hitoshura25/cvefixes huggingface dataset:
CVE-2022-2598 (C, published 2022-08-01T15:15Z)
Description: value: Out-of-bounds Write to API in GitHub repository vim/vim prior to 9.0.0100.


Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/vim/vim
Files changed:
src/diff.c
src/testdir/test_diffmode.vim
src/version.c
Commit message: patch 9.0.0101: invalid memory access in diff mode with "dp" and undo

Problem:    Invalid memory access in diff mode with "dp" and undo.
Solution:   Make sure the line number does not go below one.


Vulnerable code:
			    dp->df_lnum[i] -= off;
		ml_delete(lnum);
		--added;

Fixed code:
			    if (dp->df_lnum[i] > off)
				dp->df_lnum[i] -= off;
			    else
				dp->df_lnum[i] = 1;
		if (ml_delete(lnum) == OK)
		    --added;
" This was causing the line number in the diff block to go below one.
" FIXME: somehow this causes a valgrind error when run directly but not when
" run as a test.
func Test_diff_put_and_undo()
  set diff
  next 0
  split 00
  sil! norm o0gguudpo0ggJuudp

  bwipe!
  bwipe!
  set nodiff
endfunc

/**/
    101,
CVE-2022-2816 (C, published 2022-08-15T22:15Z)
Description: value: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/vim/vim
Files changed:
src/testdir/test_vim9_cmd.vim
src/version.c
src/vim9cmds.c
Commit message: patch 9.0.0212: invalid memory access when compiling :unlet

Problem:    Invalid memory access when compiling :unlet.
Solution:   Don't read past the end of the line.


Vulnerable code:
        s:0([], s:0)
  v9.CheckScriptFailure(lines, 'E179', 2)

Fixed code:
  v9.CheckScriptFailure(lines, 'E179', 1)

  lines =<< trim END
      def T()
        unlet
      enddef
      defcomp
  END
  v9.CheckScriptFailure(lines, 'E179', 1)
/**/
    212,
    if (*name == NUL)
    {
	semsg(_(e_argument_required_for_str), "unlet");
	return FAIL;
    }
CVE-2022-2817 (C, published 2022-08-15T23:15Z)
Description: value: Use After Free in GitHub repository vim/vim prior to 9.0.0213.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/vim/vim
Files changed:
src/testdir/test_assert.vim
src/testing.c
src/version.c
Commit message: patch 9.0.0213: using freed memory with error in assert argument

Problem:    Using freed memory with error in assert argument.
Solution:   Make a copy of the error.


Vulnerable code:
		tv = &list->lv_u.mat.lv_last->li_tv;
		actual = get_vim_var_str(VV_ERRMSG);
		expected = tv_get_string_buf_chk(tv, buf);
		if (!pattern_match(expected, actual, FALSE))
		    error_found = TRUE;
		    expected_str = expected;

Fixed code:

  call assert_equal(1, assert_fails('c0', ['', '\1']))
  call assert_match("Expected '\\\\\\\\1' but got 'E939: Positive count required: c0': c0", v:errors[0])
  call remove(v:errors, 0)
    char_u	*tofree = NULL;
		// make a copy, an error in pattern_match() may free it
		tofree = actual = vim_strsave(get_vim_var_str(VV_ERRMSG));
		if (actual != NULL)
		    tv = &list->lv_u.mat.lv_last->li_tv;
		    expected = tv_get_string_buf_chk(tv, buf);
		    if (!pattern_match(expected, actual, FALSE))
		    {
			error_found = TRUE;
			expected_str = expected;
		    }
    vim_free(tofree);
/**/
    213,
CVE-2022-2819 (C, published 2022-08-15T11:21Z)
Description: value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/testdir/test_vim9_cmd.vim
src/version.c
src/vim9cmds.c
Commit message: patch 9.0.0211: invalid memory access when compiling :lockvar

Problem:    Invalid memory access when compiling :lockvar.
Solution:   Don't read past the end of the line.


