开源软件构建与测试

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

Changes of Revision 4

_service:extract_file:vim.spec Deleted

@@ -1,740 +0,0 @@
-%define _python3ver__ %(fullver=%{__python3} --version | awk '{print $2}';echo ${fullver:0:3})
-%define _python3path__ %{_includedir}/%{_python3ver__}m
-
-%{!?_with_selinux__:%global _with_selinux__ 1}
-%{!?_with_ruby__:%define _with_ruby__ 1}
-%{!?_with_lua__:%define _with_lua__ 1}
-%{!?_with_netbeans__:%define _with_netbeans__ 1}
-
-%define vimdir vim82
-%define python_ver %{python3_version}
-
-Name: vim
-Epoch: 2
-Version: 8.2
-Release: 37
-Summary: Vim is a highly configurable text editor for efficiently creating and changing any kind of text.
-License: Vim and MIT
-URL: http://www.vim.org
-Source0: ftp://ftp.vim.org/pub/vim/unix/vim-8.2.tar.bz2
-Source1:	 virc
-Source2:	 vimrc
-
-Patch0000: vim-7.0-fixkeys.patch
-Patch0001: vim-7.4-specsyntax.patch
-Patch0002: vim-7.4-syntax.patch
-Patch0003: vim-7.4-nowarnings.patch
-Patch0004: vim-7.0-rclocation.patch
-Patch0005: vim-7.4-checkhl.patch
-Patch0006: vim-7.4-fstabsyntax.patch
-Patch0007: vim-7.4-syncolor.patch
-Patch0009: vim-7.4-globalsyntax.patch
-Patch0010: vim-7.4-releasestring-1318991.patch
-Patch0011: vim-8.0-copy-paste.patch
-Patch0012: vim-python3-tests.patch
-Patch0013:	Fix-vim-lua5.4.0-defines+luaL_typeerror-twice.patch
-Patch6000: backport-Configure-does-not-recognize-gcc-10.0-and-later.patch
-Patch6001: backport-8.2.2550-signal-stack-size-is-wrong-with-lates.patch
-Patch6002: backport-CVE-2021-3770.patch
-Patch6003: backport-memory-leak-for-retab-with-invalid-argument.patch
-Patch6004: backport-CVE-2021-3778.patch
-Patch6005: backport-CVE-2021-3796.patch
-Patch6006: backport-CVE-2021-3872.patch
-Patch6007: backport-CVE-2021-3875.patch
-Patch6008: backport-CVE-2021-3903.patch
-Patch6009: backport-CVE-2021-3927.patch
-Patch6010: backport-CVE-2021-3928.patch
-Patch6011: backport-Python-3.9-does-not-define-_Py_DEC_REFTOTAL.patch
-Patch6012: backport-linker-errors-when-building-with-dynamic-Python-3.9.patch
-Patch6013: backport-PyEval_InitThreads-is-deprecated-in-Python-3.9.patch
-Patch6014: backport-linker-errors-with-dynamic-Python-3.10.patch
-Patch6015: backport-configure-cannot-detect-Python-3.10.patch
-Patch6016: backport-CVE-2021-3973.patch
-Patch6017: backport-CVE-2021-3974.patch
-Patch6018: backport-find-test-fails.patch
-Patch6019: backport-no-early-check-if-find-and-sfind-have-an-argument.patch
-Patch6020: backport-CVE-2021-3984.patch
-Patch6021: backport-CVE-2021-4019.patch
-Patch6022: backport-CVE-2021-4069.patch
-Patch6023: backport-build-failure-with-Perl5.32.patch
-Patch6024: backport-cannot-build-with-Strawberry-Perl-5.32.0.patch
-Patch6025: backport-cannot-build-with-Perl-5.34.patch
-Patch6026: backport-macros-for-Ruby-are-too-complicated.patch
-Patch6027: backport-build-problem-with-Ruby-2.7.patch
-Patch6028: backport-Ruby-missing-function-prototype.patch
-Patch6029: backport-build-failure-with-some-Ruby-versions.patch
-Patch6030: backport-compilation-error-with-Ruby-3.0.patch
-Patch6031: backport-build-failure-with-Ruby-3.0-and-32-bits.patch
-Patch6032: backport-missing-error-message.patch
-Patch6033: backport-fix-giving-the-error-0-more-files-to-edit.patch
-Patch6034: backport-add-the-arglist_locked-flag.patch
-Patch6035: backport-CVE-2021-4166.patch
-Patch6036: backport-fix-arglist-test-fails.patch
-Patch6037: backport-CVE-2021-4192.patch
-Patch6038: backport-CVE-2021-4193.patch
-Patch6039:	backport-CVE-2022-0213.patch
-Patch6040:	backport-CVE-2022-0261.patch
-Patch6041:	backport-CVE-2022-0318.patch
-Patch6042: backport-vim-fix-garbled-characters-display-when-file-name-ma.patch
-Patch6043: backport-CVE-2022-0351.patch
-Patch6044: backport-CVE-2022-0408.patch
-Patch6045: backport-CVE-2022-0361.patch
-Patch6046: backport-CVE-2022-0359.patch
-Patch6047: backport-CVE-2022-0413.patch
-Patch6048: backport-CVE-2022-0368.patch
-Patch6049: backport-CVE-2022-0443.patch
-Patch6050: backport-CVE-2022-0392.patch
-Patch6051: backport-invalid-argument-errmsg.patch
-Patch6052: backport-CVE-2022-0417.patch
-Patch6053: backport-crash-when-pasting-too-many-times.patch
-Patch6054: backport-CVE-2022-0572.patch
-Patch6055: backport-CVE-2022-0629.patch
-Patch6056: backport-CVE-2022-0714.patch
-Patch6057: backport-CVE-2022-0729.patch
-Patch6058: backport-CVE-2022-0685.patch
-Patch6059: backport-CVE-2022-0319.patch
-Patch6060: backport-CVE-2022-0554.patch
-Patch6061: backport-CVE-2022-0943.patch
-Patch6062: backport-CVE-2022-1616.patch
-Patch6063: backport-CVE-2022-1154.patch
-Patch6064: backport-html-text-objects-are-not-fully-tested.patch
-Patch6065: backport-CVE-2022-1629.patch
-Patch6066: backport-insufficient-code-coverage-for-ex_docmd.c_functions.patch
-Patch6067: backport-CVE-2022-1620.patch
-Patch6068: backport-CVE-2022-1674.patch
-Patch6069: backport-CVE-2022-1621.patch
-Patch6070: backport-spell-test-fails-because-of-new-illegal-byte-check.patch
-Patch6071: backport-command-line-editing-not-sufficiently-tested.patch
-Patch6072: backport-CVE-2022-1619.patch
-Patch6073: backport-CVE-2022-1733.patch
-Patch6074: backport-CVE-2022-1735.patch
-
-Patch9000: bugfix-rm-modify-info-version.patch
-
-BuildRequires: autoconf python3-devel ncurses-devel gettext perl-devel perl-generators gcc
-BuildRequires: perl(ExtUtils::Embed) perl(ExtUtils::ParseXS) libacl-devel gpm-devel file
-BuildRequires: desktop-file-utils >= 0.2.93
-%if %{_with_selinux__}
-BuildRequires: libselinux-devel
-%endif
-%if %{_with_ruby__}
-BuildRequires: ruby-devel ruby
-%endif
-%if %{_with_lua__}
-BuildRequires: lua-devel
-%endif
-Requires: desktop-file-utils
-Conflicts: filesystem < 3
-
-%description
-Vim is an advanced text editor that seeks to provide the power of the
-de-facto Unix editor 'Vi', with a more complete feature set. Vim is a
-highly configurable text editor built to enable efficient text editing.
-It is an improved version of the vi editor distributed with most UNIX
-systems.
-
-%package common
-Summary: This contains some common files to use vim editor.
-Requires: %{name}-filesystem
-Conflicts: man-pages-fr < 0.9.7-14 man-pages-it < 0.3.0-17 man-pages-pl < 0.24-2 %{name}-minimal < 8.0.1428-4
-
-%description common
-This common package contains files that will be needed when you run vim editor. This is also needed by vim-enhaned and vim-X11 packages.
-
-%package minimal
-Summary: This package provides the basic and minimal functionalities of vim editor.
-Provides: vi = %{version}-%{release} %{_bindir}/vi
-Conflicts: %{name}-common < 8.0.1428-4
-
-%description minimal
-The minimal package provides a minimal version of vim editor. It will be installed as /usr/bin/vi.
-
-%package enhanced
-Summary: This is a package containing enhanced vim editor.
-Requires: vim-common = %{epoch}:%{version}-%{release} which gpm-libs
-Provides: vim = %{version}-%{release} %{_bindir}/mergetool %{_bindir}/vim
-Suggests: python3 python3-libs
-Suggests: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
-Suggests: perl-libs perl-devel
-%if %{_with_ruby__}
-Suggests: ruby-libs ruby
-%endif
-%if %{_with_lua__}
-Suggests: lua-libs
-%endif
-
-%description enhanced
-This packages includes some enhancements for the vim editor.
-
-%package filesystem
-Summary: The vim filesystem.
-BuildArch: noarch
-
-%description filesystem
-This package contains the vim filesystem.
-
-%package X11
-Summary: Vim for the X Window System i.e.gvim
-BuildRequires: gtk3-devel libX11-devel libSM-devel libXt-devel libXpm-devel libICE-devel libappstream-glib
-Requires: vim-common = %{epoch}:%{version}-%{release} libattr >= 2.4 gtk3 hicolor-icon-theme
-Requires: libICE libSM libX11 libXt cairo gdk-pixbuf2 pango
-Provides: gvim = %{version}-%{release} %{_bindir}/mergetool %{_bindir}/gvim
-Suggests: python3 python3-libs
-Suggests: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
-Suggests: perl-libs perl-devel
-%if %{_with_ruby__}
-Suggests: ruby-libs ruby
-%endif
-%if %{_with_lua__}
-Suggests: lua-libs
-%endif
-
-%description X11
-This X11 package serves you the ability to use vim with graphics and mouse.
-
-%prep
-%autosetup -b 0 -n %{vimdir} -p1
-
-%build
-%define _make_cmd__() %{make_build} VIMRCLOC=/etc VIMRUNTIMEDIR=/usr/share/vim/%{vimdir}; cp vim %{?1}; %{!?2:make clean}

