hitoshura25/cvefixes huggingface dataset:
CVE-2022-0158 (C, published 2022-01-10T16:15Z)
Description: value: vim is vulnerable to Heap-based Buffer Overflow
Severity: MEDIUM (CVSS v3 base score: 3.3)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/testdir/test_vim9_expr.vim
src/version.c
src/vim9expr.c
Commit message: patch 8.2.4049: Vim9: reading before the start of the line with "$"

Problem:    Vim9: reading before the start of the line with "$" by itself.
Solution:   Do not subtract one when reporting the error.


Vulnerable code:
	semsg(_(e_syntax_error_at_str), start - 1);

Fixed code:
  CheckDefAndScriptFailure(["$"], ['E1002:', 'E15:'], 1)
/**/
    4049,
	semsg(_(e_syntax_error_at_str), start);
CVE-2022-0213 (C, published 2022-01-14T13:15Z)
Description: value: vim is vulnerable to Heap-based Buffer Overflow
Severity: MEDIUM (CVSS v3 base score: 6.6)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/drawscreen.c
src/testdir/test_edit.vim
src/version.c
Commit message: patch 8.2.4074: going over the end of NameBuff

Problem:    Going over the end of NameBuff.
Solution:   Check length when appending a space.


Vulnerable code:
	if (bt_help(wp->w_buffer)
		|| wp->w_p_pvw
		|| bufIsChanged(wp->w_buffer)
		|| wp->w_buffer->b_p_ro)

Fixed code:
	if ((bt_help(wp->w_buffer)
		    || wp->w_p_pvw
		    || bufIsChanged(wp->w_buffer)
		    || wp->w_buffer->b_p_ro)
		&& len < MAXPATHL - 1)
" Weird long file name was going over the end of NameBuff
func Test_edit_overlong_file_name()
  CheckUnix

  file 0000000000000000000000000000
  file %%%%%%%%%%%%%%%%%%%%%%%%%%
  file %%%%%%
  set readonly
  set ls=2 

  redraw!
  set noreadonly ls&
  bwipe!
endfunc

/**/
    4074,
CVE-2022-0261 (C, published 2022-01-18T16:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/vim/vim
Files changed:
src/ops.c
src/testdir/test_visual.vim
src/version.c
Commit message: patch 8.2.4120: block insert goes over the end of the line

Problem:    Block insert goes over the end of the line.
Solution:   Handle invalid byte better.  Fix inserting the wrong text.


Vulnerable code:
		off = (*mb_off_next)(oldp, oldp + offset);
		offset += off;
	    spaces -= off;
	    count -= off;
	newp = alloc(STRLEN(oldp) + s_len + count + 1);
	mch_memmove(newp, oldp, (size_t)(offset));
	if (spaces && !bdp->is_short)
	    // insert post-padding
	    vim_memset(newp + offset + spaces, ' ', (size_t)(ts_val - spaces));
	    // We're splitting a TAB, don't copy it.
	    oldp++;
	    // We allowed for that TAB, remember this now
	    count++;
			&& oap->end.col + oap->end.coladd

Fixed code:
		spaces -= off;
		count -= off;
		// spaces fill the gap, the character that's at the edge moves
		// right
		off = (*mb_head_off)(oldp, oldp + offset);
		offset -= off;
	// Make sure the allocated size matches what is actually copied below.
	newp = alloc(STRLEN(oldp) + spaces + s_len
		    + (spaces > 0 && !bdp->is_short ? ts_val - spaces : 0)
								  + count + 1);
	mch_memmove(newp, oldp, (size_t)offset);
	if (spaces > 0 && !bdp->is_short)
	    if (*oldp == TAB)
	    {
		// insert post-padding
		vim_memset(newp + offset + spaces, ' ',
						    (size_t)(ts_val - spaces));
		// we're splitting a TAB, don't copy it
		oldp++;
		// We allowed for that TAB, remember this now
		count++;
	    }
	    else
		// Not a TAB, no extra spaces
		count = spaces;
			&& oap->start.col + oap->start.coladd
func Test_visual_block_append_invalid_char()
  " this was going over the end of the line
  new
  call setline(1, ['	   let xxx', 'xxxxx', 'xxxxxxxxxxx'])
  exe "normal 0\<C-V>jjA-\<Esc>"
  call assert_equal(['	-   let xxx', 'xxxxx   -', 'xxxxxxxx-xxx'], getline(1, 3))
  bwipe!
endfunc

/**/
    4120,
CVE-2022-0318 (C, published 2022-01-21T12:15Z)
Description: value: Heap-based Buffer Overflow in vim/vim prior to 8.2.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/vim/vim
Files changed:
src/ops.c
src/testdir/test_visual.vim
src/version.c
Commit message: patch 8.2.4151: reading beyond the end of a line

Problem:    Reading beyond the end of a line.
Solution:   For block insert only use the offset for correcting the length.