Vulnerable code:
	char *cmd = eap->cmdidx == CMD_lockvar ? "lockvar" : "unlockvar";


Fixed code:

  lines =<< trim END
      def _()
        s:0([], s:0)
        lockv
      enddef
      defcomp
  END
  v9.CheckScriptFailure(lines, 'E179', 2)
/**/
    211,
    char	*cmd = eap->cmdidx == CMD_lockvar ? "lockvar" : "unlockvar";
    if (*p == NUL)
    {
	semsg(_(e_argument_required_for_str), cmd);
	return FAIL;
    }
CVE-2022-2845 (C, published 2022-08-17T15:15Z)
Description: value: Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218.


Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-1284 \u2014 Improper Validation of Specified Quantity in Input
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Repository: https://github.com/vim/vim
Files changed:
src/edit.c
src/proto/edit.pro
src/testdir/test_cmdwin.vim
src/version.c
Commit message: patch 9.0.0218: reading before the start of the line

Problem:    Reading before the start of the line.
Solution:   When displaying "$" check the column is not negative.


Vulnerable code:
display_dollar(colnr_T col)
void display_dollar(colnr_T col);

Fixed code:
display_dollar(colnr_T col_arg)
    colnr_T col = col_arg < 0 ? 0 : col_arg;
void display_dollar(colnr_T col_arg);
func Test_cmdwin_virtual_edit()
  enew!
  set ve=all cpo+=$
  silent normal q/s

  set ve= cpo-=$
endfunc

/**/
    218,
CVE-2022-2849 (C, published 2022-08-17T18:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/globals.h
src/mbyte.c
src/testdir/test_eval_stuff.vim
src/version.c
Commit message: patch 9.0.0220: invalid memory access with for loop over NULL string

Problem:    Invalid memory access with for loop over NULL string.
Solution:   Make sure mb_ptr2len() consistently returns zero for NUL.


Vulnerable code:
// length of char in bytes, including following composing chars
 * mb_ptr2len() function pointer.
 * Get byte length of character at "*p" but stop at a NUL.
 * For UTF-8 this includes following composing characters.
 * Returns 0 when *p is NUL.
 return MB_BYTE2LEN(*p);
dbcs_ptr2len(
    char_u	*p)
    // Check if second byte is not missing.

Fixed code:
// Length of char in bytes, including any following composing chars.
// NUL has length zero.
 * Get byte length of character at "*p".  Returns zero when "*p" is NUL.
 * Used for mb_ptr2len() when 'encoding' latin.
    return *p == NUL ? 0 : 1;
/*
 * Get byte length of character at "*p".  Returns zero when "*p" is NUL.
 * Used for mb_ptr2len() when 'encoding' DBCS.
 */
dbcs_ptr2len(char_u *p)
    if (*p == NUL)
	return 0;

    // if the second byte is missing the length is 1
 * Returns zero for NUL.
func Test_for_over_null_string()
  let save_enc = &enc
  set enc=iso8859
  let cnt = 0
  for c in test_null_string()
    let cnt += 1
  endfor
  call assert_equal(0, cnt)

  let &enc = save_enc
endfunc

/**/
    220,
CVE-2022-2862 (C, published 2022-08-17T20:15Z)
Description: value: Use After Free in GitHub repository vim/vim prior to 9.0.0221.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/vim/vim
Files changed:
src/testdir/test_vim9_func.vim
src/version.c
src/vim9compile.c
Commit message: patch 9.0.0221: accessing freed memory if compiling nested function fails

Problem:    Accessing freed memory if compiling nested function fails.
Solution:   Mess up the variable name so that it won't be found.


Vulnerable code:
	lvar_T	*lvar = reserve_local(cctx, func_name, name_end - name_start,


Fixed code:
def Test_nested_function_fails()
  var lines =<< trim END
      def T()
        def Func(g: string):string
        enddef
        Func()
      enddef
      silent! defcompile
  END
  v9.CheckScriptFailure(lines, 'E1069:')
enddef

/**/
    221,
    lvar_T	*lvar = NULL;
	lvar = reserve_local(cctx, func_name, name_end - name_start,
	if (lvar != NULL)
	    // Now the local variable can't be used.
	    *lvar->lv_name = '/';  // impossible value
CVE-2022-2874 (C, published 2022-08-18T16:15Z)
Description: value: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/vim/vim
Files changed:
src/testdir/test_vim9_script.vim
src/version.c
src/vim9compile.c
Commit message: patch 9.0.0224: Using NULL pointer when skipping compiled code

Problem:    Using NULL pointer when skipping compiled code.
Solution:   Check for skipping.