_service:tar_scm:vim.spec Added

@@ -0,0 +1,889 @@
+%define _python3ver__ %(fullver=%{__python3} --version | awk '{print $2}';echo ${fullver:0:3})
+%define _python3path__ %{_includedir}/%{_python3ver__}m
+
+%{!?_with_selinux__:%global _with_selinux__ 1}
+%{!?_with_ruby__:%define _with_ruby__ 1}
+%{!?_with_lua__:%define _with_lua__ 1}
+%{!?_with_netbeans__:%define _with_netbeans__ 1}
+
+%define vimdir vim90
+%define python_ver %{python3_version}
+
+Name: vim
+Epoch: 2
+Version: 9.0
+Release: 24
+Summary: Vim is a highly configurable text editor for efficiently creating and changing any kind of text.
+License: Vim and MIT
+URL: http://www.vim.org
+Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{version}.tar.bz2
+Source1:	 virc
+Source2:	 vimrc
+
+Patch0000: vim-7.0-fixkeys.patch
+Patch0001: vim-7.4-specsyntax.patch
+Patch0006: vim-7.4-fstabsyntax.patch
+Patch0009: vim-7.4-globalsyntax.patch
+Patch0011: vim-8.0-copy-paste.patch
+Patch0012: vim-python3-tests.patch
+
+Patch6000: backport-CVE-2022-2257.patch
+Patch6001: backport-CVE-2022-2264.patch
+Patch6002: backport-CVE-2022-2284.patch
+Patch6003: backport-CVE-2022-2285.patch
+Patch6004: backport-CVE-2022-2286.patch
+Patch6005: backport-CVE-2022-2287.patch
+Patch6006: backport-CVE-2022-2288.patch
+Patch6007: backport-patch-9.0.0022-spell-test-fails.patch
+Patch6008: backport-CVE-2022-2289.patch
+Patch6009: backport-CVE-2022-2304.patch
+Patch6010: backport-CVE-2022-2343.patch
+Patch6011: backport-CVE-2022-2344.patch
+Patch6012: backport-CVE-2022-2345.patch
+Patch6013: backport-patch-9.0.0054-compiler-warning-for-size_t-to-int-co.patch
+Patch6014: backport-CVE-2022-2522.patch
+Patch6015: backport-CVE-2022-2598.patch
+Patch6016: backport-CVE-2022-2571.patch
+Patch6017: backport-CVE-2022-2580.patch
+Patch6018: backport-CVE-2022-2581.patch
+Patch6019: backport-CVE-2022-2819.patch
+Patch6020: backport-CVE-2022-2816.patch
+Patch6021: backport-CVE-2022-2817.patch
+Patch6022: backport-CVE-2022-2845.patch
+Patch6023: backport-CVE-2022-2849.patch
+Patch6024: backport-CVE-2022-2862.patch
+Patch6025: backport-CVE-2022-2874.patch
+Patch6026: backport-CVE-2022-2889.patch
+Patch6027: backport-CVE-2022-2923.patch
+Patch6028: backport-CVE-2022-2946.patch
+Patch6029: backport-CVE-2022-2980.patch
+Patch6030: backport-CVE-2022-2982.patch
+Patch6031: backport-CVE-2022-3016.patch
+Patch6032: backport-CVE-2022-3037.patch
+Patch6033: backport-CVE-2022-3099.patch
+Patch6034: backport-CVE-2022-3134.patch
+Patch6035: backport-CVE-2022-3153.patch
+Patch6036: backport-CVE-2022-3234.patch
+Patch6037: backport-CVE-2022-3235.patch
+Patch6038: backport-CVE-2022-3256.patch
+Patch6039: backport-CVE-2022-3296.patch
+Patch6040: backport-CVE-2022-3352.patch
+Patch6041: backport-spell-test-fails-because-error-message-changed.patch
+Patch6042: backport-CVE-2022-3278.patch
+Patch6043: backport-CVE-2022-3297.patch
+Patch6044: backport-9.0.0581-adding-a-character-for-incsearch-fails-at-end-of-line.patch
+Patch6045: backport-CVE-2022-3324.patch
+Patch6046: backport-CVE-2022-3705.patch
+Patch6047: backport-CVE-2022-4141.patch
+Patch6048: backport-CVE-2022-3491.patch
+Patch6049: backport-CVE-2022-3520.patch
+Patch6050: backport-CVE-2022-3591.patch
+Patch6051: backport-patch-9.0.0790-test-for-dummy-buffer-does-not-always.patch
+Patch6052: backport-CVE-2022-4292.patch
+Patch6053: backport-patch-9.0.0712-wrong-column-when-calling-setcursorch-with-zero-lnum.patch
+Patch6054: backport-CVE-2022-4293.patch
+
+Patch9000: bugfix-rm-modify-info-version.patch
+
+BuildRequires: autoconf python3-devel ncurses-devel gettext perl-devel perl-generators gcc
+BuildRequires: perl(ExtUtils::Embed) perl(ExtUtils::ParseXS) libacl-devel gpm-devel file
+BuildRequires: desktop-file-utils >= 0.2.93 libtool make chrpath
+%if %{_with_selinux__}
+BuildRequires: libselinux-devel
+%endif
+%if %{_with_ruby__}
+BuildRequires: ruby-devel ruby
+%endif
+%if %{_with_lua__}
+BuildRequires: lua-devel
+%endif
+Requires: desktop-file-utils
+Conflicts: filesystem < 3
+
+%description
+Vim is an advanced text editor that seeks to provide the power of the
+de-facto Unix editor 'Vi', with a more complete feature set. Vim is a
+highly configurable text editor built to enable efficient text editing.
+It is an improved version of the vi editor distributed with most UNIX
+systems.
+
+%package common
+Summary: This contains some common files to use vim editor.
+Requires: %{name}-filesystem
+Conflicts: man-pages-fr < 0.9.7-14 man-pages-it < 0.3.0-17 man-pages-pl < 0.24-2 %{name}-minimal < 8.0.1428-4
+
+%description common
+This common package contains files that will be needed when you run vim editor. This is also needed by vim-enhaned and vim-X11 packages.
+
+%package minimal
+Summary: This package provides the basic and minimal functionalities of vim editor.
+Provides: vi = %{version}-%{release} %{_bindir}/vi
+Conflicts: %{name}-common < 8.0.1428-4
+
+%description minimal
+The minimal package provides a minimal version of vim editor. It will be installed as /usr/bin/vi.
+
+%package enhanced
+Summary: This is a package containing enhanced vim editor.
+Requires: vim-common = %{epoch}:%{version}-%{release} which gpm-libs
+Provides: vim = %{version}-%{release} %{_bindir}/mergetool %{_bindir}/vim
+Suggests: python3 python3-libs
+Suggests: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
+Suggests: perl-libs perl-devel
+%if %{_with_ruby__}
+Suggests: ruby-libs ruby
+%endif
+%if %{_with_lua__}
+Suggests: lua-libs
+%endif
+
+%description enhanced
+This packages includes some enhancements for the vim editor.
+
+%package filesystem
+Summary: The vim filesystem.
+BuildArch: noarch
+
+%description filesystem
+This package contains the vim filesystem.
+
+%package X11
+Summary: Vim for the X Window System i.e.gvim
+BuildRequires: gtk3-devel libX11-devel libSM-devel libXt-devel libXpm-devel libICE-devel libappstream-glib
+Requires: vim-common = %{epoch}:%{version}-%{release} libattr >= 2.4 gtk3 hicolor-icon-theme
+Requires: libICE libSM libX11 libXt cairo gdk-pixbuf2 pango
+Provides: gvim = %{version}-%{release} %{_bindir}/mergetool %{_bindir}/gvim
+Suggests: python3 python3-libs
+Suggests: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
+Suggests: perl-libs perl-devel
+%if %{_with_ruby__}
+Suggests: ruby-libs ruby
+%endif
+%if %{_with_lua__}
+Suggests: lua-libs
+%endif
+
+%description X11
+This X11 package serves you the ability to use vim with graphics and mouse.
+
+%prep
+%autosetup -b 0 -n %{vimdir} -p1
+
+#ipv6 test fail in CI, it should be related to the ipv6 configuration on jenkins, which is successful on openEuler obs
+rm -rf src/testdir/test_channel.*
+
+%build
+%define _make_cmd__() %{make_build} VIMRCLOC=/etc VIMRUNTIMEDIR=/usr/share/vim/%{vimdir}; cp vim %{?1}; %{!?2:make clean}
+
+export CFLAGS="%{optflags} -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_FORTIFY_SOURCE=2 -I%{_python3path__} -D__linux__ -D_REENTRANT"
+export CXXFLAGS="%{optflags} -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_FORTIFY_SOURCE=2 -I%{_python3path__} -D__linux__ -D_REENTRANT"
+
+sed -i 's/nawk/awk/g' runtime/tools/mve.awk
+cd src; autoconf
+
+cp -f os_unix.h os_unix.h.bak
+
+sed -i 's/vimrc/virc/' os_unix.h
+%configure --with-features=small --with-x=no --enable-multibyte --disable-netbeans \
+ --disable-pythoninterp --disable-perlinterp --disable-tclinterp --with-tlib=ncurses \
+ --enable-gui=no --disable-gpm --exec-prefix=/ \
+ --enable-fail-if-missing --with-python3-config-dir=/usr/lib64/python%{python_ver}/config-%{python_ver}-%{_arch}-linux-gnu \
+%if %{_with_selinux__}
+ --enable-selinux \
+%else
+ --disable-selinux \
+%endif
+
+%{_make_cmd__ vim-minimal}
+
+mv os_unix.h.bak os_unix.h

