CVE-2023-1264: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2023-03-07T22:15Z
Repository: https://github.com/vim/vim
Language: Other
Files changed: src/getchar.c, src/testdir/term_util.vim, src/testdir/test_ex_mode.vim, src/version.c
Commit date: 2023-03-07 21:05:04 +0000
Commit message: patch 9.0.1392: using NULL pointer with nested :open command

Problem:    Using NULL pointer with nested :open command.
Solution:   Check that ccline.cmdbuff is not NULL.

Diff: diff --git a/src/getchar.c b/src/getchar.c
index 6645be8a0ebd..dac57eb26c61 100644
--- a/src/getchar.c
+++ b/src/getchar.c
@@ -3105,11 +3105,11 @@ check_end_reg_executing(int advance)
  * K_SPECIAL and CSI may be escaped, need to get two more bytes then.
  */
     static int
 vgetorpeek(int advance)
 {
-    int		c, c1;
+    int		c;
     int		timedout = FALSE;	// waited for more than 'timeoutlen'
 					// for mapping to complete or
 					// 'ttimeoutlen' for complete key code
     int		mapdepth = 0;		// check for recursive mapping
     int		mode_deleted = FALSE;   // set when mode has been deleted
@@ -3472,11 +3472,11 @@ vgetorpeek(int advance)
 		 * If we have a partial match (and are going to wait for more
 		 * input from the user), show the partially matched characters
 		 * to the user with showcmd.
 		 */
 		showcmd_idx = 0;
-		c1 = 0;
+		int showing_partial = FALSE;
 		if (typebuf.tb_len > 0 && advance && !exmode_active)
 		{
 		    if (((State & (MODE_NORMAL | MODE_INSERT))
 						      || State == MODE_LANGMAP)
 			    && State != MODE_HITRETURN)
@@ -3487,11 +3487,11 @@ vgetorpeek(int advance)
 						   + typebuf.tb_len - 1) == 1)
 			{
 			    edit_putchar(typebuf.tb_buf[typebuf.tb_off
 						+ typebuf.tb_len - 1], FALSE);
 			    setcursor(); // put cursor back where it belongs
-			    c1 = 1;
+			    showing_partial = TRUE;
 			}
 			// need to use the col and row from above here
 			old_wcol = curwin->w_wcol;
 			old_wrow = curwin->w_wrow;
 			curwin->w_wcol = new_wcol;
@@ -3504,21 +3504,23 @@ vgetorpeek(int advance)
 			       typebuf.tb_buf[typebuf.tb_off + showcmd_idx++]);
 			curwin->w_wcol = old_wcol;
 			curwin->w_wrow = old_wrow;
 		    }
 
-		    // this looks nice when typing a dead character map
+		    // This looks nice when typing a dead character map.
+		    // There is no actual command line for get_number().
 		    if ((State & MODE_CMDLINE)
+			    && get_cmdline_info()->cmdbuff != NULL
 #if defined(FEAT_CRYPT) || defined(FEAT_EVAL)
 			    && cmdline_star == 0
 #endif
 			    && ptr2cells(typebuf.tb_buf + typebuf.tb_off
 						   + typebuf.tb_len - 1) == 1)
 		    {
 			putcmdline(typebuf.tb_buf[typebuf.tb_off
 						+ typebuf.tb_len - 1], FALSE);
-			c1 = 1;
+			showing_partial = TRUE;
 		    }
 		}
 
 /*
  * get a character: 3. from the user - get it
@@ -3548,15 +3550,16 @@ vgetorpeek(int advance)
 			typebuf.tb_buflen - typebuf.tb_off - typebuf.tb_len - 1,
 			wait_time);
 
 		if (showcmd_idx != 0)
 		    pop_showcmd();
-		if (c1 == 1)
+		if (showing_partial)
 		{
 		    if (State & MODE_INSERT)
 			edit_unputchar();
-		    if (State & MODE_CMDLINE)
+		    if ((State & MODE_CMDLINE)
+					&& get_cmdline_info()->cmdbuff != NULL)
 			unputcmdline();
 		    else
 			setcursor();	// put cursor back where it belongs
 		}
 
diff --git a/src/testdir/term_util.vim b/src/testdir/term_util.vim
index 0f0373184505..88e2b33d083b 100644
--- a/src/testdir/term_util.vim
+++ b/src/testdir/term_util.vim
@@ -53,10 +53,11 @@ endfunc
 "               parts of line 2 and 3 on the display)
 " "rows" - height of the terminal window (max. 20)
 " "cols" - width of the terminal window (max. 78)
 " "statusoff" - number of lines the status is offset from default
 " "wait_for_ruler" - if zero then don't wait for ruler to show
+" "no_clean" - if non-zero then remove "--clean" from the command
 func RunVimInTerminal(arguments, options)
   " If Vim doesn't exit a swap file remains, causing other tests to fail.
   " Remove it here.
   call delete(".swp")
 
