hitoshura25/cvefixes huggingface dataset:
CVE-2022-1154 (C, published 2022-03-30T12:15Z)
Description: value: Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/vim/vim
Files changed:
src/regexp_bt.c
src/testdir/test_regexp_latin.vim
src/version.c
Commit message: patch 8.2.4646: using buffer line after it has been freed

Problem:    Using buffer line after it has been freed in old regexp engine.
Solution:   After getting mark get the line again.


Vulnerable code:

Fixed code:
		size_t	col = REG_MULTI ? rex.input - rex.line : 0;

		// Line may have been freed, get it again.
		if (REG_MULTI)
		{
		    rex.line = reg_getline(rex.lnum);
		    rex.input = rex.line + col;
		}

  " new engine

  " old engine
  new
  norm O0
  call assert_fails("s/\\%#=1\\%')", 'E486:')
  bwipe!
/**/
    4646,
CVE-2022-1160 (C, published 2022-03-30T19:15Z)
Description: value: heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/scriptfile.c
src/testdir/test_source.vim
src/version.c
Commit message: patch 8.2.4647: "source" can read past end of copied line

Problem:    "source" can read past end of copied line.
Solution:   Add a terminating NUL.


Vulnerable code:

Fixed code:
	    if (ga_grow(&ga, 1) == FAIL)
		break;
	    buf[ga.ga_len++] = NUL;
func Test_source_buffer_long_line()
  " This was reading past the end of the line.
  new
  norm300gr0
  so
  bwipe!
endfunc


/**/
    4647,
CVE-2022-1381 (C, published 2022-04-18T01:15Z)
Description: value: global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/ex_docmd.c
src/testdir/test_ex_mode.vim
src/version.c
Commit message: patch 8.2.4763: using invalid pointer with "V:" in Ex mode

Problem:    Using invalid pointer with "V:" in Ex mode.
Solution:   Correctly handle the command being changed to "+".


Vulnerable code:
	    mch_memmove(cmd_start - 5, cmd_start, eap->cmd - cmd_start);
	    eap->cmd -= 5;
	    mch_memmove(eap->cmd - 1, ":'<,'>", 6);
	    // no modifiers, move the pointer back
	    eap->cmd -= 5;

Fixed code:
    char_u  *orig_cmd = eap->cmd;
    int	    did_plus_cmd = FALSE;
	    did_plus_cmd = TRUE;
	    if (did_plus_cmd)
	    {
		size_t len = STRLEN(cmd_start);

		// Special case: empty command may have been changed to "+":
		//  "'<,'>mod" -> "mod'<,'>+
		mch_memmove(orig_cmd, cmd_start, len);
		STRCPY(orig_cmd + len, "'<,'>+");
	    }
	    else
	    {
		mch_memmove(cmd_start - 5, cmd_start, eap->cmd - cmd_start);
		eap->cmd -= 5;
		mch_memmove(eap->cmd - 1, ":'<,'>", 6);
	    }
	    // No modifiers, move the pointer back.
	    // Special case: empty command may have been changed to "+".
	    if (did_plus_cmd)
		eap->cmd = (char_u *)"'<,'>+";
	    else
		eap->cmd = orig_cmd;
" This was accessing illegal memory when using "+" for eap->cmd.
func Test_empty_command_visual_mode()
  let lines =<< trim END
      r<sfile>
      0norm0V:
      :qall!
  END
  call writefile(lines, 'Xexmodescript')
  call assert_equal(1, RunVim([], [], '-u NONE -e -s -S Xexmodescript'))

  call delete('Xexmodescript')
endfunc

/**/
    4763,
CVE-2022-1420 (C, published 2022-04-21T11:15Z)
Description: value: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-823 \u2014 Use of Out-of-range Pointer Offset
The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.
Repository: https://github.com/vim/vim
Files changed:
src/errors.h
src/eval.c
src/testdir/test_lambda.vim
src/version.c
Commit message: patch 8.2.4774: crash when using a number for lambda name

Problem:    Crash when using a number for lambda name.
Solution:   Check the type of the lambda reference.