_service:extract_file:Fix-vim-lua5.4.0-defines+luaL_typeerror-twice.patch Deleted

@@ -1,56 +0,0 @@
-From ea3ebd50e2a4ec26ee503f352a1280e11e4af93b Mon Sep 17 00:00:00 2001
-From: Zdenek Dohnal <zdohnal@redhat.com>
-Date: Tue, 14 Jul 2020 12:14:03 +0200
-Subject: PATCH if_lua.c: new Lua 5.4.0 defines luaL_typeerror, so don't
- define it twice
- 
----
- src/if_lua.c | 11 ++++++++++-
- 1 file changed, 10 insertions(+), 1 deletion(-)
-
-diff --git a/src/if_lua.c b/src/if_lua.c
-index 9b03c97..81faf92 100644
---- a/src/if_lua.c
-+++ b/src/if_lua.c
-@@ -109,6 +109,9 @@ static luaV_Funcref *luaV_pushfuncref(lua_State *L, char_u *name);
- #define luaL_loadbufferx dll_luaL_loadbufferx
- #define luaL_argerror dll_luaL_argerror
- #endif
-+#if LUA_VERSION_NUM >= 504
-+#define luaL_typeerror dll_luaL_typeerror
-+#endif
- #define luaL_checkany dll_luaL_checkany
- #define luaL_checklstring dll_luaL_checklstring
- #define luaL_checkinteger dll_luaL_checkinteger
-@@ -203,6 +206,9 @@ int (*dll_luaL_loadfilex) (lua_State *L, const char *filename, const char *mode)
- int (*dll_luaL_loadbufferx) (lua_State *L, const char *buff, size_t sz, const char *name, const char *mode);
- int (*dll_luaL_argerror) (lua_State *L, int numarg, const char *extramsg);
- #endif
-+#if LUA_VERSION_NUM >= 504
-+int (*dll_luaL_typeerror) (lua_State *L, int narg, const char *tname);
-+#endif
- void (*dll_luaL_checkany) (lua_State *L, int narg);
- const char *(*dll_luaL_checklstring) (lua_State *L, int numArg, size_t *l);
- lua_Integer (*dll_luaL_checkinteger) (lua_State *L, int numArg);
-@@ -314,6 +320,9 @@ static const luaV_Reg luaV_dll = {
- {"luaL_loadfilex", (luaV_function) &dll_luaL_loadfilex},
- {"luaL_loadbufferx", (luaV_function) &dll_luaL_loadbufferx},
- {"luaL_argerror", (luaV_function) &dll_luaL_argerror},
-+#endif
-+#if LUA_VERSION_NUM >= 504
-+ {"luaL_typeerror", (luaV_function) &dll_luaL_typeerror},
- #endif
- {"luaL_checkany", (luaV_function) &dll_luaL_checkany},
- {"luaL_checklstring", (luaV_function) &dll_luaL_checklstring},
-@@ -443,7 +452,7 @@ lua_enabled(int verbose)
- }
- #endif
- 
--#if LUA_VERSION_NUM > 501
-+#if LUA_VERSION_NUM > 501 && LUA_VERSION_NUM < 504
- static int
- luaL_typeerror(lua_State *L, int narg, const char *tname)
- {
--- 
-2.23.0
-

_service:extract_file:backport-8.2.2550-signal-stack-size-is-wrong-with-lates.patch Deleted

@@ -1,132 +0,0 @@
-From 0e62a6742bca186624e97e2121c98ada30e009a0 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 25 Feb 2021 17:17:56 +0100
-Subject: PATCH 4236/5000 patch 8.2.2550: signal stack size is wrong with
- latest glibc 2.34
-
-Problem: Signal stack size is wrong with latest glibc 2.34.
-Solution: Use sysconf(_SC_SIGSTKSZ) if available. (Zdenek Dohnal, closes
- #7895)
----
- src/auto/configure | 24 ++++++++++++++++++++++++
- src/config.h.in | 3 +++
- src/configure.ac | 9 +++++++++
- src/os_unix.c | 14 +++++++++++++-
- 4 files changed, 49 insertions(+), 1 deletion(-)
-
-diff --git a/src/auto/configure b/src/auto/configure
-index 250e5ae..8183499 100755
---- a/src/auto/configure
-+++ b/src/auto/configure
-@@ -13943,6 +13943,30 @@ $as_echo "not usable" >&6; }
- fi
- rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- 
-+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for _SC_SIGSTKSZ via sysconf()" >&5
-+$as_echo_n "checking for _SC_SIGSTKSZ via sysconf()... " >&6; }
-+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-+/* end confdefs.h. */
-+#include <unistd.h>
-+int
-+main ()
-+{
-+	(void)sysconf(_SC_SIGSTKSZ);
-+
-+ ;
-+ return 0;
-+}
-+_ACEOF
-+if ac_fn_c_try_compile "$LINENO"; then :
-+ { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-+$as_echo "yes" >&6; }; $as_echo "#define HAVE_SYSCONF_SIGSTKSZ 1" >>confdefs.h
-+
-+else
-+ { $as_echo "$as_me:${as_lineno-$LINENO}: result: not usable" >&5
-+$as_echo "not usable" >&6; }
-+fi
-+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-+
- # The cast to long int works around a bug in the HP C Compiler
- # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
- # declarations like `int a3(sizeof (unsigned char)) >= 0;'.
-diff --git a/src/config.h.in b/src/config.h.in
-index b114480..5d01e2c 100644
---- a/src/config.h.in
-+++ b/src/config.h.in
-@@ -496,3 +496,6 @@
- 
- /* Define to inline symbol or empty */
- #undef inline
-+
-+/* Define if _SC_SIGSTKSZ is available via sysconf() */
-+#undef HAVE_SYSCONF_SIGSTKSZ
-diff --git a/src/configure.ac b/src/configure.ac
-index 58bfa19..798e9b8 100644
---- a/src/configure.ac
-+++ b/src/configure.ac
-@@ -4105,6 +4105,15 @@ AC_TRY_COMPILE(
- 	AC_MSG_RESULT(yes); AC_DEFINE(HAVE_SYSCONF),
- 	AC_MSG_RESULT(not usable))
- 
-+dnl check if we have _SC_SIGSTKSZ via sysconf()
-+AC_MSG_CHECKING(for _SC_SIGSTKSZ via sysconf())
-+AC_TRY_COMPILE(
-+#include <unistd.h>,
-+	(void)sysconf(_SC_SIGSTKSZ);
-+	,
-+	AC_MSG_RESULT(yes); AC_DEFINE(HAVE_SYSCONF_SIGSTKSZ),
-+	AC_MSG_RESULT(not usable))
-+
- AC_CHECK_SIZEOF(int)
- AC_CHECK_SIZEOF(long)
- AC_CHECK_SIZEOF(time_t)
-diff --git a/src/os_unix.c b/src/os_unix.c
-index 1edc7e6..1c80799 100644
---- a/src/os_unix.c
-+++ b/src/os_unix.c
-@@ -783,7 +783,7 @@ mch_stackcheck(char *p)
- * completely full.
- */
- 
--#ifndef SIGSTKSZ
-+#if !defined SIGSTKSZ && !defined(HAVE_SYSCONF_SIGSTKSZ)
- # define SIGSTKSZ 8000 // just a guess of how much stack is needed...
- #endif
- 
-@@ -806,13 +806,21 @@ init_signal_stack(void)
- # else
- 	sigstk.ss_sp = signal_stack;
- # endif
-+# ifdef HAVE_SYSCONF_SIGSTKSZ
-+	sigstk.ss_size = sysconf(_SC_SIGSTKSZ);
-+# else
- 	sigstk.ss_size = SIGSTKSZ;
-+# endif
- 	sigstk.ss_flags = 0;
- 	(void)sigaltstack(&sigstk, NULL);
- # else
- 	sigstk.ss_sp = signal_stack;
- 	if (stack_grows_downwards)
-+# ifdef HAVE_SYSCONF_SIGSTKSZ
-+	 sigstk.ss_sp += sysconf(_SC_SIGSTKSZ) - 1;
-+# else
- 	 sigstk.ss_sp += SIGSTKSZ - 1;
-+# endif
- 	sigstk.ss_onstack = 0;
- 	(void)sigstack(&sigstk, NULL);
- # endif
-@@ -3261,7 +3269,11 @@ mch_early_init(void)
- * Ignore any errors.
- */
- #if defined(HAVE_SIGALTSTACK) || defined(HAVE_SIGSTACK)
-+# ifdef HAVE_SYSCONF_SIGSTKSZ
-+ signal_stack = alloc(sysconf(_SC_SIGSTKSZ));
-+# else
- signal_stack = alloc(SIGSTKSZ);
-+# endif
- init_signal_stack();
- #endif
- }
--- 
-1.8.3.1
-

