwin, TRUE);
+}
+
 /*
  * Reset cursor and topline to its stored values from check_lnums().
  * check_lnums() must have been called first!
  */
     void

Vulnerable code: 	    // make sure cursor and topline are valid
 * Correct the cursor line number in other windows.  Used after changing the
 * current buffer, and before applying autocommands.
 * When "do_curwin" is TRUE, also check current window.
    void
check_lnums(int do_curwin)
	    // save the original cursor position and topline
	    wp->w_save_cursor.w_cursor_save = wp->w_cursor;
	    wp->w_save_cursor.w_topline_save = wp->w_topline;
	    // save the corrected cursor position and topline
Fixed code: 	// Make sure cursor and topline are valid.  The first time the current
	// values are saved, restored by reset_lnums().  When nested only the
	// values are corrected when needed.
	else
	    check_lnums_nested(TRUE);
void check_lnums_nested(int do_curwin);
func Test_autocmd_nested_cursor_invalid()
  set laststatus=0
  copen
  cclose
  call setline(1, ['foo', 'bar', 'baz'])
  3
  augroup nested_inv
    autocmd User foo ++nested copen
    autocmd BufAdd * let &laststatus = 2 - &laststatus
  augroup END
  doautocmd User foo

  augroup nested_inv
    au!
  augroup END
  set laststatus&
  bwipe!
endfunc

/**/
    61,
 * Implementation of check_lnums() and check_lnums_nested().
    static void
check_lnums_both(int do_curwin, int nested)
	    if (!nested)
	    {
		// save the original cursor position and topline
		wp->w_save_cursor.w_cursor_save = wp->w_cursor;
		wp->w_save_cursor.w_topline_save = wp->w_topline;
	    }
	    // save the (corrected) cursor position and topline
/*
 * Correct the cursor line number in other windows.  Used after changing the
 * current buffer, and before applying autocommands.
 * When "do_curwin" is TRUE, also check current window.
 */
    void
check_lnums(int do_curwin)
{
    check_lnums_both(do_curwin, FALSE);
}

/*
 * Like check_lnums() but for when check_lnums() was already called.
 */
    void
check_lnums_nested(int do_curwin)
{
    check_lnums_both(do_curwin, TRUE);
}