Vulnerable code:
	{
	    int off;
	    // Avoid starting halfway a multi-byte character.
	    if (b_insert)
	    {
		off = (*mb_head_off)(oldp, oldp + offset + spaces);
		spaces -= off;
		count -= off;
	    }
	    else
	    {
		// spaces fill the gap, the character that's at the edge moves
		// right
		off = (*mb_head_off)(oldp, oldp + offset);
		offset -= off;
	    }
	}

Fixed code:
	    // avoid copying part of a multi-byte character
	    offset -= (*mb_head_off)(oldp, oldp + offset);
func Test_visual_block_insert_round_off()
  new
  " The number of characters are tuned to fill a 4096 byte allocated block,
  " so that valgrind reports going over the end.
  call setline(1, ['xxxxx', repeat('0', 1350), "\t", repeat('x', 60)])
  exe "normal gg0\<C-V>GI" .. repeat('0', 1320) .. "\<Esc>"
  bwipe!
endfunc

/**/
    4151,
CVE-2022-0319 (C, published 2022-01-21T14:15Z)
Description: value: Out-of-bounds Read in vim/vim prior to 8.2.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/vim/vim
Files changed:
src/testdir/test_visual.vim
src/version.c
src/window.c
Commit message: patch 8.2.4154: ml_get error when exchanging windows in Visual mode

Problem:    ml_get error when exchanging windows in Visual mode.
Solution:   Correct end of Visual area when entering another buffer.


Vulnerable code:
    wp->w_lines = ALLOC_CLEAR_MULT(wline_T, Rows );

Fixed code:
" this was causing an ml_get error
func Test_visual_exchange_windows()
  enew!
  new
  call setline(1, ['foo', 'bar'])
  exe "normal G\<C-V>gg\<C-W>\<C-X>OO\<Esc>"
  bwipe!
  bwipe!
endfunc

/**/
    4154,
    if (wp->w_buffer != curbuf)
	reset_VIsual_and_resel();
    else if (VIsual_active)
	wp->w_cursor = curwin->w_cursor;

    wp->w_lines = ALLOC_CLEAR_MULT(wline_T, Rows);
CVE-2022-0351 (C, published 2022-01-25T18:15Z)
Description: value: Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/vim/vim
Files changed:
src/errors.h
src/eval.c
src/testdir/test_eval_stuff.vim
src/version.c
Commit message: patch 8.2.4206: condition with many "(" causes a crash

Problem:    Condition with many "(" causes a crash.
Solution:   Limit recursion to 1000.


Vulnerable code:
// E1169 unused

Fixed code:
// E1045 not used
// E1046 not used
// E1082 unused
// E1142 unused
EXTERN char e_expression_too_recursive_str[]
	INIT(= N_("E1169: Expression too recursive: %s"));
    static	int recurse = 0;
    // Limit recursion to 1000 levels.  At least at 10000 we run out of stack
    // and crash.
    if (recurse == 1000)
    {
	semsg(_(e_expression_too_recursive_str), *arg);
	return FAIL;
    }
    ++recurse;


    --recurse;
func Test_deep_recursion()
  " this was running out of stack
  call assert_fails("exe 'if ' .. repeat('(', 1002)", 'E1169: Expression too recursive: ((')
endfunc

/**/
    4206,
CVE-2022-0361 (C, published 2022-01-26T13:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/ex_cmds.c
src/testdir/test_visual.vim
src/version.c
Commit message: patch 8.2.4215: illegal memory access when copying lines in Visual mode

Problem:    Illegal memory access when copying lines in Visual mode.
Solution:   Adjust the Visual position after copying lines.