Vulnerable code:
	    if (lvar->lv_from_outer > 0)
		generate_LOADOUTER(cctx, lvar->lv_idx, lvar->lv_from_outer,
	    else
		generate_LOAD(cctx, ISN_LOAD, lvar->lv_idx, NULL, type);

Fixed code:
def Test_skipped_redir()
  var lines =<< trim END
      def T()
        if 0
          redir =>l[0]
          redir END
        endif
      enddef
      defcompile
  END
  v9.CheckScriptSuccess(lines)
enddef

/**/
    224,
	    if (cctx->ctx_skip != SKIP_YES)
	    {
		if (lvar->lv_from_outer > 0)
		    generate_LOADOUTER(cctx, lvar->lv_idx, lvar->lv_from_outer,
		else
		    generate_LOAD(cctx, ISN_LOAD, lvar->lv_idx, NULL, type);
	    }
    if (cctx->ctx_skip == SKIP_YES)
	return OK;
CVE-2022-2923 (C, published 2022-08-22T21:15Z)
Description: value: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/vim/vim
Files changed:
src/spellfile.c
src/testdir/test_spellfile.vim
src/version.c
Commit message: patch 9.0.0240: crash when using ":mkspell" with an empty .dic file

Problem:    Crash when using ":mkspell" with an empty .dic file.
Solution:   Check for an empty word tree.


Vulnerable code:
     * in the trie.

Fixed code:
     * in the trie.  Bail out if the tree is empty.
    if (byts == NULL || idxs == NULL)
	return FAIL;
" this was using a NULL pointer
func Test_mkspell_empty_dic()
  call writefile(['1'], 'XtestEmpty.dic')
  call writefile(['SOFOFROM abcd', 'SOFOTO ABCD', 'SAL CIA X'], 'XtestEmpty.aff')
  mkspell! XtestEmpty.spl XtestEmpty

  call delete('XtestEmpty.dic')
  call delete('XtestEmpty.aff')
  call delete('XtestEmpty.spl')
endfunc


/**/
    240,
CVE-2022-2946 (C, published 2022-08-23T17:15Z)
Description: value: Use After Free in GitHub repository vim/vim prior to 9.0.0246.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/vim/vim
Files changed:
src/tag.c
src/testdir/test_tagfunc.vim
src/version.c
Commit message: patch 9.0.0246: using freed memory when 'tagfunc' deletes the buffer

Problem:    Using freed memory when 'tagfunc' deletes the buffer.
Solution:   Make a copy of the tag name.


Vulnerable code:
	    name = tagstack[tagstackidx].tagname;

Fixed code:
    char_u	*tofree = NULL;
	{
	    // make a copy, the tagstack may change in 'tagfunc'
	    name = vim_strsave(tagstack[tagstackidx].tagname);
	    vim_free(tofree);
	    tofree = name;
	}
    vim_free(tofree);
func Test_tagfunc_wipes_buffer()
  func g:Tag0unc0(t,f,o)
   bwipe
  endfunc
  set tagfunc=g:Tag0unc0
  new
  cal assert_fails('tag 0', 'E987:')

  delfunc g:Tag0unc0
  set tagfunc=
endfunc

/**/
    246,
CVE-2022-2982 (C, published 2022-08-25T20:15Z)
Description: value: Use After Free in GitHub repository vim/vim prior to 9.0.0260.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/vim/vim
Files changed:
src/quickfix.c
src/testdir/test_quickfix.vim
src/version.c
Commit message: patch 9.0.0260: using freed memory when using 'quickfixtextfunc' recursively

Problem:    Using freed memory when using 'quickfixtextfunc' recursively.
Solution:   Do not allow for recursion.