_service:extract_file:backport-CVE-2021-3770.patch Deleted

@@ -1,206 +0,0 @@
-From b7081e135a16091c93f6f5f7525a5c58fb7ca9f9 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sat, 4 Sep 2021 18:47:28 +0200
-Subject: PATCH patch 8.2.3402: invalid memory access when using :retab with
- large value
-
-Problem: Invalid memory access when using :retab with large value.
-Solution: Check the number is positive.
----
- src/indent.c | 34 +++++++++++++++++++++-------------
- src/option.c | 12 ++++++------
- src/optionstr.c | 4 ++--
- src/testdir/test_retab.vim | 3 +++
- src/version.c | 2 ++
- 5 files changed, 34 insertions(+), 21 deletions(-)
-
-diff --git a/src/indent.c b/src/indent.c
-index 32f1e12..7e196c2 100644
---- a/src/indent.c
-+++ b/src/indent.c
-@@ -18,18 +18,19 @@
- /*
- * Set the integer values corresponding to the string setting of 'vartabstop'.
- * "array" will be set, caller must free it if needed.
-+ * Return FAIL for an error.
- */
- int
- tabstop_set(char_u *var, int **array)
- {
-- int valcount = 1;
-- int t;
-- char_u *cp;
-+ int	 valcount = 1;
-+ int	 t;
-+ char_u *cp;
- 
- if (var0 == NUL || (var0 == '0' && var1 == NUL))
- {
- 	*array = NULL;
--	return TRUE;
-+	return OK;
- }
- 
- for (cp = var; *cp != NUL; ++cp)
-@@ -43,8 +44,8 @@ tabstop_set(char_u *var, int **array)
- 		if (cp != end)
- 		 emsg(_(e_positive));
- 		else
--		 emsg(_(e_invarg));
--		return FALSE;
-+		 semsg(_(e_invarg2), cp);
-+		return FAIL;
- 	 }
- 	}
- 
-@@ -55,26 +56,33 @@ tabstop_set(char_u *var, int **array)
- 	 ++valcount;
- 	 continue;
- 	}
--	emsg(_(e_invarg));
--	return FALSE;
-+	semsg(_(e_invarg2), var);
-+	return FAIL;
- }
- 
- *array = ALLOC_MULT(int, valcount + 1);
- if (*array == NULL)
--	return FALSE;
-+	return FAIL;
- (*array)0 = valcount;
- 
- t = 1;
- for (cp = var; *cp != NUL;)
- {
--	(*array)t++ = atoi((char *)cp);
--	while (*cp != NUL && *cp != ',')
-+	int n = atoi((char *)cp);
-+
-+	if (n < 0 || n > 9999)
-+	{
-+	 semsg(_(e_invarg2), cp);
-+	 return FAIL;
-+	}
-+	(*array)t++ = n;
-+	while (*cp != NUL && *cp != ',')
- 	 ++cp;
- 	if (*cp != NUL)
- 	 ++cp;
- }
- 
-- return TRUE;
-+ return OK;
- }
- 
- /*
-@@ -1556,7 +1564,7 @@ ex_retab(exarg_T *eap)
- 
- #ifdef FEAT_VARTABS
- new_ts_str = eap->arg;
-- if (!tabstop_set(eap->arg, &new_vts_array))
-+ if (tabstop_set(eap->arg, &new_vts_array) == FAIL)
- 	return;
- while (vim_isdigit(*(eap->arg)) || *(eap->arg) == ',')
- 	++(eap->arg);
-diff --git a/src/option.c b/src/option.c
-index 5c99c69..e9598d6 100644
---- a/src/option.c
-+++ b/src/option.c
-@@ -2292,9 +2292,9 @@ didset_options2(void)
- #endif
- #ifdef FEAT_VARTABS
- vim_free(curbuf->b_p_vsts_array);
-- tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
-+ (void)tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
- vim_free(curbuf->b_p_vts_array);
-- tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array);
-+ (void)tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array);
- #endif
- }
- 
-@@ -5756,7 +5756,7 @@ buf_copy_options(buf_T *buf, int flags)
- 	 buf->b_p_vsts = vim_strsave(p_vsts);
- 	 COPY_OPT_SCTX(buf, BV_VSTS);
- 	 if (p_vsts && p_vsts != empty_option)
--		tabstop_set(p_vsts, &buf->b_p_vsts_array);
-+		(void)tabstop_set(p_vsts, &buf->b_p_vsts_array);
- 	 else
- 		buf->b_p_vsts_array = 0;
- 	 buf->b_p_vsts_nopaste = p_vsts_nopaste
-@@ -5914,7 +5914,7 @@ buf_copy_options(buf_T *buf, int flags)
- 		buf->b_p_isk = save_p_isk;
- #ifdef FEAT_VARTABS
- 		if (p_vts && p_vts != empty_option && !buf->b_p_vts_array)
--		 tabstop_set(p_vts, &buf->b_p_vts_array);
-+		 (void)tabstop_set(p_vts, &buf->b_p_vts_array);
- 		else
- 		 buf->b_p_vts_array = NULL;
- #endif
-@@ -5929,7 +5929,7 @@ buf_copy_options(buf_T *buf, int flags)
- 		buf->b_p_vts = vim_strsave(p_vts);
- 		COPY_OPT_SCTX(buf, BV_VTS);
- 		if (p_vts && p_vts != empty_option && !buf->b_p_vts_array)
--		 tabstop_set(p_vts, &buf->b_p_vts_array);
-+		 (void)tabstop_set(p_vts, &buf->b_p_vts_array);
- 		else
- 		 buf->b_p_vts_array = NULL;
- #endif
-@@ -6634,7 +6634,7 @@ paste_option_changed(void)
- 	 if (buf->b_p_vsts_array)
- 		vim_free(buf->b_p_vsts_array);
- 	 if (buf->b_p_vsts && buf->b_p_vsts != empty_option)
--		tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
-+		(void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
- 	 else
- 		buf->b_p_vsts_array = 0;
- #endif
-diff --git a/src/optionstr.c b/src/optionstr.c
-index 98e90a4..383babe 100644
---- a/src/optionstr.c
-+++ b/src/optionstr.c
-@@ -2166,7 +2166,7 @@ did_set_string_option(
- 	 if (errmsg == NULL)
- 	 {
- 		int *oldarray = curbuf->b_p_vsts_array;
--		if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)))
-+		if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)) == OK)
- 		{
- 		 if (oldarray)
- 			vim_free(oldarray);
-@@ -2205,7 +2205,7 @@ did_set_string_option(
- 	 {
- 		int *oldarray = curbuf->b_p_vts_array;
- 
--		if (tabstop_set(*varp, &(curbuf->b_p_vts_array)))
-+		if (tabstop_set(*varp, &(curbuf->b_p_vts_array)) == OK)
- 		{
- 		 vim_free(oldarray);
- #ifdef FEAT_FOLDING
-diff --git a/src/testdir/test_retab.vim b/src/testdir/test_retab.vim
-index f11a32b..e7b8946 100644
---- a/src/testdir/test_retab.vim
-+++ b/src/testdir/test_retab.vim
-@@ -74,4 +74,7 @@ endfunc
- func Test_retab_error()
- call assert_fails('retab -1', 'E487:')
- call assert_fails('retab! -1', 'E487:')
-+ call assert_fails('ret -1000', 'E487:')
-+ call assert_fails('ret 10000', 'E475:')
-+ call assert_fails('ret 80000000000000000000', 'E475:')
- endfunc
-diff --git a/src/version.c b/src/version.c
-index 3ef6259..8912f62 100644
---- a/src/version.c
-+++ b/src/version.c
-@@ -743,6 +743,8 @@ static char *(features) =
- static int included_patches =
- { /* Add new patch number below this line */
- /**/
-+ 3402,