Vulnerable code:

Fixed code:
    if (VIsual_active)
	check_pos(curbuf, &VIsual);
" this was leaving the end of the Visual area beyond the end of a line
func Test_visual_ex_copy_line()
  new
  call setline(1, ["aaa", "bbbbbbbbbxbb"])
  /x
  exe "normal ggvjfxO"
  t0
  normal gNU
  bwipe!
endfunc

/**/
    4215,
CVE-2022-0368 (C, published 2022-01-26T18:15Z)
Description: value: Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/vim/vim
Files changed:
src/testdir/test_visual.vim
src/undo.c
src/version.c
Commit message: patch 8.2.4217: illegal memory access when undo makes Visual area invalid

Problem:    Illegal memory access when undo makes Visual area invalid.
Solution:   Correct the Visual area after undo.


Vulnerable code:

Fixed code:
" This was leaving the end of the Visual area beyond the end of a line.
" Set 'undolevels' to start a new undo block.
func Test_visual_undo_deletes_last_line()
  new
  call setline(1, ["aaa", "ccc", "dyd"])
  set undolevels=100
  exe "normal obbbbbbbbbxbb\<Esc>"
  set undolevels=100
  /y
  exe "normal ggvjfxO"
  undo
  normal gNU
  bwipe!
endfunc

    if (VIsual_active)
	check_pos(curbuf, &VIsual);
/**/
    4217,
CVE-2022-0392 (C, published 2022-01-28T22:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository vim prior to 8.2.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/edit.c
src/testdir/test_paste.vim
src/version.c
Commit message: patch 8.2.4218: illegal memory access with bracketed paste in Ex mode

Problem:    Illegal memory access with bracketed paste in Ex mode.
Solution:   Reserve space for the trailing NUL.


Vulnerable code:
		    if (gap != NULL && ga_grow(gap, idx) == OK)

Fixed code:
		    // add one for the NUL that is going to be appended
		    if (gap != NULL && ga_grow(gap, idx + 1) == OK)

  " pasting more than 40 bytes
  exe "norm Q\<PasteStart>0000000000000000000000000000000000000000000000000000000000000000000000\<C-C>"
/**/
    4218,
CVE-2022-0408 (C, published 2022-01-30T15:15Z)
Description: value: Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-121 \u2014 Stack-based Buffer Overflow
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Repository: https://github.com/vim/vim
Files changed:
src/spellsuggest.c
src/testdir/test_spell.vim
src/version.c
Commit message: patch 8.2.4247: stack corruption when looking for spell suggestions

Problem:    Stack corruption when looking for spell suggestions.
Solution:   Prevent the depth increased too much.  Add a five second time
            limit to finding suggestions.


Vulnerable code:
		(stack[depth].ts_score + (add) < su->su_maxscore)
		if (byts[arridx] == 0 || n == (int)STATE_NOPREFIX)

Fixed code:
	   (depth < MAXWLEN && stack[depth].ts_score + (add) < su->su_maxscore)
#ifdef FEAT_RELTIME
    proftime_T	time_limit;
#endif
#ifdef FEAT_RELTIME
    // The loop may take an indefinite amount of time. Break out after five
    // sectonds. TODO: add an option for the time limit.
    profile_setlimit(5000, &time_limit);
#endif
		if (depth < MAXWLEN
			    && (byts[arridx] == 0 || n == (int)STATE_NOPREFIX))
#ifdef FEAT_RELTIME
		if (profile_passed_limit(&time_limit))
		    got_int = TRUE;
#endif
func Test_spellsuggest_too_deep()
  " This was incrementing "depth" over MAXWLEN.
  new
  norm s000G00ý000000000000
  sil norm ..vzG................vvzG0     v z=
  bwipe!
endfunc

/**/
    4247,
CVE-2022-0417 (C, published 2022-02-01T13:15Z)
Description: value: Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/indent.c
src/option.c
src/testdir/test_options.vim
src/version.c
src/vim.h
Commit message: patch 8.2.4245: ":retab 0" may cause illegal memory access

Problem:    ":retab 0" may cause illegal memory access.
Solution:   Limit the value of 'tabstop' to 10000.


