hitoshura25/cvefixes huggingface dataset:
CVE-2022-2210 (C, published 2022-06-27T16:15Z)
Description: value: Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/vim/vim
Files changed:
src/diff.c
src/testdir/test_diffmode.vim
src/version.c
Commit message: patch 8.2.5164: invalid memory access after diff buffer manipulations

Problem:    Invalid memory access after diff buffer manipulations.
Solution:   Use zero offset when change removes all lines in a diff block.


Vulnerable code:
			off = dp->df_lnum[idx] - lnum_deleted;
			off = 0;

Fixed code:
		    off = 0;
			    off = dp->df_lnum[idx] - lnum_deleted;
" This was causing invalid diff block values
" FIXME: somehow this causes a valgrind error when run directly but not when
" run as a test.
func Test_diff_manipulations()
  set diff
  split 0
  sil! norm RdoobdeuRdoobdeuRdoobdeu

  set nodiff
  %bwipe!
endfunc

/**/
    5164,
CVE-2022-2231 (C, published 2022-06-28T20:15Z)
Description: value: NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/vim/vim
Files changed:
src/eval.c
src/testdir/test_vimscript.vim
src/version.c
Commit message: patch 8.2.5169: nested :source may use NULL pointer

Problem:    Nested :source may use NULL pointer.
Solution:   Do not use the NULL pointer.


Vulnerable code:
    expr_end = p;
    p = skipwhite(p);
    // In Vim9 script a command block is not split at NL characters for
    // commands using an expression argument.  Skip over a '#' comment to check
    // for a following NL.  Require white space before the '#'.
    if (in_vim9script() && p > expr_end && retarg == NULL)
	while (*p == '#')
	{
	    char_u *nl = vim_strchr(p, NL);
	    if (nl == NULL)
		break;
	    p = skipwhite(nl + 1);
	    if (eap != NULL && *p != NUL)
		eap->nextcmd = p;
	    check_for_end = FALSE;
	}
    if (ret != FAIL && check_for_end)
	end_error = !ends_excmd2(arg, p);
	if (eap != NULL && skipwhite(p)[0] == '|' && skipwhite(p)[1] != '|')

Fixed code:
    if (ret != FAIL)
    {
	expr_end = p;
	p = skipwhite(p);
	// In Vim9 script a command block is not split at NL characters for
	// commands using an expression argument.  Skip over a '#' comment to
	// check for a following NL.  Require white space before the '#'.
	if (in_vim9script() && p > expr_end && retarg == NULL)
	    while (*p == '#')
	    {
		char_u *nl = vim_strchr(p, NL);

		if (nl == NULL)
		    break;
		p = skipwhite(nl + 1);
		if (eap != NULL && *p != NUL)
		    eap->nextcmd = p;
		check_for_end = FALSE;
	    }

	if (check_for_end)
	    end_error = !ends_excmd2(arg, p);
    }
	if (eap != NULL && p != NULL
			  &&  skipwhite(p)[0] == '|' && skipwhite(p)[1] != '|')
" Test for deeply nested :source command  {{{1
func Test_deeply_nested_source()
  let lines =<< trim END

      so
      sil 0scr
      delete
      so
      0
  END
  call writefile(["vim9 silent! @0 \n/"] + lines, 'Xnested.vim')

  " this must not crash
  let cmd = GetVimCommand() .. " -e -s -S Xnested.vim -c qa!"
  call system(cmd)

  call delete('Xnested.vim')
endfunc

/**/
    5169,
CVE-2022-2257 (C, published 2022-06-30T21:15Z)
Description: value: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/vim/vim
Files changed:
src/message.c
src/testdir/test_menu.vim
src/version.c
Commit message: patch 9.0.0009: going past the end of a menu item with only modifier

Problem:    Going past the end of a menu item with only modifier.
Solution:   Check for NUL.