_service:extract_file:backport-CVE-2021-3778.patch Deleted

@@ -1,46 +0,0 @@
-From 65b605665997fad54ef39a93199e305af2fe4d7f Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 7 Sep 2021 19:26:53 +0200
-Subject: PATCH patch 8.2.3409: reading beyond end of line with invalid utf-8
- character
-
-Problem: Reading beyond end of line with invalid utf-8 character.
-Solution: Check for NUL when advancing.
----
- src/regexp_nfa.c | 3 ++-
- src/testdir/test_regexp_utf8.vim | 8 ++++++++
- 2 files changed, 10 insertions(+), 1 deletion(-)
-
-diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c
-index fb512f9..bc4a4b6 100644
---- a/src/regexp_nfa.c
-+++ b/src/regexp_nfa.c
-@@ -5455,7 +5455,8 @@ find_match_text(colnr_T startcol, int regstart, char_u *match_text)
- 		match = FALSE;
- 		break;
- 	 }
--	 len2 += MB_CHAR2LEN(c2);
-+	 len2 += enc_utf8 ? utf_ptr2len(rex.line + col + len2)
-+							 : MB_CHAR2LEN(c2);
- 	}
- 	if (match
- 		// check that no composing char follows
-diff --git a/src/testdir/test_regexp_utf8.vim b/src/testdir/test_regexp_utf8.vim
-index 19ff882..6d0ce59 100644
---- a/src/testdir/test_regexp_utf8.vim
-+++ b/src/testdir/test_regexp_utf8.vim
-@@ -215,3 +215,11 @@ func Test_optmatch_toolong()
- set re=0
- endfunc
- 
-+func Test_match_invalid_byte()
-+ call writefile(0z630a.765d30aa0a.2e0a.790a.4030, 'Xinvalid')
-+ new
-+ source Xinvalid
-+ bwipe!
-+ call delete('Xinvalid')
-+endfunc
-+
--- 
-1.8.3.1
-

_service:extract_file:backport-CVE-2021-3796.patch Deleted

@@ -1,67 +0,0 @@
-From 35a9a00afcb20897d462a766793ff45534810dc3 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sat, 11 Sep 2021 21:14:20 +0200
-Subject: PATCH patch 8.2.3428: using freed memory when replacing
-
-Problem: Using freed memory when replacing. (Dhiraj Mishra)
-Solution: Get the line pointer after calling ins_copychar().
----
- src/normal.c | 10 +++++++---
- src/testdir/test_edit.vim | 13 +++++++++++++
- 2 files changed, 20 insertions(+), 3 deletions(-)
-
-diff --git a/src/normal.c b/src/normal.c
-index c4963e6..d6333b9 100644
---- a/src/normal.c
-+++ b/src/normal.c
-@@ -5009,19 +5009,23 @@ nv_replace(cmdarg_T *cap)
- 	 {
- 		/*
- 		 * Get ptr again, because u_save and/or showmatch() will have
--		 * released the line. At the same time we let know that the
--		 * line will be changed.
-+		 * released the line. This may also happen in ins_copychar().
-+		 * At the same time we let know that the line will be changed.
- 		 */
--		ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
- 		if (cap->nchar == Ctrl_E || cap->nchar == Ctrl_Y)
- 		{
- 		 int c = ins_copychar(curwin->w_cursor.lnum
- 					 + (cap->nchar == Ctrl_Y ? -1 : 1));
-+
-+		 ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
- 		 if (c != NUL)
- 		 ptrcurwin->w_cursor.col = c;
- 		}
- 		else
-+		{
-+		 ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
- 		 ptrcurwin->w_cursor.col = cap->nchar;
-+		}
- 		if (p_sm && msg_silent == 0)
- 		 showmatch(cap->nchar);
- 		++curwin->w_cursor.col;
-diff --git a/src/testdir/test_edit.vim b/src/testdir/test_edit.vim
-index 4e29e7f..c3b1af5 100644
---- a/src/testdir/test_edit.vim
-+++ b/src/testdir/test_edit.vim
-@@ -1519,3 +1519,16 @@ func Test_edit_noesckeys()
- bwipe!
- set esckeys
- endfunc
-+
-+" Test for getting the character of the line below after "p"
-+func Test_edit_put_CTRL_E()
-+ set encoding=latin1
-+ new
-+ let @" = ''
-+ sil! norm or&#x3;ggRx
-+ sil! norm pr&#x5;
-+ call assert_equal('r', 'r', getline(1, 2))
-+ bwipe!
-+ set encoding=utf-8
-+endfunc
-+
--- 
-1.8.3.1
-

_service:extract_file:backport-CVE-2021-3872.patch Deleted

@@ -1,70 +0,0 @@
-From 826bfe4bbd7594188e3d74d2539d9707b1c6a14b Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Fri, 8 Oct 2021 18:39:28 +0100
-Subject: PATCH patch 8.2.3487: illegal memory access if buffer name is very
- long
-
-Problem: Illegal memory access if buffer name is very long.
-Solution: Make sure not to go over the end of the buffer.
----
- src/drawscreen.c | 10 +++++-----
- src/testdir/test_statusline.vim | 10 ++++++++++
- 2 files changed, 15 insertions(+), 5 deletions(-)
-
-diff --git a/src/drawscreen.c b/src/drawscreen.c
-index 3a88ee9..9acb705 100644
---- a/src/drawscreen.c
-+++ b/src/drawscreen.c
-@@ -446,13 +446,13 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED)
- 	 *(p + len++) = ' ';
- 	if (bt_help(wp->w_buffer))
- 	{
--	 STRCPY(p + len, _("Help"));
-+	 vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("Help"));
- 	 len += (int)STRLEN(p + len);
- 	}
- #ifdef FEAT_QUICKFIX
- 	if (wp->w_p_pvw)
- 	{
--	 STRCPY(p + len, _("Preview"));
-+	 vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("Preview"));
- 	 len += (int)STRLEN(p + len);
- 	}
- #endif
-@@ -462,12 +462,12 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED)
- #endif
- 		)
- 	{
--	 STRCPY(p + len, "+");
--	 len += 3;
-+	 vim_snprintf((char *)p + len, MAXPATHL - len, "%s", "+");
-+	 len += (int)STRLEN(p + len);
- 	}
- 	if (wp->w_buffer->b_p_ro)
- 	{
--	 STRCPY(p + len, _("RO"));
-+	 vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("RO"));
- 	 len += (int)STRLEN(p + len);
- 	}
- 
-diff --git a/src/testdir/test_statusline.vim b/src/testdir/test_statusline.vim
-index 1f705b8..febb5d6 100644
---- a/src/testdir/test_statusline.vim
-+++ b/src/testdir/test_statusline.vim
-@@ -393,3 +393,13 @@ func Test_statusline_visual()
- bwipe! x1
- bwipe! x2
- endfunc
-+
-+" Used to write beyond allocated memory. This assumes MAXPATHL is 4096 bytes.
-+func Test_statusline_verylong_filename()
-+ let fname = repeat('x', 4090)
-+ exe "new " .. fname
-+ set buftype=help
-+ set previewwindow
-+ redraw
-+ bwipe!
-+endfunc
--- 
-2.27.0
-