Vulnerable code:
	if (n < 0 || n > 9999)
    if (new_ts < 0 || new_ts > 9999)
		buf->b_p_vsts_array = 0;
	    if (buf->b_p_vsts_array)
		vim_free(buf->b_p_vsts_array);
	    buf->b_p_vsts_array = 0;
	    if (buf->b_p_vsts_array)
		vim_free(buf->b_p_vsts_array);
		buf->b_p_vsts_array = 0;

Fixed code:
	if (n < 0 || n > TABSTOP_MAX)
    if (new_ts < 0 || new_ts > TABSTOP_MAX)
    else if (curbuf->b_p_ts > TABSTOP_MAX)
    {
	errmsg = e_invalid_argument;
	curbuf->b_p_ts = 8;
    }
		buf->b_p_vsts_array = NULL;
	    VIM_CLEAR(buf->b_p_vsts_array);
	    vim_free(buf->b_p_vsts_array);
		buf->b_p_vsts_array = NULL;
  call assert_fails('set tabstop=10000', 'E474:')
  call assert_fails('set tabstop=5500000000', 'E474:')
/**/
    4245,
#define TABSTOP_MAX 9999
CVE-2022-0572 (C, published 2022-02-14T12:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/vim/vim
Files changed:
src/indent.c
src/testdir/test_retab.vim
src/version.c
Commit message: patch 8.2.4359: crash when repeatedly using :retab

Problem:    crash when repeatedly using :retab.
Solution:   Bail out when the line is getting too long.


Vulnerable code:

Fixed code:
	    if (vcol >= MAXCOL)
	    {
		emsg(_(e_resulting_text_too_long));
		break;
	    }

  set tabstop& expandtab&
func Test_retab_endless()
  new
  call setline(1, "\t0\t")
  let caught = 'no'
  try
    while 1
      set ts=4000
      retab 4
    endwhile
  catch /E1240/
    let caught = 'yes'
  endtry
  bwipe!
  set tabstop&
endfunc


/**/
    4359,
CVE-2022-0629 (C, published 2022-02-17T12:15Z)
Description: value: Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-121 \u2014 Stack-based Buffer Overflow
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Repository: https://github.com/vim/vim
Files changed:
src/testdir/test_assert.vim
src/testing.c
src/version.c
Commit message: patch 8.2.4397: crash when using many composing characters in error message

Problem:    Crash when using many composing characters in error message.
Solution:   Use mb_cptr2char_adv() instead of mb_ptr2char_adv().


Vulnerable code:
	c = mb_ptr2char_adv(&s);

Fixed code:

  " many composing characters are handled properly
  call setline(1, ' ')
  norm 100gr݀
  call assert_equal(1, getline(1))
  call assert_match("Expected 1 but got '.* occurs 100 times]'", v:errors[0])
  call remove(v:errors, 0)
  bwipe!
	c = mb_cptr2char_adv(&s);
/**/
    4397,
CVE-2022-0685 (C, published 2022-02-20T11:15Z)
Description: value: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-823 \u2014 Use of Out-of-range Pointer Offset
The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.
Repository: https://github.com/vim/vim
Files changed:
src/charset.c
src/filepath.c
src/proto/charset.pro
src/testdir/test_autochdir.vim
src/version.c
Commit message: patch 8.2.4418: crash when using special multi-byte character

Problem:    Crash when using special multi-byte character.
Solution:   Don't use isalpha() for an arbitrary character.


Vulnerable code:
					     && isalpha(PTR2CHAR(path_end)))))
void ebcdic2ascii(char_u *buffer, int len);

Fixed code:
    int
vim_isalpha(int c)
{
    return vim_islower(c) || vim_isupper(c);
}

					  && vim_isalpha(PTR2CHAR(path_end)))))
int vim_isalpha(int c);
func Test_multibyte()
  " using an invalid character should not cause a crash
  set wic
  call assert_fails('tc û¦*', 'E344:')
  set nowic
endfunc


/**/
    4418,
CVE-2022-0696 (C, published 2022-02-21T20:15Z)
Description: value: NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4428.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/vim/vim
Files changed:
src/evalvars.c
src/proto/window.pro
src/usercmd.c
src/version.c
src/window.c
Commit message: patch 8.2.4428: crash when switching tabpage while in the cmdline window

Problem:    Crash when switching tabpage while in the cmdline window.
Solution:   Disallow switching tabpage when in the cmdline window.