Vulnerable code:
	// single-byte character or illegal byte
	*sp = str + 1;

Fixed code:
	// single-byte character, NUL or illegal byte
	*sp = str + (*str == NUL ? 0 : 1);
func Test_only_modifier()
  exe "tmenu a.b \x80\xfc0"
  let exp =<< trim [TEXT]
  --- Menus ---
  500 a
    500 b
        t  - <T-2-^@>
  [TEXT]
  call assert_equal(exp, split(execute('tmenu'), "\n"))

  tunmenu a.b
endfunc

/**/
    9,
CVE-2022-2264 (C, published 2022-07-01T11:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/register.c
src/testdir/test_put.vim
src/version.c
Commit message: patch 9.0.0011: reading beyond the end of the line with put command

Problem:    Reading beyond the end of the line with put command.
Solution:   Adjust the end mark position.


Vulnerable code:

Fixed code:
		else
		    totlen -= spaces;  // didn't use these spaces
" this was putting the end mark after the end of the line
func Test_put_visual_mode()
  edit! SomeNewBuffer
  set selection=exclusive
  exe "norm o\t"
  m0
  sil! norm pp

  bwipe!
  set selection&
endfunc

/**/
    11,
CVE-2022-2284 (C, published 2022-07-02T15:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/testdir/test_visual.vim
src/version.c
src/window.c
Commit message: patch 9.0.0017: accessing memory beyond the end of the line

Problem:    Accessing memory beyond the end of the line.
Solution:   Stop Visual mode when closing a window.


Vulnerable code:

Fixed code:
func Test_visual_area_adjusted_when_hiding()
  " The Visual area ended after the end of the line after :hide
  call setline(1, 'xxx')
  vsplit Xfile
  call setline(1, 'xxxxxxxx')
  norm! $o
  hid
  norm! zW
  bwipe!
  bwipe!
endfunc

/**/
    17,
	    reset_VIsual_and_resel();	// stop Visual mode
CVE-2022-2285 (C, published 2022-07-02T16:15Z)
Description: value: Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/vim/vim
Files changed:
src/term.c
src/testdir/test_mapping.vim
src/version.c
Commit message: patch 9.0.0018: going over the end of the typahead

Problem:    Going over the end of the typahead.
Solution:   Put a NUL after the typeahead.


Vulnerable code:

Fixed code:
	tp[len] = NUL;
func Test_using_past_typeahead()
  nnoremap :00 0
  exe "norm :set \x80\xfb0=0\<CR>"
  exe "sil norm :0\x0f\<C-U>\<CR>"

  exe "norm :set \x80\xfb0=\<CR>"
  nunmap :00
endfunc


/**/
    18,
CVE-2022-2286 (C, published 2022-07-02T19:15Z)
Description: value: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/vim/vim
Files changed:
src/insexpand.c
src/testdir/test_ins_complete.vim
src/version.c
Commit message: patch 9.0.0020: with some completion reading past end of string

Problem:    With some completion reading past end of string.
Solution:   Check the length of the string.


Vulnerable code:
	    ins_bytes(compl_leader + get_compl_len());
	    ins_bytes(compl_orig_text + get_compl_len());

Fixed code:
	char_u *p = NULL;

	    p = compl_leader;
	    p = compl_orig_text;
	if (p != NULL)
	{
	    int	    compl_len = get_compl_len();
	    int	    len = (int)STRLEN(p);

	    if (len > compl_len)
		ins_bytes_len(p + compl_len, len - compl_len);
	}
func Test_complete_overrun()
  " this was going past the end of the copied text
  new
  sil norm si0s0
  bwipe!
endfunc


/**/
    20,
CVE-2022-2287 (C, published 2022-07-02T22:15Z)
Description: value: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/vim/vim
Files changed:
src/spellfile.c
src/testdir/test_spell.vim
src/version.c
Commit message: patch 9.0.0021: invalid memory access when adding word to spell word list

Problem:    Invalid memory access when adding word with a control character to
            the internal spell word list.
Solution:   Disallow adding a word with control characters or a trailing
            slash.


