CVE-2022-3153 (published 2022-09-08T15:15Z)

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-09-07 15:20:26+01:00
msg: patch 9.0.0404: crash when passing invalid arguments to assert_fails()

Problem:    Crash when passing invalid arguments to assert_fails().
Solution:   Check for NULL string.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: test_assert.vim
change_type: ModificationType.MODIFY
diff: @@ -275,6 +275,21 @@ func Test_assert_fail_fails()
   endtry
   call assert_match("E1222: String or List required for argument 2", exp)
 
+  try
+    call assert_equal(0, assert_fails('xxx', [#{one: 1}]))
+  catch
+    let exp = v:exception
+  endtry
+  call assert_match("E731: Using a Dictionary as a String", exp)
+
+  let exp = ''
+  try
+    call assert_equal(0, assert_fails('xxx', ['E492', #{one: 1}]))
+  catch
+    let exp = v:exception
+  endtry
+  call assert_match("E731: Using a Dictionary as a String", exp)
+
   try
     call assert_equal(1, assert_fails('xxx', 'E492', '', 'burp'))
   catch
@@ -289,8 +304,8 @@ func Test_assert_fail_fails()
   endtry
   call assert_match("E1174: String required for argument 5", exp)
 
-  call assert_equal(1, assert_fails('c0', ['', '\1']))
-  call assert_match("Expected '\\\\\\\\1' but got 'E939: Positive count required: c0': c0", v:errors[0])
+  call assert_equal(1, assert_fails('c0', ['', '\(.\)\1']))
+  call assert_match("Expected '\\\\\\\\(.\\\\\\\\)\\\\\\\\1' but got 'E939: Positive count required: c0': c0", v:errors[0])
   call remove(v:errors, 0)
 endfunc
 

programming_language: Lua
filename: testing.c
change_type: ModificationType.MODIFY
diff: @@ -616,6 +616,11 @@ f_assert_fails(typval_T *argvars, typval_T *rettv)
     in_assert_fails = TRUE;
 
     do_cmdline_cmd(cmd);
+
+    // reset here for any errors reported below
+    trylevel = save_trylevel;
+    suppress_errthrow = FALSE;
+
     if (called_emsg == called_emsg_before)
     {
 	prepare_assert_error(&ga);
@@ -654,6 +659,8 @@ f_assert_fails(typval_T *argvars, typval_T *rettv)
 	    CHECK_LIST_MATERIALIZE(list);
 	    tv = &list->lv_first->li_tv;
 	    expected = tv_get_string_buf_chk(tv, buf);
+	    if (expected == NULL)
+		goto theend;
 	    if (!pattern_match(expected, actual, FALSE))
 	    {
 		error_found = TRUE;
@@ -667,6 +674,8 @@ f_assert_fails(typval_T *argvars, typval_T *rettv)
 		{
 		    tv = &list->lv_u.mat.lv_last->li_tv;
 		    expected = tv_get_string_buf_chk(tv, buf);
+		    if (expected == NULL)
+			goto theend;
 		    if (!pattern_match(expected, actual, FALSE))
 		    {
 			error_found = TRUE;

programming_language: C
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -703,6 +703,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    404,
 /**/
     403,
 /**/

programming_language: Ruby