CVE-2022-0696: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4428.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-02-21T20:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/evalvars.c, src/proto/window.pro, src/usercmd.c, src/version.c, src/window.c
Commit date: 2022-02-20 20:49:35 +0000
Commit message: patch 8.2.4428: crash when switching tabpage while in the cmdline window

Problem:    Crash when switching tabpage while in the cmdline window.
Solution:   Disallow switching tabpage when in the cmdline window.

Diff: diff --git a/src/evalvars.c b/src/evalvars.c
index 40375588c284..dabd49b675a4 100644
--- a/src/evalvars.c
+++ b/src/evalvars.c
@@ -2197,16 +2197,11 @@ get_user_var_name(expand_T *xp, int idx)
 	    return cat_prefix_varname('g', hi->hi_key);
 	return hi->hi_key;
     }
 
     // b: variables
-    ht =
-#ifdef FEAT_CMDWIN
-	// In cmdwin, the alternative buffer should be used.
-	is_in_cmdwin() ? &prevwin->w_buffer->b_vars->dv_hashtab :
-#endif
-	&curbuf->b_vars->dv_hashtab;
+    ht = &prevwin_curwin()->w_buffer->b_vars->dv_hashtab;
     if (bdone < ht->ht_used)
     {
 	if (bdone++ == 0)
 	    hi = ht->ht_array;
 	else
@@ -2215,16 +2210,11 @@ get_user_var_name(expand_T *xp, int idx)
 	    ++hi;
 	return cat_prefix_varname('b', hi->hi_key);
     }
 
     // w: variables
-    ht =
-#ifdef FEAT_CMDWIN
-	// In cmdwin, the alternative window should be used.
-	is_in_cmdwin() ? &prevwin->w_vars->dv_hashtab :
-#endif
-	&curwin->w_vars->dv_hashtab;
+    ht = &prevwin_curwin()->w_vars->dv_hashtab;
     if (wdone < ht->ht_used)
     {
 	if (wdone++ == 0)
 	    hi = ht->ht_array;
 	else
diff --git a/src/proto/window.pro b/src/proto/window.pro
index 654d36a6e3d6..11c2d47c70bf 100644
--- a/src/proto/window.pro
+++ b/src/proto/window.pro
@@ -1,6 +1,7 @@
 /* window.c */
+win_T *prevwin_curwin(void);
 void do_window(int nchar, long Prenum, int xchar);
 void get_wincmd_addr_type(char_u *arg, exarg_T *eap);
 int win_split(int size, int flags);
 int win_split_ins(int size, int flags, win_T *new_wp, int dir);
 int win_valid_popup(win_T *win);
diff --git a/src/usercmd.c b/src/usercmd.c
index d4a7a9c15074..1ff4d0d49221 100644
--- a/src/usercmd.c
+++ b/src/usercmd.c
@@ -139,15 +139,11 @@ find_ucmd(
 				    // only full match global is accepted.
 
     /*
      * Look for buffer-local user commands first, then global ones.
      */
-    gap =
-#ifdef FEAT_CMDWIN
-	is_in_cmdwin() ? &prevwin->w_buffer->b_ucmds :
-#endif
-	&curbuf->b_ucmds;
+    gap = &prevwin_curwin()->w_buffer->b_ucmds;
     for (;;)
     {
 	for (j = 0; j < gap->ga_len; ++j)
 	{
 	    uc = USER_CMD_GA(gap, j);
@@ -356,15 +352,11 @@ expand_user_command_name(int idx)
  */
     char_u *
 get_user_commands(expand_T *xp UNUSED, int idx)
 {
     // In cmdwin, the alternative buffer should be used.
-    buf_T *buf =
-#ifdef FEAT_CMDWIN
-	is_in_cmdwin() ? prevwin->w_buffer :
-#endif
-	curbuf;
+    buf_T *buf = prevwin_curwin()->w_buffer;
 
     if (idx < buf->b_ucmds.ga_len)
 	return USER_CMD_GA(&buf->b_ucmds, idx)->uc_name;
     idx -= buf->b_ucmds.ga_len;
     if (idx < ucmds.ga_len)
@@ -384,15 +376,11 @@ get_user_command_name(int idx, int cmdidx)
     if (cmdidx == CMD_USER && idx < ucmds.ga_len)
 	return USER_CMD(idx)->uc_name;
     if (cmdidx == CMD_USER_BUF)
     {
 	// In cmdwin, the alternative buffer should be used.
-	buf_T *buf =
-#ifdef FEAT_CMDWIN
-		    is_in_cmdwin() ? prevwin->w_buffer :
-#endif
-		    curbuf;
+	buf_T *buf = prevwin_curwin()->w_buffer;
 
 	if (idx < buf->b_ucmds.ga_len)
 	    return USER_CMD_GA(&buf->b_ucmds, idx)->uc_name;
     }
     return NULL;
@@ -476,15 +464,11 @@ uc_list(char_u *name, size_t name_len)
     int		over;
     long	a;
     garray_T	*gap;
 