Vulnerable code:
    if (enc_utf8 && !utf_valid_string(word, NULL))
    if (enc_utf8 && !utf_valid_string(word, NULL))

Fixed code:
/*
 * Return TRUE if "word" contains valid word characters.
 * Control characters and trailing '/' are invalid.  Space is OK.
 */
    static int
valid_spell_word(char_u *word)
{
    char_u *p;

    if (enc_utf8 && !utf_valid_string(word, NULL))
	return FALSE;
    for (p = word; *p != NUL; p += mb_ptr2len(p))
	if (*p < ' ' || (p[0] == '/' && p[1] == NUL))
	    return FALSE;
    return TRUE;
}

    if (!valid_spell_word(word))
    if (!valid_spell_word(word))
func Test_spell_good_word_invalid()
  " This was adding a word with a 0x02 byte, which causes havoc.
  enew
  norm o0
  sil! norm rzzWs00/
  2
  sil! norm VzGprzzW
  sil! norm z=

  bwipe!
  " clear the internal word list
  set enc=latin1
  set enc=utf-8
endfunc

/**/
    21,
CVE-2022-2288 (C, published 2022-07-03T13:15Z)
Description: value: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/vim/vim
Files changed:
src/ex_docmd.c
src/testdir/test_cmdline.vim
src/version.c
Commit message: patch 9.0.0025: accessing beyond allocated memory with the cmdline window

Problem:    Accessing beyond allocated memory when using the cmdline window in
            Ex mode.
Solution:   Use "*" instead of "'<,'>" for Visual mode.


Vulnerable code:
		//  "'<,'>mods" -> "mods'<,'>+
		STRCPY(orig_cmd + len, "'<,'>+");

Fixed code:
		//  "'<,'>mods" -> "mods *+
		//  Use "*" instead of "'<,'>" to avoid the command getting
		//  longer, in case is was allocated.
		STRCPY(orig_cmd + len, " *+");
func Test_cmdwin_ex_mode_with_modifier()
  " this was accessing memory after allocated text in Ex mode
  new
  call setline(1, ['some', 'text', 'lines'])
  silent! call feedkeys("gQnormal vq:atopleft\<C-V>\<CR>\<CR>", 'xt')
  bwipe!
endfunc

/**/
    25,
CVE-2022-2289 (C, published 2022-07-03T15:15Z)
Description: value: Use After Free in GitHub repository vim/vim prior to 9.0.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/vim/vim
Files changed:
src/diff.c
src/version.c
Commit message: patch 9.0.0026: accessing freed memory with diff put

Problem:    Accessing freed memory with diff put.
Solution:   Bail out when diff pointer is no longer valid.


Vulnerable code:
	    // Adjust marks.  This will change the following entries!
	    else

Fixed code:
/*
 * Return TRUE if "diff" appears in the list of diff blocks of the current tab.
 */
    static int
valid_diff(diff_T *diff)
{
    diff_T	*dp;

    for (dp = curtab->tp_first_diff; dp != NULL; dp = dp->df_next)
	if (dp == diff)
	    return TRUE;
    return FALSE;
}

		// Adjust marks.  This will change the following entries!

	    // mark_adjust() may have made "dp" invalid.  We don't know where
	    // to continue then, bail out.
	    if (added != 0 && !valid_diff(dp))
		break;

	    if (dfree == NULL)
/**/
    26,
CVE-2022-2304 (C, published 2022-07-05T13:15Z)
Description: value: Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-121 \u2014 Stack-based Buffer Overflow
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Repository: https://github.com/vim/vim
Files changed:
src/spell.c
src/testdir/test_spell.vim
src/version.c
Commit message: patch 9.0.0035: spell dump may go beyond end of an array

Problem:    Spell dump may go beyond end of an array.
Solution:   Limit the word length.


Vulnerable code:
		    if (c == 0)
			// End of word, deal with the word.