_service:extract_file:backport-CVE-2021-3875.patch Deleted

@@ -1,54 +0,0 @@
-From 35a319b77f897744eec1155b736e9372c9c5575f Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sat, 9 Oct 2021 13:58:55 +0100
-Subject: PATCH patch 8.2.3489: ml_get error after search with range
-
-Problem: ml_get error after search with range.
-Solution: Limit the line number to the buffer line count.
----
- src/ex_docmd.c | 6 ++++--
- src/testdir/test_search.vim | 14 ++++++++++++++
- 2 files changed, 18 insertions(+), 2 deletions(-)
-
-diff --git a/src/ex_docmd.c b/src/ex_docmd.c
-index 76daf43..12554fa 100644
---- a/src/ex_docmd.c
-+++ b/src/ex_docmd.c
-@@ -3586,8 +3586,10 @@ get_address(
- 
- 		 // When '/' or '?' follows another address, start from
- 		 // there.
--		 if (lnum != MAXLNUM)
--			curwin->w_cursor.lnum = lnum;
-+		 if (lnum > 0 && lnum != MAXLNUM)
-+			curwin->w_cursor.lnum =
-+				lnum > curbuf->b_ml.ml_line_count
-+					 ? curbuf->b_ml.ml_line_count : lnum;
- 
- 		 // Start a forward search at the end of the line (unless
- 		 // before the first line).
-diff --git a/src/testdir/test_search.vim b/src/testdir/test_search.vim
-index 1876713..ac0881c 100644
---- a/src/testdir/test_search.vim
-+++ b/src/testdir/test_search.vim
-@@ -1366,3 +1366,17 @@ func Test_searchdecl()
- 
- bwipe!
- endfunc
-+
-+func Test_search_with_invalid_range()
-+ new
-+ let lines =<< trim END
-+ /\%.v
-+ 5/
-+ c
-+ END
-+ call writefile(lines, 'Xrangesearch')
-+ source Xrangesearch
-+
-+ bwipe!
-+ call delete('Xrangesearch')
-+endfunc
--- 
-2.27.0
-

_service:extract_file:backport-CVE-2021-3903.patch Deleted

@@ -1,78 +0,0 @@
-From 777e7c21b7627be80961848ac560cb0a9978ff43 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Mon, 25 Oct 2021 17:07:04 +0100
-Subject: PATCH patch 8.2.3564: invalid memory access when scrolling without
- valid screen
-
-Problem: Invalid memory access when scrolling without a valid screen.
-Solution: Do not set VALID_BOTLINE in w_valid.
----
- src/move.c | 1 -
- src/testdir/test_normal.vim | 22 +++++++++++++++++++---
- 2 files changed, 19 insertions(+), 4 deletions(-)
-
-diff --git a/src/move.c b/src/move.c
-index 8e53d8b..10165ef 100644
---- a/src/move.c
-+++ b/src/move.c
-@@ -198,7 +198,6 @@ update_topline(void)
- {
- 	curwin->w_topline = curwin->w_cursor.lnum;
- 	curwin->w_botline = curwin->w_topline;
--	curwin->w_valid |= VALID_BOTLINE|VALID_BOTLINE_AP;
- 	curwin->w_scbind_pos = 1;
- 	return;
- }
-diff --git a/src/testdir/test_normal.vim b/src/testdir/test_normal.vim
-index d45cf41..1f0088a 100644
---- a/src/testdir/test_normal.vim
-+++ b/src/testdir/test_normal.vim
-@@ -33,14 +33,14 @@ func CountSpaces(type, ...)
- else
- silent exe "normal! `v`y"
- endif
-- let g:a=strlen(substitute(@@, '^ ', '', 'g'))
-+ let g:a = strlen(substitute(@@, '^ ', '', 'g'))
- let &selection = sel_save
- let @@ = reg_save
- endfunc
- 
- func OpfuncDummy(type, ...)
- " for testing operatorfunc
-- let g:opt=&linebreak
-+ let g:opt = &linebreak
- 
- if a:0 " Invoked from Visual mode, use gv command.
- silent exe "normal! gvy"
-@@ -51,7 +51,7 @@ func OpfuncDummy(type, ...)
- endif
- " Create a new dummy window
- new
-- let g:bufnr=bufnr('%')
-+ let g:bufnr = bufnr('%')
- endfunc
- 
- fun! Test_normal00_optrans()
-@@ -2705,3 +2705,19 @@ func Test_normal_gk()
- bw!
- set cpoptions& number& numberwidth&
- endfunc
-+
-+func Test_scroll_in_ex_mode()
-+ " This was using invalid memory because w_botline was invalid.
-+ let lines =<< trim END
-+ diffsplit
-+ norm os0&#x3;0(&#x4;
-+ call writefile('done', 'Xdone')
-+ qa!
-+ END
-+ call writefile(lines, 'Xscript')
-+ call assert_equal(1, RunVim(, , '--clean -X -Z -e -s -S Xscript'))
-+ call assert_equal('done', readfile('Xdone'))
-+
-+ call delete('Xscript')
-+ call delete('Xdone')
-+endfunc
--- 
-1.8.3.1
-

_service:extract_file:backport-CVE-2021-3927.patch Deleted

@@ -1,44 +0,0 @@
-From 0b5b06cb4777d1401fdf83e7d48d287662236e7e Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 4 Nov 2021 15:10:11 +0000
-Subject: PATCH patch 8.2.3581: reading character past end of line
-
-Problem: Reading character past end of line.
-Solution: Correct the cursor column.
----
- src/ex_docmd.c | 1 +
- src/testdir/test_put.vim | 9 +++++++++
- 2 files changed, 10 insertions(+)
-
-diff --git a/src/ex_docmd.c b/src/ex_docmd.c
-index 12554fa..203174a 100644
---- a/src/ex_docmd.c
-+++ b/src/ex_docmd.c
-@@ -6906,6 +6906,7 @@ ex_put(exarg_T *eap)
- 	eap->forceit = TRUE;
- }
- curwin->w_cursor.lnum = eap->line2;
-+ check_cursor_col();
- do_put(eap->regname, eap->forceit ? BACKWARD : FORWARD, 1L,
- 						 PUT_LINE|PUT_CURSLINE);
- }
-diff --git a/src/testdir/test_put.vim b/src/testdir/test_put.vim
-index 225ebd1..f5037dc 100644
---- a/src/testdir/test_put.vim
-+++ b/src/testdir/test_put.vim
-@@ -113,3 +113,12 @@ func Test_put_p_indent_visual()
- call assert_equal('select that text', getline(2))
- bwipe!
- endfunc
-+
-+func Test_put_above_first_line()
-+ new
-+ let @" = 'text'
-+ silent! normal 0o00
-+ 0put
-+ call assert_equal('text', getline(1))
-+ bwipe!
-+endfunc
--- 
-1.8.3.1
-

_service:extract_file:backport-CVE-2021-3928.patch Deleted

@@ -1,48 +0,0 @@
-From 15d9890eee53afc61eb0a03b878a19cb5672f732 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 4 Nov 2021 15:46:05 +0000
-Subject: PATCH patch 8.2.3582: reading uninitialized memory when giving
- spell suggestions
-
-Problem: Reading uninitialized memory when giving spell suggestions.
-Solution: Check that preword is not empty.
----
- src/spellsuggest.c | 2 +-
- src/testdir/test_spell.vim | 8 ++++++++
- 2 files changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/src/spellsuggest.c b/src/spellsuggest.c
-index 9d6df79..8615d52 100644
---- a/src/spellsuggest.c
-+++ b/src/spellsuggest.c
-@@ -1600,7 +1600,7 @@ suggest_trie_walk(
- 		 // char, e.g., "thes," -> "these".
- 		 p = fword + sp->ts_fidx;
- 		 MB_PTR_BACK(fword, p);
--		 if (!spell_iswordp(p, curwin))
-+		 if (!spell_iswordp(p, curwin) && *preword != NUL)
- 		 {
- 			p = preword + STRLEN(preword);
- 			MB_PTR_BACK(preword, p);
-diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
-index 79fb892..e435e91 100644
---- a/src/testdir/test_spell.vim
-+++ b/src/testdir/test_spell.vim
-@@ -498,6 +498,14 @@ func Test_spell_screendump()
- call delete('XtestSpell')
- endfunc
- 
-+func Test_spell_single_word()
-+ new
-+ silent! norm 0R00
-+ spell! ßÂ
-+ silent 0norm 0r$ Dvz=
-+ bwipe!
-+endfunc
-+
- let g:test_data_aff1 = 
- \"SET ISO8859-1",
- \"TRY esianrtolcdugmphbyfvkwjkqxz-\xEB\xE9\xE8\xEA\xEF\xEE\xE4\xE0\xE2\xF6\xFC\xFB'ESIANRTOLCDUGMPHBYFVKWJKQXZ",
--- 
-1.8.3.1
-