Vulnerable code:
	if (**arg == ')')
	    ++*arg;
	else
	    emsg(_(e_missing_closing_paren));
	    ret = FAIL;
    else if (**arg != '(')

Fixed code:
#ifdef FEAT_EVAL
EXTERN char e_string_or_function_required_for_arrow_parens_expr[]
	INIT(= N_("E1275: String or function required for ->(expr)"));
#endif
	if (**arg != ')')
	    emsg(_(e_missing_closing_paren));
	    return FAIL;
	if (rettv->v_type != VAR_STRING && rettv->v_type != VAR_FUNC
					       && rettv->v_type != VAR_PARTIAL)
	    emsg(_(e_string_or_function_required_for_arrow_parens_expr));
	    return FAIL;
	++*arg;

    if (**arg != '(')
  call assert_fails('eval 0->(3)()', "E1275:")
  call assert_fails('eval 0->([3])()', "E1275:")
  call assert_fails('eval 0->({"a": 3})()', "E1275:")
  call assert_fails('eval 0->(xxx)()', "E121:")
/**/
    4774,
CVE-2022-1616 (C, published 2022-05-07T19:15Z)
Description: value: Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/vim/vim
Files changed:
src/ex_docmd.c
src/testdir/test_cmdline.vim
src/version.c
Commit message: patch 8.2.4895: buffer overflow with invalid command with composing chars

Problem:    Buffer overflow with invalid command with composing chars.
Solution:   Check that the whole character fits in the buffer.


Vulnerable code:
    while (*s != NUL && d - IObuff < IOSIZE - 7)

Fixed code:
    while (*s != NUL && d - IObuff + 5 < IOSIZE)
	else if (d - IObuff + (*mb_ptr2len)(s) + 1 >= IOSIZE)
	    break;
" this was going over the end of IObuff
func Test_report_error_with_composing()
  let caught = 'no'
  try
    exe repeat('0', 987) .. "0\xdd\x80\xdd\x80\xdd\x80\xdd\x80"
  catch /E492:/
    let caught = 'yes'
  endtry
  call assert_equal('yes', caught)
endfunc

/**/
    4895,
CVE-2022-1619 (C, published 2022-05-08T10:15Z)
Description: value: Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing software, modify memory, and possible remote execution
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/ex_getln.c
src/testdir/test_cmdline.vim
src/version.c
Commit message: patch 8.2.4899: with latin1 encoding CTRL-W might go before the cmdline

Problem:    With latin1 encoding CTRL-W might go before the start of the
            command line.
Solution:   Check already being at the start of the command line.


Vulnerable code:
	    i = vim_iswordc(p[-1]);
	    while (p > ccline.cmdbuff && !vim_isspace(p[-1])
		    && vim_iswordc(p[-1]) == i)
		--p;

Fixed code:
	    if (p > ccline.cmdbuff)
	    {
		i = vim_iswordc(p[-1]);
		while (p > ccline.cmdbuff && !vim_isspace(p[-1])
			&& vim_iswordc(p[-1]) == i)
		    --p;
	    }

    " This was going before the start in latin1.
    call feedkeys(": \<C-W>\<CR>", 'tx')
/**/
    4899,
CVE-2022-1620 (C, published 2022-05-08T11:15Z)
Description: value: NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash) via a crafted input.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/vim/vim
Files changed:
src/buffer.c
src/testdir/test_buffer.vim
src/version.c
Commit message: patch 8.2.4901: NULL pointer access when using invalid pattern

Problem:    NULL pointer access when using invalid pattern.
Solution:   Check for failed regexp program.


Vulnerable code:
	else

Fixed code:
	else if (rmp->regprog != NULL)
" this was using a NULL pointer after failing to use the pattern
func Test_buf_pattern_invalid()
  vsplit 0000000
  silent! buf [0--]\&\zs*\zs*e
  bwipe!
endfunc

/**/
    4901,
CVE-2022-1621 (C, published 2022-05-10T14:15Z)
Description: value: Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/errors.h
src/mbyte.c
src/spellfile.c
src/testdir/test_spell_utf8.vim
src/version.c
Commit message: patch 8.2.4919: can add invalid bytes with :spellgood

Problem:    Can add invalid bytes with :spellgood.
Solution:   Check for a valid word string.


