CVE-2022-4293 (published 2022-12-05T19:15Z)

Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-1077
cwe_name: Floating Point Comparison with Incorrect Operator
description: The code performs a comparison such as an
        equality test between two float (floating point) values, but
        it uses comparison operators that do not account for the
        possibility of loss of precision.
extended_description: 
	   Numeric calculation using floating point values
	   can generate imprecise results because of rounding errors.
	   As a result, two different calculations might generate
	   numbers that are mathematically equal, but have slightly
	   different bit representations that do not translate to the
	   same mathematically-equal values.  As a result, an equality
	   test or other comparison might produce unexpected
	   results.
	   This issue can prevent the product from running reliably.  If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-10-20 14:17:18+01:00
msg: patch 9.0.0804: crash when trying to divide a number by -1

Problem:    Crash when trying to divice the largest negative number by -1.
Solution:   Handle this case specifically.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: eval.c
change_type: ModificationType.MODIFY
diff: @@ -66,6 +66,12 @@ num_divide(varnumber_T n1, varnumber_T n2, int *failed)
 	else
 	    result = VARNUM_MAX;
     }
+    else if (n1 == VARNUM_MIN && n2 == -1)
+    {
+	// specific case: trying to do VARNUM_MIN / -1 results in a positive
+	// number that doesn't fit in varnumber_T and causes an FPE
+	result = VARNUM_MAX;
+    }
     else
 	result = n1 / n2;
 
@@ -6023,7 +6029,7 @@ var2fpos(
 }
 
 /*
- * Convert list in "arg" into position "psop" and optional file number "fnump".
+ * Convert list in "arg" into position "posp" and optional file number "fnump".
  * When "fnump" is NULL there is no file number, only 3 items: [lnum, col, off]
  * Note that the column is passed on as-is, the caller may want to decrement
  * it to use 1 for the first column.

programming_language: C
filename: test_expr.vim
change_type: ModificationType.MODIFY
diff: @@ -761,6 +761,12 @@ func Test_eval_after_if()
   call assert_equal('b', s:val)
 endfunc
 
+func Test_divide_by_zero()
+  " only tests that this doesn't crash, the result is not important
+  echo 0 / 0
+  echo 0 / 0 / -1
+endfunc
+
 " Test for command-line completion of expressions
 func Test_expr_completion()
   CheckFeature cmdline_compl

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -695,6 +695,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    804,
 /**/
     803,
 /**/

programming_language: Ruby