Vulnerable code:

Fixed code:
    static int	recursive = FALSE;

    if (recursive)
	return NULL;  // this doesn't work properly recursively
    recursive = TRUE;
	{
	    recursive = FALSE;
	}
    recursive = FALSE;
func Test_quickfixtextfunc_recursive()
  func s:QFTfunc(o)
    cgete '0'
  endfunc
  copen
  let &quickfixtextfunc = 's:QFTfunc'
  cex ""

  let &quickfixtextfunc = ''
  cclose
endfunc


/**/
    260,
CVE-2022-3016 (C, published 2022-08-28T12:15Z)
Description: value: Use After Free in GitHub repository vim/vim prior to 9.0.0286.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/vim/vim
Files changed:
src/quickfix.c
src/testdir/test_quickfix.vim
src/version.c
Commit message: patch 9.0.0286: using freed memory when location list changed in autocmd

Problem:    Using freed memory when location list changed in autocmd.
Solution:   Return QF_ABORT and handle it. (Yegappan Lakshmanan,
            closes #10993)


Vulnerable code:
 * buffer and NOTDONE if the quickfix/location list was freed by an autocmd
	    return NOTDONE;
	return NOTDONE;
	return NOTDONE;
 * with the entry.
	return FAIL;
	return FAIL;
 * NOTDONE if the quickfix/location list is freed by an autocmd when opening
    if (retval == NOTDONE)
	// Quickfix/location list is freed by an autocmd

Fixed code:
    QF_ABORT = 6
 * buffer and QF_ABORT if the quickfix/location list was freed by an autocmd
	    return QF_ABORT;
	return QF_ABORT;
	return QF_ABORT;
 * with the entry.  Returns QF_ABORT if the quickfix/location list was modified
 * by an autocmd.
	return QF_ABORT;
	return QF_ABORT;
 * QF_ABORT if the quickfix/location list is freed by an autocmd when opening
    if (retval == QF_ABORT)
    {
	qi = NULL;
	qf_ptr = NULL;
	goto theend;
    }
    if (retval == QF_ABORT)
	// Quickfix/location list was modified by an autocmd
" Test for replacing the location list from an autocmd. This used to cause a
" read from freed memory.
func Test_loclist_replace_autocmd()
  %bw!
  call setloclist(0, [], 'f')
  let s:bufnr = bufnr()
  cal setloclist(0, [{'0': 0, '': ''}])
  au BufEnter * cal setloclist(1, [{'t': ''}, {'bufnr': s:bufnr}], 'r')
  lopen
  try
    exe "norm j\<CR>"
  catch
  endtry
  lnext
  %bw!
  call setloclist(0, [], 'f')
endfunc
/**/
    286,
CVE-2022-3037 (C, published 2022-08-30T21:15Z)
Description: value: Use After Free in GitHub repository vim/vim prior to 9.0.0322.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/vim/vim
Files changed:
src/quickfix.c
src/testdir/test_quickfix.vim
src/version.c
Commit message: patch 9.0.0322: crash when no errors and 'quickfixtextfunc' is set

Problem:    Crash when no errors and 'quickfixtextfunc' is set.
Solution:   Do not handle errors if there aren't any.


Vulnerable code:
    if (qfl != NULL)

Fixed code:
    if (qfl != NULL && qfl->qf_start != NULL)
func Test_empty_list_quickfixtextfunc()
  " This was crashing.  Can only reproduce by running it in a separate Vim
  " instance.
  let lines =<< trim END
      func s:Func(o)
              cgetexpr '0'
      endfunc
      cope
      let &quickfixtextfunc = 's:Func'
      cgetfile [ex
  END
  call writefile(lines, 'Xquickfixtextfunc')
  call RunVim([], [], '-e -s -S Xquickfixtextfunc -c qa')
  call delete('Xquickfixtextfunc')
endfunc

/**/
    322,
CVE-2022-3099 (C, published 2022-09-03T16:15Z)
Description: value: Use After Free in GitHub repository vim/vim prior to 9.0.0360.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/vim/vim
Files changed:
src/ex_docmd.c
src/testdir/test_eval_stuff.vim
src/version.c
Commit message: patch 9.0.0360: crash when invalid line number on :for is ignored

Problem:    Crash when invalid line number on :for is ignored.
Solution:   Do not check breakpoint for non-existing line.