_service:extract_file:backport-CVE-2021-3973.patch Deleted

@@ -1,79 +0,0 @@
-From 615ddd5342b50a6878a907062aa471740bd9a847 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Wed, 17 Nov 2021 18:00:31 +0000
-Subject: PATCH patch 8.2.3611: crash when using CTRL-W f without finding a
- file name
-
-Problem: Crash when using CTRL-W f without finding a file name.
-Solution: Bail out when the file name length is zero.
-
-Reference:https://github.com/vim/vim/commit/615ddd5342b50a6878a907062aa471740bd9a847
----
- src/findfile.c | 8 ++++++++
- src/normal.c | 6 ++++--
- src/testdir/test_visual.vim | 8 ++++++++
- 3 files changed, 20 insertions(+), 2 deletions(-)
-
-diff --git a/src/findfile.c b/src/findfile.c
-index ba996c4..7a4dfe5 100644
---- a/src/findfile.c
-+++ b/src/findfile.c
-@@ -1727,6 +1727,9 @@ find_file_in_path_option(
- proc->pr_WindowPtr = (APTR)-1L;
- # endif
- 
-+ if (len == 0)
-+	return NULL;
-+
- if (first == TRUE)
- {
- 	// copy file name into NameBuff, expanding environment variables
-@@ -2103,7 +2106,12 @@ find_file_name_in_path(
- int		c;
- # if defined(FEAT_FIND_ID) && defined(FEAT_EVAL)
- char_u	*tofree = NULL;
-+# endif
- 
-+ if (len == 0)
-+	return NULL;
-+
-+# if defined(FEAT_FIND_ID) && defined(FEAT_EVAL)
- if ((options & FNAME_INCL) && *curbuf->b_p_inex != NUL)
- {
- 	tofree = eval_includeexpr(ptr, len);
-diff --git a/src/normal.c b/src/normal.c
-index d6333b9..e9e587d 100644
---- a/src/normal.c
-+++ b/src/normal.c
-@@ -3778,8 +3778,10 @@ get_visual_text(
- 	 *pp = ml_get_pos(&VIsual);
- 	 *lenp = curwin->w_cursor.col - VIsual.col + 1;
- 	}
--	if (has_mbyte)
--	 // Correct the length to include the whole last character.
-+	if (**pp == NUL)
-+	 *lenp = 0;
-+	if (has_mbyte && *lenp > 0)
-+	 // Correct the length to include all bytes of the last character.
- 	 *lenp += (*mb_ptr2len)(*pp + (*lenp - 1)) - 1;
- }
- reset_VIsual_and_resel();
-diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
-index ae28123..0705fdb 100644
---- a/src/testdir/test_visual.vim
-+++ b/src/testdir/test_visual.vim
-@@ -894,4 +894,12 @@ func Test_block_insert_replace_tabs()
- bwipe!
- endfunc
- 
-+func Test_visual_block_ctrl_w_f()
-+ " Emtpy block selected in new buffer should not result in an error.
-+ au! BufNew foo sil norm &#x16;&#x17;f
-+ edit foo
-+
-+ au! BufNew
-+endfunc
-+
- " vim: shiftwidth=2 sts=2 expandtab
--- 
-2.23.0
\ No newline at end of file

_service:extract_file:backport-CVE-2021-3974.patch Deleted

@@ -1,67 +0,0 @@
-From 64066b9acd9f8cffdf4840f797748f938a13f2d6 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Wed, 17 Nov 2021 18:22:56 +0000
-Subject: PATCH patch 8.2.3612: using freed memory with regexp using a mark
-
-Problem: Using freed memory with regexp using a mark.
-Solution: Get the line again after getting the mark position.
-
-Reference:https://github.com/vim/vim/commit/64066b9acd9f8cffdf4840f797748f938a13f2d6
----
- src/regexp.c | 2 +-
- src/regexp_nfa.c | 8 ++++++++
- src/testdir/test_regexp_latin.vim | 8 ++++++++
- 3 files changed, 17 insertions(+), 1 deletion(-)
-
-diff --git a/src/regexp.c b/src/regexp.c
-index 112f753..2e94e5a 100644
---- a/src/regexp.c
-+++ b/src/regexp.c
-@@ -1092,7 +1092,7 @@ typedef struct {
- // The current match-position is stord in these variables:
- linenr_T	lnum;		// line number, relative to first line
- char_u	*line;		// start of current line
-- char_u	*input;		// current input, points into "regline"
-+ char_u	*input;		// current input, points into "line"
- 
- int	need_clear_subexpr;	// subexpressions still need to be cleared
- #ifdef FEAT_SYN_HL
-diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c
-index bc4a4b6..433523e 100644
---- a/src/regexp_nfa.c
-+++ b/src/regexp_nfa.c
-@@ -6623,8 +6623,16 @@ nfa_regmatch(
- 	 case NFA_MARK_GT:
- 	 case NFA_MARK_LT:
- 	 {
-+ size_t	col = rex.input - rex.line;
- 		pos_T	*pos = getmark_buf(rex.reg_buf, t->state->val, FALSE);
- 
-+		// Line may have been freed, get it again.
-+		if (REG_MULTI)
-+		{
-+		 rex.line = reg_getline(rex.lnum);
-+		 rex.input = rex.line + col;
-+		}
-+
- 		// Compare the mark position to the match position.
- 		result = (pos != NULL		 // mark doesn't exist
- 			&& pos->lnum > 0 // mark isn't set in reg_buf
-diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim
-index 7a4d98f..3168edc 100644
---- a/src/testdir/test_regexp_latin.vim
-+++ b/src/testdir/test_regexp_latin.vim
-@@ -141,3 +141,11 @@ func Test_pattern_compile_speed()
- call assert_inrange(0.01, 10.0, reltimefloat(reltime(start)))
- set spc=
- endfunc
-+
-+func Test_using_mark_position()
-+ " this was using freed memory
-+ new
-+ norm O0
-+ call assert_fails("s/\\%')", 'E486:')
-+ bwipe!
-+endfunc
--- 
-2.23.0
\ No newline at end of file

_service:extract_file:backport-CVE-2021-3984.patch Deleted

@@ -1,64 +0,0 @@
-From 2de9b7c7c8791da8853a9a7ca9c467867465b655 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Fri, 19 Nov 2021 19:41:13 +0000
-Subject: PATCH patch 8.2.3625: illegal memory access when C-indenting
-
-Problem: Illegal memory access when C-indenting.
-Solution: Also set the cursor column.
----
- src/cindent.c | 10 +++++-----
- src/testdir/test_cindent.vim | 12 ++++++++++++
- 2 files changed, 17 insertions(+), 5 deletions(-)
-
-diff --git a/src/cindent.c b/src/cindent.c
-index c7caed6..28d1558 100644
---- a/src/cindent.c
-+++ b/src/cindent.c
-@@ -1635,10 +1635,10 @@ get_baseclass_amount(int col)
- static pos_T *
- find_start_brace(void)	 // XXX
- {
-- pos_T	cursor_save;
-- pos_T	*trypos;
-- pos_T	*pos;
-- static pos_T	pos_copy;
-+ pos_T	 cursor_save;
-+ pos_T	 *trypos;
-+ pos_T	 *pos;
-+ static pos_T pos_copy;
- 
- cursor_save = curwin->w_cursor;
- while ((trypos = findmatchlimit(NULL, '{', FM_BLOCKSTOP, 0)) != NULL)
-@@ -1652,7 +1652,7 @@ find_start_brace(void)	 // XXX
- 		 && (pos = ind_find_start_CORS(NULL)) == NULL) // XXX
- 	 break;
- 	if (pos != NULL)
--	 curwin->w_cursor.lnum = pos->lnum;
-+	 curwin->w_cursor = *pos;
- }
- curwin->w_cursor = cursor_save;
- return trypos;
-diff --git a/src/testdir/test_cindent.vim b/src/testdir/test_cindent.vim
-index 2cb3f24..2a87460 100644
---- a/src/testdir/test_cindent.vim
-+++ b/src/testdir/test_cindent.vim
-@@ -5251,4 +5251,16 @@ func Test_cindent_56()
- enew! | close
- endfunc
- 
-+func Test_find_brace_backwards()
-+ " this was looking beyond the end of the line
-+ new
-+ norm R/*
-+ norm o0{
-+ norm o//
-+ norm V{=
-+ call assert_equal('/*', ' 0{', '//', getline(1, 3))
-+ bwipe!
-+endfunc
-+
-+
- " vim: shiftwidth=2 sts=2 expandtab
--- 
-1.8.3.1
-

