Heap-based Buffer Overflow in vim/vim

Description

Greetings,

A Heap-based Buffer Overflow issue was discovered in Vim.

The POC file is reduced to the absolute minimum to reproduce the problem. Please see sanitizer output and the "trimmed" POC file link below.

System info OS version : Ubuntu 20.04.2 LTS + Clang 12 with ASan Vim Version : master(3cad470) - Thu Nov 18 15:37:29 2021 +0000

Steps to reproduce:

git clone https://github.com/vim/vim

LD=lld-12 AS=llvm-as-12 AR=llvm-ar-12 RANLIB=llvm-ranlib-12 CC=clang-12 CXX=clang++-12 CFLAGS="-fsanitize=address" CXXFLAGS="-fsanitize=address" LDFLAGS="-ldl -fsanitize=address" ./configure --with-features=huge --enable-gui=none && make

3. Download POC from This URL

./vim -u NONE -X -Z -e -s -S POC -c :qa!

Sanitizer output:

=================================================================
==135953==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x621000012918 at pc 0x00000139d8cd bp 0x7ffd76bc2330 sp 0x7ffd76bc2328
READ of size 1 at 0x621000012918 thread T0
    #0 0x139d8cc in findmatchlimit /src/fuzzer11/triage_yeni/vim/src/search.c:2590:6
    #1 0x60e8c5 in find_start_brace /src/fuzzer11/triage_yeni/vim/src/cindent.c:1646:22
    #2 0x5c1385 in get_c_indent /src/fuzzer11/triage_yeni/vim/src/cindent.c:2317:24
    #3 0xc0c7b8 in op_reindent /src/fuzzer11/triage_yeni/vim/src/indent.c:1060:12
    #4 0xf389b7 in do_pending_operator /src/fuzzer11/triage_yeni/vim/src/ops.c
    #5 0xe84da1 in normal_cmd /src/fuzzer11/triage_yeni/vim/src/normal.c:1125:2
    #6 0x9aefb4 in exec_normal /src/fuzzer11/triage_yeni/vim/src/ex_docmd.c
    #7 0x9ad0aa in exec_normal_cmd /src/fuzzer11/triage_yeni/vim/src/ex_docmd.c:8548:5
    #8 0x9ad0aa in ex_normal /src/fuzzer11/triage_yeni/vim/src/ex_docmd.c:8466:6
    #9 0x94ff7b in do_one_cmd /src/fuzzer11/triage_yeni/vim/src/ex_docmd.c:2614:2
    #10 0x94ff7b in do_cmdline /src/fuzzer11/triage_yeni/vim/src/ex_docmd.c:1000:17
    #11 0x136cde4 in do_source /src/fuzzer11/triage_yeni/vim/src/scriptfile.c:1406:5
    #12 0x13699e1 in cmd_source /src/fuzzer11/triage_yeni/vim/src/scriptfile.c:971:14
    #13 0x13699e1 in ex_source /src/fuzzer11/triage_yeni/vim/src/scriptfile.c:997:2
    #14 0x94ff7b in do_one_cmd /src/fuzzer11/triage_yeni/vim/src/ex_docmd.c:2614:2
    #15 0x94ff7b in do_cmdline /src/fuzzer11/triage_yeni/vim/src/ex_docmd.c:1000:17
    #16 0x1bcecfc in exe_commands /src/fuzzer11/triage_yeni/vim/src/main.c:3081:2
    #17 0x1bcecfc in vim_main2 /src/fuzzer11/triage_yeni/vim/src/main.c:773:2
    #18 0x1bc5a8f in main /src/fuzzer11/triage_yeni/vim/src/main.c:425:12
    #19 0x7f43168c50b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #20 0x41f64d in _start (/src/fuzzer11/triage_yeni/vim/src/vim+0x41f64d)

0x621000012918 is located 24 bytes to the right of 4096-byte region [0x621000011900,0x621000012900)
allocated by thread T0 here:
    #0 0x49a8ad in malloc (/src/fuzzer11/triage_yeni/vim/src/vim+0x49a8ad)
    #1 0x4cc2cb in lalloc /src/fuzzer11/triage_yeni/vim/src/alloc.c:244:11

SUMMARY: AddressSanitizer: heap-buffer-overflow /src/fuzzer11/triage_yeni/vim/src/search.c:2590:6 in findmatchlimit
Shadow bytes around the buggy address:
  0x0c427fffa4d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fffa4e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fffa4f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fffa500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fffa510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c427fffa520: fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffa530: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffa540: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffa550: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffa560: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffa570: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==135953==ABORTING

References:

CWE-122: Heap-based Buffer Overflow - https://cwe.mitre.org/data/definitions/122.html

This vulnerability is capable of crashing software, bypass protection mechanism, modify of memory, and successful exploitation may lead to code execution