Fixed code:
		    if (c == 0 || depth >= MAXWLEN - 1)
			// End of word or reached maximum length, deal with the
			// word.
func Test_spell_dump_word_length()
  " this was running over MAXWLEN
  new
  noremap 0 0a0zW0000000
  sil! norm 0z=0
  sil norm 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  sil! norm 0z=0

  bwipe!
  nunmap 0
endfunc

/**/
    35,
CVE-2022-2344 (C, published 2022-07-08T19:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/insexpand.c
src/testdir/test_ins_complete.vim
src/version.c
Commit message: patch 9.0.0046: reading past end of completion with duplicate match

Problem:    Reading past end of completion with duplicate match.
Solution:   Check string length


Vulnerable code:
		    && match->cp_str[len] == NUL)

Fixed code:
		    && ((int)STRLEN(match->cp_str) <= len
						 || match->cp_str[len] == NUL))
func Test_ins_complete_add()
  " this was reading past the end of allocated memory
  new
  norm o
  norm 7o
  sil! norm o

  bwipe!
endfunc

/**/
    46,
CVE-2022-2345 (C, published 2022-07-08T22:15Z)
Description: value: Use After Free in GitHub repository vim/vim prior to 9.0.0046.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/vim/vim
Files changed:
src/ex_cmds.c
src/regexp.c
src/testdir/test_regexp_latin.vim
src/version.c
Commit message: patch 9.0.0047: using freed memory with recursive substitute

Problem:    Using freed memory with recursive substitute.
Solution:   Always make a copy for reg_prev_sub.


Vulnerable code:
	sub = regtilde(sub, magic_isset());
    if (newsub != source)	// newsub was allocated, just keep it
	reg_prev_sub = newsub;
    else			// no ~ found, need to save newsub
	reg_prev_sub = vim_strsave(newsub);

Fixed code:
    {
	char_u *newsub = regtilde(sub, magic_isset());

	if (newsub != sub)
	{
	    // newsub was allocated, free it later.
	    sub_copy = newsub;
	    sub = newsub;
	}
    }
    // Store a copy of newsub  in reg_prev_sub.  It is always allocated,
    // because recursive calls may make the returned string invalid.
    reg_prev_sub = vim_strsave(newsub);

func Test_recursive_substitute_expr()
  new
  func Repl()
    s
  endfunc
  silent! s/\%')/~\=Repl()

  bwipe!
  delfunc Repl
endfunc

/**/
    47,
CVE-2022-2522 (C, published 2022-07-25T14:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/autocmd.c
src/proto/window.pro
src/testdir/test_autocmd.vim
src/version.c
src/window.c
Commit message: patch 9.0.0061: ml_get error with nested autocommand

Problem:    ml_get error with nested autocommand.
Solution:   Also check line numbers for a nested autocommand. (closes #10761)


Vulnerable code:
	    // make sure cursor and topline are valid
 * Correct the cursor line number in other windows.  Used after changing the
 * current buffer, and before applying autocommands.
 * When "do_curwin" is TRUE, also check current window.
    void
check_lnums(int do_curwin)
	    // save the original cursor position and topline
	    wp->w_save_cursor.w_cursor_save = wp->w_cursor;
	    wp->w_save_cursor.w_topline_save = wp->w_topline;
	    // save the corrected cursor position and topline

Fixed code:
	// Make sure cursor and topline are valid.  The first time the current
	// values are saved, restored by reset_lnums().  When nested only the
	// values are corrected when needed.
	else
	    check_lnums_nested(TRUE);
void check_lnums_nested(int do_curwin);
func Test_autocmd_nested_cursor_invalid()
  set laststatus=0
  copen
  cclose
  call setline(1, ['foo', 'bar', 'baz'])
  3
  augroup nested_inv
    autocmd User foo ++nested copen
    autocmd BufAdd * let &laststatus = 2 - &laststatus
  augroup END
  doautocmd User foo

  augroup nested_inv
    au!
  augroup END
  set laststatus&
  bwipe!
endfunc

/**/
    61,
 * Implementation of check_lnums() and check_lnums_nested().
    static void
check_lnums_both(int do_curwin, int nested)
	    if (!nested)
	    {
		// save the original cursor position and topline
		wp->w_save_cursor.w_cursor_save = wp->w_cursor;
		wp->w_save_cursor.w_topline_save = wp->w_topline;
	    }
	    // save the (corrected) cursor position and topline
/*
 * Correct the cursor line number in other windows.  Used after changing the
 * current buffer, and before applying autocommands.
 * When "do_curwin" is TRUE, also check current window.
 */
    void
check_lnums(int do_curwin)
{
    check_lnums_both(do_curwin, FALSE);
}

