Blame SOURCES/0001-patch-8.2.5037-cursor-position-may-be-invalid-after-.patch

f520a9
diff -up vim82/src/ex_docmd.c.cve1927 vim82/src/ex_docmd.c
f520a9
--- vim82/src/ex_docmd.c.cve1927	2021-03-22 10:02:42.000000000 +0100
f520a9
+++ vim82/src/ex_docmd.c	2022-06-13 15:29:45.099472751 +0200
f520a9
@@ -3081,6 +3081,8 @@ parse_cmd_address(exarg_T *eap, char **e
f520a9
 {
f520a9
     int		address_count = 1;
f520a9
     linenr_T	lnum;
f520a9
+    int		need_check_cursor = FALSE;
f520a9
+    int		ret = FAIL;
f520a9
 
f520a9
     // Repeat for all ',' or ';' separated addresses.
f520a9
     for (;;)
f520a9
@@ -3091,7 +3093,7 @@ parse_cmd_address(exarg_T *eap, char **e
f520a9
 	lnum = get_address(eap, &eap->cmd, eap->addr_type, eap->skip, silent,
f520a9
 					eap->addr_count == 0, address_count++);
f520a9
 	if (eap->cmd == NULL)	// error detected
f520a9
-	    return FAIL;
f520a9
+	    goto theend;
f520a9
 	if (lnum == MAXLNUM)
f520a9
 	{
f520a9
 	    if (*eap->cmd == '%')   // '%' - all lines
f520a9
@@ -3136,14 +3138,14 @@ parse_cmd_address(exarg_T *eap, char **e
f520a9
 			    // there is no Vim command which uses '%' and
f520a9
 			    // ADDR_WINDOWS or ADDR_TABS
f520a9
 			    *errormsg = _(e_invrange);
f520a9
-			    return FAIL;
f520a9
+			    goto theend;
f520a9
 			}
f520a9
 			break;
f520a9
 		    case ADDR_TABS_RELATIVE:
f520a9
 		    case ADDR_UNSIGNED:
f520a9
 		    case ADDR_QUICKFIX:
f520a9
 			*errormsg = _(e_invrange);
f520a9
-			return FAIL;
f520a9
+			goto theend;
f520a9
 		    case ADDR_ARGUMENTS:
f520a9
 			if (ARGCOUNT == 0)
f520a9
 			    eap->line1 = eap->line2 = 0;
f520a9
@@ -3175,7 +3177,7 @@ parse_cmd_address(exarg_T *eap, char **e
f520a9
 		if (eap->addr_type != ADDR_LINES)
f520a9
 		{
f520a9
 		    *errormsg = _(e_invrange);
f520a9
-		    return FAIL;
f520a9
+		    goto theend;
f520a9
 		}
f520a9
 
f520a9
 		++eap->cmd;
f520a9
@@ -3183,11 +3185,11 @@ parse_cmd_address(exarg_T *eap, char **e
f520a9
 		{
f520a9
 		    fp = getmark('<', FALSE);
f520a9
 		    if (check_mark(fp) == FAIL)
f520a9
-			return FAIL;
f520a9
+			goto theend;
f520a9
 		    eap->line1 = fp->lnum;
f520a9
 		    fp = getmark('>', FALSE);
f520a9
 		    if (check_mark(fp) == FAIL)
f520a9
-			return FAIL;
f520a9
+			goto theend;
f520a9
 		    eap->line2 = fp->lnum;
f520a9
 		    ++eap->addr_count;
f520a9
 		}
f520a9
@@ -3202,10 +3204,13 @@ parse_cmd_address(exarg_T *eap, char **e
f520a9
 	    if (!eap->skip)
f520a9
 	    {
f520a9
 		curwin->w_cursor.lnum = eap->line2;
f520a9
+
f520a9
 		// Don't leave the cursor on an illegal line or column, but do
f520a9
 		// accept zero as address, so 0;/PATTERN/ works correctly.
f520a9
+		// Check the cursor position before returning.
f520a9
 		if (eap->line2 > 0)
f520a9
 		    check_cursor();
f520a9
+		need_check_cursor = TRUE;
f520a9
 	    }
f520a9
 	}
f520a9
 	else if (*eap->cmd != ',')
f520a9
@@ -3221,7 +3226,12 @@ parse_cmd_address(exarg_T *eap, char **e
f520a9
 	if (lnum == MAXLNUM)
f520a9
 	    eap->addr_count = 0;
f520a9
     }
f520a9
-    return OK;
f520a9
+    ret = OK;
f520a9
+
f520a9
+theend:
f520a9
+    if (need_check_cursor)
f520a9
+	check_cursor();
f520a9
+    return ret;
f520a9
 }
f520a9
 
f520a9
 /*
f520a9
diff -up vim82/src/testdir/test_excmd.vim.cve1927 vim82/src/testdir/test_excmd.vim
f520a9
--- vim82/src/testdir/test_excmd.vim.cve1927	2022-06-13 15:26:53.941517542 +0200
f520a9
+++ vim82/src/testdir/test_excmd.vim	2022-06-13 15:30:53.972860361 +0200
f520a9
@@ -536,4 +536,13 @@ func Test_sandbox()
f520a9
   sandbox call Sandbox_tests()
f520a9
 endfunc
f520a9
 
f520a9
+" This was leaving the cursor in line zero
f520a9
+func Test_using_zero_in_range()
f520a9
+  new
f520a9
+  norm o00
f520a9
+  silent!  0;s/\%')
f520a9
+  bwipe!
f520a9
+endfunc
f520a9
+
f520a9
+
f520a9
 " vim: shiftwidth=2 sts=2 expandtab