Vulnerable code:
#if defined(FEAT_GUI_GTK) || defined(PROTO)

Fixed code:
#ifdef FEAT_SPELL
EXTERN char e_illegal_character_in_word[]
	INIT(= N_("E1280: Illegal character in word"));
#endif
#if defined(FEAT_GUI_GTK) || defined(FEAT_SPELL) || defined(PROTO)
    // Avoid adding illegal bytes to the word tree.
    if (enc_utf8 && !utf_valid_string(word, NULL))
	return FAIL;

    if (enc_utf8 && !utf_valid_string(word, NULL))
    {
	emsg(_(e_illegal_character_in_word));
	return;
    }

" Invalid bytes may cause trouble when creating the word list.
func Test_check_for_valid_word()
  call assert_fails("spellgood! 0\xac", 'E1280:')
endfunc

/**/
    4919,
CVE-2022-1629 (C, published 2022-05-10T14:15Z)
Description: value: Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are capable of crashing software, Modify Memory, and possible remote execution
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-126 \u2014 Buffer Over-read
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
Repository: https://github.com/vim/vim
Files changed:
src/testdir/test_textobjects.vim
src/textobject.c
src/version.c
Commit message: patch 8.2.4925: trailing backslash may cause reading past end of line

Problem:    Trailing backslash may cause reading past end of line.
Solution:   Check for NUL after backslash.


Vulnerable code:
  bwipe!

Fixed code:

    " this was going beyond the end of the line
    %del
    sil! norm i"\
    sil! norm i"\
    sil! norm i"\
    call assert_equal('"\', getline(1))

    bwipe!
	{
	    if (line[col] == NUL)
		return -1;
	}
/**/
    4925,
CVE-2022-1674 (C, published 2022-05-12T11:15Z)
Description: value: NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 allows attackers to cause a denial of service (application crash) via a crafted input.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/vim/vim
Files changed:
src/buffer.c
src/testdir/test_buffer.vim
src/version.c
Commit message: patch 8.2.4938: crash when matching buffer with invalid pattern

Problem:    Crash when matching buffer with invalid pattern.
Solution:   Check for NULL regprog.


Vulnerable code:
    if (match == NULL)

Fixed code:
    if (match == NULL && rmp->regprog != NULL)

  vsplit 00000000000000000000000000
  silent! buf [0--]\&\zs*\zs*e
  bwipe!
/**/
    4938,
CVE-2022-1720 (C, published 2022-06-20T15:15Z)
Description: value: Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-126 \u2014 Buffer Over-read
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
Repository: https://github.com/vim/vim
Files changed:
src/normal.c
src/testdir/test_gf.vim
src/version.c
Commit message: patch 8.2.4956: reading past end of line with "gf" in Visual block mode

Problem:    Reading past end of line with "gf" in Visual block mode.
Solution:   Do not include the NUL in the length.


Vulnerable code:
	if (has_mbyte && *lenp > 0)
	    // Correct the length to include all bytes of the last character.
	    *lenp += (*mb_ptr2len)(*pp + (*lenp - 1)) - 1;

Fixed code:
	if (*lenp > 0)
	{
	    if (has_mbyte)
		// Correct the length to include all bytes of the last
		// character.
		*lenp += (*mb_ptr2len)(*pp + (*lenp - 1)) - 1;
	    else if ((*pp)[*lenp - 1] == NUL)
		// Do not include a trailing NUL.
		*lenp -= 1;
	}
  " do not include the NUL at the end 
  call writefile(['x'], 'X')
  let save_enc = &enc
  for enc in ['latin1', 'utf-8']
    exe "set enc=" .. enc
    new
    call setline(1, 'X')
    set nomodified
    exe "normal \<C-V>$gf"
    call assert_equal('X', bufname())
    bwipe!
  endfor
  let &enc = save_enc
  call delete('X')

/**/
    4956,
CVE-2022-1725 (C, published 2022-09-29T03:15Z)
Description: value: NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/vim/vim
Files changed:
src/buffer.c
src/testdir/test_buffer.vim
src/version.c
Commit message: patch 8.2.4959: using NULL regexp program

Problem:    Using NULL regexp program.
Solution:   Check for regexp program becoming NULL in more places.