Vulnerable code:
    ht =
#ifdef FEAT_CMDWIN
	// In cmdwin, the alternative buffer should be used.
	is_in_cmdwin() ? &prevwin->w_buffer->b_vars->dv_hashtab :
#endif
	&curbuf->b_vars->dv_hashtab;
    ht =
#ifdef FEAT_CMDWIN
	// In cmdwin, the alternative window should be used.
	is_in_cmdwin() ? &prevwin->w_vars->dv_hashtab :
#endif
	&curwin->w_vars->dv_hashtab;
    gap =
#ifdef FEAT_CMDWIN
	is_in_cmdwin() ? &prevwin->w_buffer->b_ucmds :
#endif
	&curbuf->b_ucmds;
    buf_T *buf =
#ifdef FEAT_CMDWIN
	is_in_cmdwin() ? prevwin->w_buffer :
#endif
	curbuf;
	buf_T *buf =
#ifdef FEAT_CMDWIN
		    is_in_cmdwin() ? prevwin->w_buffer :
#endif
		    curbuf;
    gap =
#ifdef FEAT_CMDWIN
	    is_in_cmdwin() ? &prevwin->w_buffer->b_ucmds :
#endif
	    &curbuf->b_ucmds;

Fixed code:
    ht = &prevwin_curwin()->w_buffer->b_vars->dv_hashtab;
    ht = &prevwin_curwin()->w_vars->dv_hashtab;
win_T *prevwin_curwin(void);
    gap = &prevwin_curwin()->w_buffer->b_ucmds;
    buf_T *buf = prevwin_curwin()->w_buffer;
	buf_T *buf = prevwin_curwin()->w_buffer;
    gap = &prevwin_curwin()->w_buffer->b_ucmds;
/**/
    4428,
/*
 * Return the current window, unless in the cmdline window and "prevwin" is
 * set, then return "prevwin".
 */
    win_T *
prevwin_curwin(void)
{
    return
#ifdef FEAT_CMDWIN
	// In cmdwin, the alternative buffer should be used.
	is_in_cmdwin() && prevwin != NULL ? prevwin :
#endif
	curwin;
}

#ifdef FEAT_CMDWIN
    if (cmdwin_type != 0)
    {
	emsg(_(e_invalid_in_cmdline_window));
	return FAIL;
    }
#endif

    CHECK_CMDWIN;
    CHECK_CMDWIN;
CVE-2022-0714 (C, published 2022-02-22T20:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/indent.c
src/testdir/test_vartabs.vim
src/version.c
Commit message: patch 8.2.4436: crash with weird 'vartabstop' value

Problem:    Crash with weird 'vartabstop' value.
Solution:   Check for running into the end of the line.


Vulnerable code:

Fixed code:
	    if (ptr[new_cursor_col] == NUL)
		break;
func Test_vartabstop_latin1()
  let save_encoding = &encoding
  new
  set encoding=iso8859
  silent norm :se 
  set vartabstop=400
  norm i00	
  bwipe!
  let &encoding = save_encoding
endfunc


/**/
    4436,
CVE-2022-0729 (C, published 2022-02-23T14:15Z)
Description: value: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-823 \u2014 Use of Out-of-range Pointer Offset
The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.
Repository: https://github.com/vim/vim
Files changed:
src/regexp_bt.c
src/testdir/test_regexp_utf8.vim
src/version.c
Commit message: patch 8.2.4440: crash with specific regexp pattern and string

Problem:    Crash with specific regexp pattern and string.
Solution:   Stop at the start of the string.


Vulnerable code:
  let _engine=&regexpengine
  let &regexpengine=_engine

Fixed code:
				if (rex.lnum == 0)
				{
				    status = RA_NOMATCH;
				    break;
				}
  set regexpengine=0
func Test_match_too_complicated()
  set regexpengine=1
  exe "vsplit \xeb\xdb\x99"
  silent! buf \&\zs*\zs*0
  bwipe!
  set regexpengine=0
endfunc


/**/
    4440,
CVE-2022-0943 (C, published 2022-03-14T21:15Z)
Description: value: Heap-based Buffer Overflow occurs in vim in GitHub repository vim/vim prior to 8.2.4563.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/spellsuggest.c
src/testdir/test_spell.vim
src/version.c
Commit message: patch 8.2.4563: "z=" in Visual mode may go beyond the end of the line

Problem:    "z=" in Visual mode may go beyond the end of the line.
Solution:   Adjust "badlen".


Vulnerable code:

Fixed code:
	// make sure we don't include the NUL at the end of the line
	line = ml_get_curline();
	if (badlen > STRLEN(line) - curwin->w_cursor.col)
	    badlen = STRLEN(line) - curwin->w_cursor.col;
func Test_spellsuggest_visual_end_of_line()
  let enc_save = &encoding
  set encoding=iso8859

  " This was reading beyond the end of the line.
  norm R00000000000
  sil norm 0
  sil! norm i00000)
  sil! norm i00000)
  call feedkeys("\<CR>")
  norm z=

  let &encoding = enc_save
endfunc

/**/
    4563,