Vulnerable code:
		    if (breakpoint != NULL)

Fixed code:
		    if (breakpoint != NULL && lines_ga.ga_len > current_line)
source shared.vim
func Test_for_invalid_line_count()
  let lines =<< trim END
      111111111111111111111111 for line in ['one']
      endfor
  END
  call writefile(lines, 'XinvalidFor')
  " only test that this doesn't crash
  call RunVim([], [], '-u NONE -e -s -S XinvalidFor -c qa')

  call delete('XinvalidFor')
endfunc

/**/
    360,
CVE-2022-3134 (C, published 2022-09-06T20:15Z)
Description: value: Use After Free in GitHub repository vim/vim prior to 9.0.0389.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/vim/vim
Files changed:
src/errors.h
src/tag.c
src/testdir/test_tagfunc.vim
src/version.c
Commit message: patch 9.0.0389: crash when 'tagfunc' closes the window

Problem:    Crash when 'tagfunc' closes the window.
Solution:   Bail out when the window was closed.


Vulnerable code:

Fixed code:
EXTERN char e_window_unexpectedly_close_while_searching_for_tags[]
	INIT(= N_("E1299: Window unexpectedly closed while searching for tags"));
	    // A tag function may do anything, which may cause various
	    // information to become invalid.  At least check for the tagstack
	    // to still be the same.
	    if (tagstack != curwin->w_tagstack)
	    {
		emsg(_(e_window_unexpectedly_close_while_searching_for_tags));
		FreeWild(new_num_matches, new_matches);
		break;
	    }

func Test_tagfunc_closes_window()
  split any
  func MytagfuncClose(pat, flags, info)
    close
    return [{'name' : 'mytag', 'filename' : 'Xtest', 'cmd' : '1'}]
  endfunc
  set tagfunc=MytagfuncClose
  call assert_fails('tag xyz', 'E1299:')

  set tagfunc=
endfunc


/**/
    389,
CVE-2022-3153 (C, published 2022-09-08T15:15Z)
Description: value: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/vim/vim
Files changed:
src/testdir/test_assert.vim
src/testing.c
src/version.c
Commit message: patch 9.0.0404: crash when passing invalid arguments to assert_fails()

Problem:    Crash when passing invalid arguments to assert_fails().
Solution:   Check for NULL string.


Vulnerable code:
  call assert_equal(1, assert_fails('c0', ['', '\1']))
  call assert_match("Expected '\\\\\\\\1' but got 'E939: Positive count required: c0': c0", v:errors[0])

Fixed code:
  try
    call assert_equal(0, assert_fails('xxx', [#{one: 1}]))
  catch
    let exp = v:exception
  endtry
  call assert_match("E731: Using a Dictionary as a String", exp)

  let exp = ''
  try
    call assert_equal(0, assert_fails('xxx', ['E492', #{one: 1}]))
  catch
    let exp = v:exception
  endtry
  call assert_match("E731: Using a Dictionary as a String", exp)

  call assert_equal(1, assert_fails('c0', ['', '\(.\)\1']))
  call assert_match("Expected '\\\\\\\\(.\\\\\\\\)\\\\\\\\1' but got 'E939: Positive count required: c0': c0", v:errors[0])

    // reset here for any errors reported below
    trylevel = save_trylevel;
    suppress_errthrow = FALSE;

	    if (expected == NULL)
		goto theend;
		    if (expected == NULL)
			goto theend;
/**/
    404,
CVE-2022-3234 (C, published 2022-09-17T22:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/ops.c
src/testdir/test_virtualedit.vim
src/version.c
Commit message: patch 9.0.0483: illegal memory access when replacing in virtualedit mode

Problem:    Illegal memory access when replacing in virtualedit mode.
Solution:   Check for replacing NUL after Tab.


Vulnerable code:
		    PBYTE(curwin->w_cursor, c);
	    else if (virtual_op && curwin->w_cursor.lnum == oap->end.lnum)

Fixed code:
	    int done = FALSE;

		    done = TRUE;
		    // with "coladd" set may move to just after a TAB
		    if (gchar_cursor() != NUL)
		    {
			PBYTE(curwin->w_cursor, c);
			done = TRUE;
		    }
	    if (!done && virtual_op && curwin->w_cursor.lnum == oap->end.lnum)
" this was replacing the NUL at the end of the line 
func Test_virtualedit_replace_after_tab()
  new
  s/\v/	0
  set ve=all
  let @" = ''
  sil! norm vPvr0
  
  call assert_equal("\t0", getline(1))
  set ve&
  bwipe!
endfunc


/**/
    483,