Vulnerable code:
		if (regmatch.regprog == NULL)
		{
		    vim_free(pat);
		    return -1;
		}
	    if (regmatch.regprog == NULL)
	    {
		if (patc != pat)
		    vim_free(patc);
		return FAIL;
	    }
 * Try matching the regexp in "prog" with file name "name".
    if (name != NULL)

Fixed code:
		{
		    if (regmatch.regprog == NULL)
		    {
			// invalid pattern, possibly after switching engine
			vim_free(pat);
			return -1;
		    }
		}
		{
		    if (regmatch.regprog == NULL)
		    {
			// invalid pattern, possibly after recompiling
			if (patc != pat)
			    vim_free(patc);
			return FAIL;
		    }
		}
 * Note that rmp->regprog may become NULL when switching regexp engine.
 * Try matching the regexp in "rmp->regprog" with file name "name".
 * Note that rmp->regprog may become NULL when switching regexp engine.
    // extra check for valid arguments
    if (name != NULL && rmp->regprog != NULL)

  " similar case with different code path
  split 0
  edit ÿ
  silent! buf [0--]\&\zs*\zs*0
  bwipe!
/**/
    4959,
CVE-2022-1733 (C, published 2022-05-17T17:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4968.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/cindent.c
src/testdir/test_cindent.vim
src/version.c
Commit message: patch 8.2.4968: reading past end of the line when C-indenting

Problem:    Reading past end of the line when C-indenting.
Solution:   Check for NUL.


Vulnerable code:
	    if (p[i] == '\'')		    // check for trailing '

Fixed code:
	    if (p[i - 1] != NUL && p[i] == '\'')    // check for trailing '
" This was reading past the end of the line
func Test_cindent_check_funcdecl()
  new
  sil norm o0('\0=L
  bwipe!
endfunc

/**/
    4968,
CVE-2022-1735 (C, published 2022-05-17T19:15Z)
Description: value: Classic Buffer Overflow in GitHub repository vim/vim prior to 8.2.4969.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/vim/vim
Files changed:
src/change.c
src/edit.c
src/misc2.c
src/proto/misc2.pro
src/testdir/test_visual.vim
src/version.c
Commit message: patch 8.2.4969: changing text in Visual mode may cause invalid memory access

Problem:    Changing text in Visual mode may cause invalid memory access.
Solution:   Check the Visual position after making a change.


Vulnerable code:
	    if (VIsual_active && VIsual.lnum == curwin->w_cursor.lnum)
	    {
		int len = (int)STRLEN(ml_get_curline());

		if (VIsual.col > len)
		{
		    VIsual.col = len;
		    VIsual.coladd = 0;
		}
	    }
#if defined(EXITFREE) || defined(PROTOS)

Fixed code:
    if (VIsual_active)
	check_visual_pos();

	    if (VIsual_active)
		check_visual_pos();
/*
 * Check if VIsual position is valid, correct it if not.
 * Can be called when in Visual mode and a change has been made.
 */
    void
check_visual_pos(void)
{
    if (VIsual.lnum > curbuf->b_ml.ml_line_count)
    {
	VIsual.lnum = curbuf->b_ml.ml_line_count;
	VIsual.col = 0;
	VIsual.coladd = 0;
    }
    else
    {
	int len = (int)STRLEN(ml_get(VIsual.lnum));

	if (VIsual.col > len)
	{
	    VIsual.col = len;
	    VIsual.coladd = 0;
	}
    }
}

#if defined(EXITFREE) || defined(PROTO)
void check_visual_pos(void);
func Test_visual_block_with_substitute()
  " this was reading beyond the end of the line
  new
  norm a0)
  sil! norm  O
  s/)
  sil! norm 
  bwipe!
endfunc

