!441 fix CVE-2022-4141 and delete irrelevant log file

From: @wangjiang37 
Reviewed-by: @lvying6 
Signed-off-by: @lvying6

backport-CVE-2022-4141.patch

@@ -0,0 +1,145 @@
+From cc762a48d42b579fb7bdec2c614636b830342dd5 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Fri, 25 Nov 2022 13:03:31 +0000
+Subject: [PATCH] patch 9.0.0947: invalid memory access in substitute with
+ function
+
+Problem:    Invalid memory access in substitute with function that goes to
+            another file.
+Solution:   Check for text locked in CTRL-W gf.
+---
+ src/normal.c                    | 33 ++++++++++++++++++++++++---------
+ src/proto/normal.pro            |  1 +
+ src/testdir/test_substitute.vim | 19 +++++++++++++++++++
+ src/window.c                    |  4 +++-
+ 4 files changed, 47 insertions(+), 10 deletions(-)
+
+diff --git a/src/normal.c b/src/normal.c
+index 938ae718efa2..0d1eba759e69 100644
+--- a/src/normal.c
++++ b/src/normal.c
+@@ -192,13 +192,33 @@ check_text_locked(oparg_T *oap)
+ {
+     if (text_locked())
+     {
+-	clearopbeep(oap);
++	if (oap != NULL)
++	    clearopbeep(oap);
+ 	text_locked_msg();
+ 	return TRUE;
+     }
+     return FALSE;
+ }
+ 
++/*
++ * If text is locked, "curbuf_lock" or "allbuf_lock" is set:
++ * Give an error message, possibly beep and return TRUE.
++ * "oap" may be NULL.
++ */
++    int
++check_text_or_curbuf_locked(oparg_T *oap)
++{
++    if (check_text_locked(oap))
++	return TRUE;
++    if (curbuf_locked())
++    {
++	if (oap != NULL)
++	    clearop(oap);
++	return TRUE;
++    }
++    return FALSE;
++}
++
+ /*
+  * Handle the count before a normal command and set cap->count0.
+  */
+@@ -816,8 +836,7 @@ normal_cmd(
+ 	goto normal_end;
+     }
+ 
+-    if ((nv_cmds[idx].cmd_flags & NV_NCW)
+-				&& (check_text_locked(oap) || curbuf_locked()))
++    if ((nv_cmds[idx].cmd_flags & NV_NCW) && check_text_or_curbuf_locked(oap))	    
+ 	// this command is not allowed now
+ 	goto normal_end;
+ 
+@@ -4058,13 +4077,9 @@ nv_gotofile(cmdarg_T *cap)
+     char_u	*ptr;
+     linenr_T	lnum = -1;
+ 
+-    if (check_text_locked(cap->oap))
+-	return;
+-    if (curbuf_locked())
+-    {
+-	clearop(cap->oap);
++    if (check_text_or_curbuf_locked(cap->oap))	
+ 	return;
+-    }
++
+ #ifdef FEAT_PROP_POPUP
+     if (ERROR_IF_TERM_POPUP_WINDOW)
+ 	return;
+diff --git a/src/proto/normal.pro b/src/proto/normal.pro
+index 106d0e1..eff08df 100644
+--- a/src/proto/normal.pro
++++ b/src/proto/normal.pro
+@@ -1,4 +1,5 @@
+ /* normal.c */
++int check_text_or_curbuf_locked(oparg_T *oap);
+ void normal_cmd(oparg_T *oap, int toplevel);
+ void check_visual_highlight(void);
+ void end_visual_mode(void);
+diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
+index 7e7ccff..73c8c57 100644
+--- a/src/testdir/test_substitute.vim
++++ b/src/testdir/test_substitute.vim
+@@ -1076,6 +1076,25 @@ func Test_sub_edit_scriptfile()
+   bwipe!
+ endfunc
+ 
++" This was editing another file from the expression.
++func Test_sub_expr_goto_other_file()
++  call writefile([''], 'Xfileone', 'D')
++  enew!
++  call setline(1, ['a', 'b', 'c', 'd',
++	\ 'Xfileone zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz'])
++
++  func g:SplitGotoFile()
++    exe "sil! norm 0\<C-W>gf"
++    return ''
++  endfunc
++
++  $
++  s/\%')/\=g:SplitGotoFile()
++
++  delfunc g:SplitGotoFile
++  bwipe!
++endfunc
++
+ " Test for the 2-letter and 3-letter :substitute commands
+ func Test_substitute_short_cmd()
+   new
+diff --git a/src/window.c b/src/window.c
+index 97cc77035f95..a2bebcaea4df 100644
+--- a/src/window.c
++++ b/src/window.c
+@@ -534,6 +534,8 @@ do_window(
+     case Ctrl_F:
+ wingotofile:
+ 		CHECK_CMDWIN;
++		if (check_text_or_curbuf_locked(NULL))
++		    break;
+ 
+ 		ptr = grab_file_name(Prenum1, &lnum);
+ 		if (ptr != NULL)
+@@ -857,7 +859,7 @@ win_split(int size, int flags)
+  * When "new_wp" is NULL: split the current window in two.
+  * When "new_wp" is not NULL: insert this window at the far
+  * top/left/right/bottom.
+- * return FAIL for failure, OK otherwise
++ * Return FAIL for failure, OK otherwise.
+  */
+     int
+ win_split_ins(
+-- 
+2.33.0

vim.spec

@@ -12,7 +12,7 @@
 Name:           vim
 Epoch:          2
 Version:        9.0
-Release:        2
+Release:        3
 Summary:        Vim is a highly configurable text editor for efficiently creating and changing any kind of text.
 License:        Vim and MIT
 URL:            http://www.vim.org
@@ -73,6 +73,7 @@ Patch6043:      backport-CVE-2022-3297.patch
 Patch6044:      backport-9.0.0581-adding-a-character-for-incsearch-fails-at-end-of-line.patch
 Patch6045:      backport-CVE-2022-3324.patch
 Patch6046:      backport-CVE-2022-3705.patch
+Patch6047:      backport-CVE-2022-4141.patch
 
 Patch9000:      bugfix-rm-modify-info-version.patch
 Patch9001:      vim-Add-sw64-architecture.patch
@@ -473,6 +474,12 @@ LC_ALL=en_US.UTF-8 make -j1 test
 %{_mandir}/man1/evim.*
 
 %changelog
+* Mon Nov 28 2022 wangjiang <wangjiang37@h-partners.com> - 2:9.0-3
+- Type:CVE
+- ID:CVE-2022-4141
+- SUG:NA
+- DESC:fix CVE-2022-4141 and delete irrelevant log file
+
 * Thu Nov 10 2022 wuzx<wuzx1226@qq.com> - 2:9.0-2
 - Type:feature
 - CVE:NA