@@ -89,10 +90,14 @@ func RunVimInTerminal(arguments, options)
     let reset_u7 = ' --cmd "set t_u7=" '
   endif
 
   let cmd = GetVimCommandCleanTerm() .. reset_u7 .. a:arguments
 
+  if get(a:options, 'no_clean', 0)
+    let cmd = substitute(cmd, '--clean', '', '')
+  endif
+
   let options = #{curwin: 1}
   if &termwinsize == ''
     let options.term_rows = rows
     let options.term_cols = cols
   endif
diff --git a/src/testdir/test_ex_mode.vim b/src/testdir/test_ex_mode.vim
index a6602227638a..d03ec8f2d81d 100644
--- a/src/testdir/test_ex_mode.vim
+++ b/src/testdir/test_ex_mode.vim
@@ -132,10 +132,32 @@ func Test_open_command_flush_line()
   catch /E479/
   endtry
   bwipe!
 endfunc
 
+" FIXME: this doesn't fail without the fix but hangs
+func Skip_Test_open_command_state()
+  " Tricky script that failed because State was not set properly
+  let lines =<< trim END
+      !ls 
+      0scìi
+      so! Xsourced
+      set t_û0=0
+      v/-/o
+  END
+  call writefile(lines, 'XopenScript', '')
+
+  let sourced = ["!f\u0083\x02\<Esc>z=0"]
+  call writefile(sourced, 'Xsourced', 'b')
+
+  CheckRunVimInTerminal
+  let buf = RunVimInTerminal('-u NONE -i NONE -n -m -X -Z -e -s -S XopenScript -c qa!', #{rows: 6, wait_for_ruler: 0, no_clean: 1})
+  sleep 3
+
+  call StopVimInTerminal(buf)
+endfunc
+
 " Test for :g/pat/visual to run vi commands in Ex mode
 " This used to hang Vim before 8.2.0274.
 func Test_Ex_global()
   new
   call setline(1, ['', 'foo', 'bar', 'foo', 'bar', 'foo'])
diff --git a/src/version.c b/src/version.c
index 0270abdc1ebc..9689d8b2df2a 100644
--- a/src/version.c
+++ b/src/version.c
@@ -693,10 +693,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1392,
 /**/
     1391,
 /**/
     1390,
 /**/

Vulnerable code:     int		c, c1;
		c1 = 0;
			    c1 = 1;
		    // this looks nice when typing a dead character map
			c1 = 1;
		if (c1 == 1)
		    if (State & MODE_CMDLINE)
Fixed code:     int		c;
		int showing_partial = FALSE;
			    showing_partial = TRUE;
		    // This looks nice when typing a dead character map.
		    // There is no actual command line for get_number().
			    && get_cmdline_info()->cmdbuff != NULL
			showing_partial = TRUE;
		if (showing_partial)
		    if ((State & MODE_CMDLINE)
					&& get_cmdline_info()->cmdbuff != NULL)
" "no_clean" - if non-zero then remove "--clean" from the command
  if get(a:options, 'no_clean', 0)
    let cmd = substitute(cmd, '--clean', '', '')
  endif

" FIXME: this doesn't fail without the fix but hangs
func Skip_Test_open_command_state()
  " Tricky script that failed because State was not set properly
  let lines =<< trim END
      !ls 
      0scìi
      so! Xsourced
      set t_û0=0
      v/-/o
  END
  call writefile(lines, 'XopenScript', '')

  let sourced = ["!f\u0083\x02\<Esc>z=0"]
  call writefile(sourced, 'Xsourced', 'b')

  CheckRunVimInTerminal
  let buf = RunVimInTerminal('-u NONE -i NONE -n -m -X -Z -e -s -S XopenScript -c qa!', #{rows: 6, wait_for_ruler: 0, no_clean: 1})
  sleep 3

  call StopVimInTerminal(buf)
endfunc

/**/
    1392,