/*
 * Like check_lnums() but for when check_lnums() was already called.
 */
    void
check_lnums_nested(int do_curwin)
{
    check_lnums_both(do_curwin, TRUE);
}
CVE-2022-2522 (C, published 2022-07-25T14:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/insexpand.c
src/testdir/test_ins_complete.vim
src/version.c
Commit message: patch 9.0.0060: accessing uninitialized memory when completing long line

Problem:    Accessing uninitialized memory when completing long line.
Solution:   Terminate string with NUL.


Vulnerable code:

Fixed code:
	    *p = NUL;
  " check that the too long text is NUL terminated
  %del
  norm o
  norm 1987ax
  exec "norm ox\<C-X>\<C-L>"
  call assert_equal(repeat('x', 1987), getline(3))

/**/
    60,
CVE-2022-2571 (C, published 2022-08-01T15:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0101.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/insexpand.c
src/testdir/test_ins_complete.vim
src/version.c
Commit message: patch 9.0.0102: reading past end of line with insert mode completion

Problem:    Reading past end of line with insert mode completion.
Solution:   Check text length.


Vulnerable code:
	if (compl_status_adding())

Fixed code:
	if (compl_status_adding() && compl_length <= (int)STRLEN(tmp_ptr))
func Test_ins_complete_end_of_line()
  " this was reading past the end of the line
  new  
  norm 8oý 
  sil! norm o

  bwipe!
endfunc
/**/
    102,
CVE-2022-2580 (C, published 2022-08-01T15:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0102.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/vim/vim
Files changed:
src/testdir/test_eval_stuff.vim
src/typval.c
src/version.c
Commit message: patch 9.0.0104: going beyond allocated memory when evaluating string constant

Problem:    Going beyond allocated memory when evaluating string constant.
Solution:   Properly skip over <Key> form.


Vulnerable code:

Fixed code:
func Test_eval_string_in_special_key()
  " this was using the '{' inside <> as the start of an interpolated string
  silent! echo 0{1-$"\<S--{>n|nö%
endfunc

	    {
		int		modifiers = 0;
		int		flags = FSK_KEYCODE | FSK_IN_STRING;


		// Skip to the '>' to avoid using '{' inside for string
		// interpolation.
		if (p[1] != '*')
		    flags |= FSK_SIMPLIFY;
		if (find_special_key(&p, &modifiers, flags, NULL) != 0)
		    --p;  // leave "p" on the ">"
	    }
/**/
    104,
CVE-2022-2581 (C, published 2022-08-01T15:15Z)
Description: value: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0104.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/vim/vim
Files changed:
src/regexp.c
src/testdir/test_regexp_utf8.vim
src/version.c
Commit message: patch 9.0.0105: illegal memory access when pattern starts with illegal byte

Problem:    Illegal memory access when pattern starts with illegal byte.
Solution:   Do not match a character with an illegal byte.


Vulnerable code:
		if (utf_fold(utf_ptr2char(p)) == cc)

Fixed code:
		int uc = utf_ptr2char(p);

		// Do not match an illegal byte.  E.g. 0xff matches 0xc3 0xbf,
		// not 0xff.
		if ((uc < 0x80 || uc != *p) && utf_fold(uc) == cc)
source shared.vim

func Test_match_illegal_byte()
  let lines =<< trim END
      silent! buffer ÿ\c
      next ÿ
      0scriptnames
      source
  END
  call writefile(lines, 'Xregexp')
  call system(GetVimCommand() .. ' -X -Z -e -s -S Xregexp -c qa!')

  call delete('Xregexp')
endfunc

/**/
    105,