From eb41373c8c88b0789e5cf04669d6116f9a199264 Mon Sep 17 00:00:00 2001
From: Minjae Kim <flowergom@gmail.com>
Date: Sun, 26 Sep 2021 23:48:00 +0000
Subject: [PATCH] patch 8.2.3409: reading beyond end of line with invalid utf-8
 character

Problem: Reading beyond end of line with invalid utf-8 character.
Solution: Check for NUL when advancing.

Upstream-Status: Accepted [https://github.com/vim/vim/commit/65b605665997fad54ef39a93199e305af2fe4d7f]
CVE: CVE-2021-3778
Signed-off-by: Minjae Kim <flowergom@gmail.com>
---
 src/regexp_nfa.c                 | 3 ++-
 src/testdir/test_regexp_utf8.vim | 7 +++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

Index: git/src/regexp_nfa.c
===================================================================
--- git.orig/src/regexp_nfa.c
+++ git/src/regexp_nfa.c
@@ -5455,7 +5455,8 @@ find_match_text(colnr_T startcol, int re
 		match = FALSE;
 		break;
 	    }
-	    len2 += MB_CHAR2LEN(c2);
+	    len2 += enc_utf8 ? utf_ptr2len(rex.line + col + len2)
+                                                           : MB_CHAR2LEN(c2);
 	}
 	if (match
 		// check that no composing char follows
Index: git/src/testdir/test_regexp_utf8.vim
===================================================================
--- git.orig/src/testdir/test_regexp_utf8.vim
+++ git/src/testdir/test_regexp_utf8.vim
@@ -215,3 +215,10 @@ func Test_optmatch_toolong()
   set re=0
 endfunc
 
+func Test_match_invalid_byte()
+  call writefile(0z630a.765d30aa0a.2e0a.790a.4030, 'Xinvalid')
+  new
+  source Xinvalid
+  bwipe!
+  call delete('Xinvalid')
+endfunc