/**/
    4969,
CVE-2022-1769 (C, published 2022-05-17T17:15Z)
Description: value: Buffer Over-read in GitHub repository vim/vim prior to 8.2.4974.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-126 \u2014 Buffer Over-read
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
Repository: https://github.com/vim/vim
Files changed:
src/scriptfile.c
src/testdir/test_source.vim
src/version.c
Commit message: patch 8.2.4974: ":so" command may read after end of buffer

Problem:    ":so" command may read after end of buffer.
Solution:   Compute length of text properly.


Vulnerable code:
	len = ga.ga_len + (int)STRLEN(buf + ga.ga_len);

Fixed code:
	    len = ga.ga_len;
	    len = ga.ga_len + (int)STRLEN(buf + ga.ga_len);

  let lines =<< trim END
      new
      norm 10a0000000000ø00000000000
      norm i0000000000000000000
      silent! so
  END
  call writefile(lines, 'Xtest.vim')
  source Xtest.vim
  bwipe!
  call delete('Xtest.vim')
/**/
    4974,
CVE-2022-1771 (C, published 2022-05-18T20:15Z)
Description: value: Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-674 \u2014 Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
Repository: https://github.com/vim/vim
Files changed:
src/ex_getln.c
src/testdir/test_cmdline.vim
src/version.c
Commit message: patch 8.2.4975: recursive command line loop may cause a crash

Problem:    Recursive command line loop may cause a crash.
Solution:   Limit recursion of getcmdline().


Vulnerable code:

Fixed code:
    static int	depth = 0;	    // call depth
    // one recursion level deeper
    ++depth;

    if (depth == 50)
    {
	// Somehow got into a loop recursively calling getcmdline(), bail out.
	emsg(_(e_command_too_recursive));
	goto theend;
    }

	--depth;
func Test_recursive_register()
  let @= = ''
  silent! ?e/
  let caught = 'no'
  try
    normal // 
  catch /E169:/
    let caught = 'yes'
  endtry
  call assert_equal('yes', caught)
endfunc

/**/
    4975,
CVE-2022-1785 (C, published 2022-05-19T13:15Z)
Description: value: Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.4977.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/vim/vim
Files changed:
src/ex_cmds.c
src/testdir/test_substitute.vim
src/version.c
Commit message: patch 8.2.4977: memory access error when substitute expression changes window

Problem:    Memory access error when substitute expression changes window.
Solution:   Disallow changing window in substitute expression.


Vulnerable code:

Fixed code:

		// Disallow changing text or switching window in an expression.
		++textwinlock;
		--textwinlock;

#ifdef FEAT_EVAL
		++textwinlock;
#endif
#ifdef FEAT_EVAL
		--textwinlock;
#endif
" This was switching windows in between computing the length and using it.
func Test_sub_change_window()
  silent! lfile
  sil! norm o0000000000000000000000000000000000000000000000000000
  func Repl()
    lopen
  endfunc
  silent!  s/\%')/\=Repl()
  bwipe!
  bwipe!
  delfunc Repl
endfunc

/**/
    4977,
CVE-2022-1796 (C, published 2022-05-19T16:15Z)
Description: value: Use After Free in GitHub repository vim/vim prior to 8.2.4979.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/vim/vim
Files changed:
src/testdir/test_tagjump.vim
src/version.c
src/window.c
Commit message: patch 8.2.4979: accessing freed memory when line is flushed

Problem:    Accessing freed memory when line is flushed.
Solution:   Make a copy of the pattern to search for.


Vulnerable code:

Fixed code:
func Test_define_search()
  " this was accessing freed memory
  new
  call setline(1, ['first line', '', '#define something 0'])
  sil norm o0
  sil! norm 
  bwipe!
endfunc

/**/
    4979,

		// Make a copy, if the line was changed it will be freed.
		ptr = vim_strnsave(ptr, len);
		if (ptr == NULL)
		    break;

		vim_free(ptr);