     // In cmdwin, the alternative buffer should be used.
-    gap =
-#ifdef FEAT_CMDWIN
-	    is_in_cmdwin() ? &prevwin->w_buffer->b_ucmds :
-#endif
-	    &curbuf->b_ucmds;
+    gap = &prevwin_curwin()->w_buffer->b_ucmds;
     for (;;)
     {
 	for (i = 0; i < gap->ga_len; ++i)
 	{
 	    cmd = USER_CMD_GA(gap, i);
diff --git a/src/version.c b/src/version.c
index c5f5c22f90ac..777476d80dce 100644
--- a/src/version.c
+++ b/src/version.c
@@ -748,10 +748,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4428,
 /**/
     4427,
 /**/
     4426,
 /**/
diff --git a/src/window.c b/src/window.c
index 1f5e7096047c..b00ed977fc04 100644
--- a/src/window.c
+++ b/src/window.c
@@ -108,10 +108,25 @@ log_frame_layout(frame_T *frame)
     if (frame->fr_next != NULL)
 	log_frame_layout(frame->fr_next);
 }
 #endif
 
+/*
+ * Return the current window, unless in the cmdline window and "prevwin" is
+ * set, then return "prevwin".
+ */
+    win_T *
+prevwin_curwin(void)
+{
+    return
+#ifdef FEAT_CMDWIN
+	// In cmdwin, the alternative buffer should be used.
+	is_in_cmdwin() && prevwin != NULL ? prevwin :
+#endif
+	curwin;
+}
+
 /*
  * All CTRL-W window commands are handled here, called from normal_cmd().
  */
     void
 do_window(
@@ -3925,10 +3940,18 @@ win_new_tabpage(int after)
     tabpage_T	*tp = curtab;
     tabpage_T	*prev_tp = curtab;
     tabpage_T	*newtp;
     int		n;
 
+#ifdef FEAT_CMDWIN
+    if (cmdwin_type != 0)
+    {
+	emsg(_(e_invalid_in_cmdline_window));
+	return FAIL;
+    }
+#endif
+
     newtp = alloc_tabpage();
     if (newtp == NULL)
 	return FAIL;
 
     // Remember the current windows in this Tab page.
@@ -4299,10 +4322,11 @@ goto_tabpage(int n)
     {
 	// Not allowed when editing the command line.
 	text_locked_msg();
 	return;
     }
+    CHECK_CMDWIN;
 
     // If there is only one it can't work.
     if (first_tabpage->tp_next == NULL)
     {
 	if (n > 1)
@@ -4366,10 +4390,12 @@ goto_tabpage(int n)
 goto_tabpage_tp(
     tabpage_T	*tp,
     int		trigger_enter_autocmds,
     int		trigger_leave_autocmds)
 {
+    CHECK_CMDWIN;
+
     // Don't repeat a message in another tab page.
     set_keep_msg(NULL, 0);
 
     if (tp != curtab && leave_tabpage(tp->tp_curwin->w_buffer,
 					trigger_leave_autocmds) == OK)

Vulnerable code:     ht =
#ifdef FEAT_CMDWIN
	// In cmdwin, the alternative buffer should be used.
	is_in_cmdwin() ? &prevwin->w_buffer->b_vars->dv_hashtab :
#endif
	&curbuf->b_vars->dv_hashtab;
    ht =
#ifdef FEAT_CMDWIN
	// In cmdwin, the alternative window should be used.
	is_in_cmdwin() ? &prevwin->w_vars->dv_hashtab :
#endif
	&curwin->w_vars->dv_hashtab;
    gap =
#ifdef FEAT_CMDWIN
	is_in_cmdwin() ? &prevwin->w_buffer->b_ucmds :
#endif
	&curbuf->b_ucmds;
    buf_T *buf =
#ifdef FEAT_CMDWIN
	is_in_cmdwin() ? prevwin->w_buffer :
#endif
	curbuf;
	buf_T *buf =
#ifdef FEAT_CMDWIN
		    is_in_cmdwin() ? prevwin->w_buffer :
#endif
		    curbuf;
    gap =
#ifdef FEAT_CMDWIN
	    is_in_cmdwin() ? &prevwin->w_buffer->b_ucmds :
#endif
	    &curbuf->b_ucmds;
Fixed code:     ht = &prevwin_curwin()->w_buffer->b_vars->dv_hashtab;
    ht = &prevwin_curwin()->w_vars->dv_hashtab;
win_T *prevwin_curwin(void);
    gap = &prevwin_curwin()->w_buffer->b_ucmds;
    buf_T *buf = prevwin_curwin()->w_buffer;
	buf_T *buf = prevwin_curwin()->w_buffer;
    gap = &prevwin_curwin()->w_buffer->b_ucmds;
/**/
    4428,
/*
 * Return the current window, unless in the cmdline window and "prevwin" is
 * set, then return "prevwin".
 */
    win_T *
prevwin_curwin(void)
{
    return
#ifdef FEAT_CMDWIN
	// In cmdwin, the alternative buffer should be used.
	is_in_cmdwin() && prevwin != NULL ? prevwin :
#endif
	curwin;
}

#ifdef FEAT_CMDWIN
    if (cmdwin_type != 0)
    {
	emsg(_(e_invalid_in_cmdline_window));
	return FAIL;
    }
#endif

    CHECK_CMDWIN;
    CHECK_CMDWIN;