_service:extract_file:backport-CVE-2021-4019.patch Deleted

@@ -1,45 +0,0 @@
-From bd228fd097b41a798f90944b5d1245eddd484142 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 25 Nov 2021 10:50:12 +0000
-Subject: PATCH patch 8.2.3669: buffer overflow with long help argument
-
-Problem: Buffer overflow with long help argument.
-Solution: Use snprintf().
----
- src/ex_cmds.c | 3 +--
- src/testdir/test_help.vim | 8 ++++++++
- 2 files changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/src/ex_cmds.c b/src/ex_cmds.c
-index 45c733b..8f6444f 100644
---- a/src/ex_cmds.c
-+++ b/src/ex_cmds.c
-@@ -5436,8 +5436,7 @@ find_help_tags(
- 		 || (vim_strchr((char_u *)"%_z@", arg1) != NULL
- 							 && arg2 != NUL)))
- 	{
--	 STRCPY(d, "/\\\\");
--	 STRCPY(d + 3, arg + 1);
-+ vim_snprintf((char *)d, IOSIZE, "/\\\\%s", arg + 1);
- 	 // Check for "/\\_$", should be "/\\_\$"
- 	 if (d3 == '_' && d4 == '$')
- 		STRCPY(d + 4, "\\$");
-diff --git a/src/testdir/test_help.vim b/src/testdir/test_help.vim
-index 5dd937a..c2aeb1f 100644
---- a/src/testdir/test_help.vim
-+++ b/src/testdir/test_help.vim
-@@ -55,3 +55,11 @@ func Test_help_local_additions()
- call delete('Xruntime', 'rf')
- let &rtp = rtp_save
- endfunc
-+
-+func Test_help_long_argument()
-+ try
-+ exe 'help \%' .. repeat('0', 1021)
-+ catch
-+ call assert_match("E149:", v:exception)
-+ endtry
-+endfunc
--- 
-1.8.3.1
-

_service:extract_file:backport-CVE-2021-4069.patch Deleted

@@ -1,56 +0,0 @@
-From e031fe90cf2e375ce861ff5e5e281e4ad229ebb9 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sun, 5 Dec 2021 12:06:24 +0000
-Subject: PATCH patch 8.2.3741: using freed memory in open command
-
-Problem: Using freed memory in open command.
-Solution: Make a copy of the current line.
-
-Reference:https://github.com/vim/vim/commit/e031fe90cf2e375ce861ff5e5e281e4ad229ebb9
-Conflict:src/testdir/test_ex_mode.vim, The current version does not exist and therefore does not fit into this test case
----
- src/ex_docmd.c | 10 +++++++---
- src/version.c | 2 ++
- 2 files changed, 9 insertions(+), 3 deletions(-)
-
-diff --git a/src/ex_docmd.c b/src/ex_docmd.c
-index 203174a..cb6b64a 100644
---- a/src/ex_docmd.c
-+++ b/src/ex_docmd.c
-@@ -6030,13 +6030,17 @@ ex_open(exarg_T *eap)
- 	regmatch.regprog = vim_regcomp(eap->arg, p_magic ? RE_MAGIC : 0);
- 	if (regmatch.regprog != NULL)
- 	{
-+	 // make a copy of the line, when searching for a mark it might be
-+	 // flushed
-+	 char_u *line = vim_strsave(ml_get_curline());
-+
- 	 regmatch.rm_ic = p_ic;
--	 p = ml_get_curline();
--	 if (vim_regexec(&regmatch, p, (colnr_T)0))
--		curwin->w_cursor.col = (colnr_T)(regmatch.startp0 - p);
-+	 if (vim_regexec(&regmatch, line, (colnr_T)0))
-+		curwin->w_cursor.col = (colnr_T)(regmatch.startp0 - line);
- 	 else
- 		emsg(_(e_nomatch));
- 	 vim_regfree(regmatch.regprog);
-+	 vim_free(line);
- 	}
- 	// Move to the NUL, ignore any other arguments.
- 	eap->arg += STRLEN(eap->arg);
-diff --git a/src/version.c b/src/version.c
-index 035c46f..bd45631 100644
---- a/src/version.c
-+++ b/src/version.c
-@@ -742,6 +742,8 @@ static char *(features) =
- 
- static int included_patches =
- { /* Add new patch number below this line */
-+/**/
-+ 3741,
- /**/
- 3403,
- /**/
--- 
-2.27.0
-

_service:extract_file:backport-CVE-2021-4166.patch Deleted

@@ -1,61 +0,0 @@
-From 6f98371532fcff911b462d51bc64f2ce8a6ae682 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Fri, 24 Dec 2021 18:11:27 +0000
-Subject: PATCH patch 8.2.3884: crash when clearing the argument list while
- using it
-Conflict:NA
-Reference:https://github.com/vim/vim/commit/6f98371532fcff911b462d51bc64f2ce8a6ae682
-
-Problem: Crash when clearing the argument list while using it.
-Solution: Lock the argument list for ":all".
----
- src/arglist.c | 3 +++
- src/testdir/test_arglist.vim | 7 +++++++
- 2 files changed, 10 insertions(+)
-
-diff --git a/src/arglist.c b/src/arglist.c
-index 21c38c1..cdd70ca 100644
---- a/src/arglist.c
-+++ b/src/arglist.c
-@@ -902,6 +902,7 @@ do_arg_all(
- tabpage_T	*old_curtab, *last_curtab;
- win_T	*new_curwin = NULL;
- tabpage_T	*new_curtab = NULL;
-+ int		prev_arglist_locked = arglist_locked;
- 
- if (ARGCOUNT <= 0)
- {
-@@ -921,6 +922,7 @@ do_arg_all(
- // watch out for its size to be changed.
- alist = curwin->w_alist;
- ++alist->al_refcount;
-+ arglist_locked = TRUE;
- 
- old_curwin = curwin;
- old_curtab = curtab;
-@@ -1132,6 +1134,7 @@ do_arg_all(
- 
- // Remove the "lock" on the argument list.
- alist_unlink(alist);
-+ arglist_locked = prev_arglist_locked;
- 
- --autocmd_no_enter;
- 
-diff --git a/src/testdir/test_arglist.vim b/src/testdir/test_arglist.vim
-index c486b18..1c94fe9 100644
---- a/src/testdir/test_arglist.vim
-+++ b/src/testdir/test_arglist.vim
-@@ -505,3 +505,10 @@ func Test_argdo()
- call assert_equal('Xa.c', 'Xb.c', 'Xc.c', l)
- bwipe Xa.c Xb.c Xc.c
- endfunc
-+
-+func Test_clear_arglist_in_all()
-+ n 0 00 000 0000 00000 000000
-+ au! * 0 n 0
-+ all
-+ au! *
-+endfunc
--- 
-2.27.0
-

_service:extract_file:backport-CVE-2021-4192.patch Deleted

@@ -1,65 +0,0 @@
-From 4c13e5e6763c6eb36a343a2b8235ea227202e952 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 30 Dec 2021 14:49:43 +0000
-Subject: PATCH patch 8.2.3949: using freed memory with /\%V
-Conflict:NA
-Reference:https://github.com/vim/vim/commit/4c13e5e6763c6eb36a343a2b8235ea227202e952
-
-Problem: Using freed memory with /\%V.
-Solution: Get the line again after getvvcol().
----
- src/regexp.c | 9 +++++++--
- src/testdir/test_regexp_latin.vim | 8 ++++++++
- 2 files changed, 15 insertions(+), 2 deletions(-)
-
-diff --git a/src/regexp.c b/src/regexp.c
-index 2e94e5a..6849cba 100644
---- a/src/regexp.c
-+++ b/src/regexp.c
-@@ -1276,9 +1276,9 @@ reg_match_visual(void)
- if (lnum < top.lnum || lnum > bot.lnum)
- 	return FALSE;
- 
-+ col = (colnr_T)(rex.input - rex.line);
- if (mode == 'v')
- {
--	col = (colnr_T)(rex.input - rex.line);
- 	if ((lnum == top.lnum && col < top.col)
- 		|| (lnum == bot.lnum && col >= bot.col + (*p_sel != 'e')))
- 	 return FALSE;
-@@ -1293,7 +1293,12 @@ reg_match_visual(void)
- 	 end = end2;
- 	if (top.col == MAXCOL || bot.col == MAXCOL)
- 	 end = MAXCOL;
--	cols = win_linetabsize(wp, rex.line, (colnr_T)(rex.input - rex.line));
-+
-+	// getvvcol() flushes rex.line, need to get it again
-+	rex.line = reg_getline(rex.lnum);
-+	rex.input = rex.line + col;
-+
-+	cols = win_linetabsize(wp, rex.line, col);
- 	if (cols < start || cols > end - (*p_sel == 'e'))
- 	 return FALSE;
- }
-diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim
-index 3168edc..044b678 100644
---- a/src/testdir/test_regexp_latin.vim
-+++ b/src/testdir/test_regexp_latin.vim
-@@ -39,6 +39,14 @@ func Test_recursive_substitute()
- bwipe!
- endfunc
- 
-+func Test_using_visual_position()
-+ " this was using freed memory
-+ new
-+ exe "norm 0o\<Esc>\<C-V>k\<C-X>o0"
-+ /\%V
-+ bwipe!
-+endfunc
-+
- func Test_nested_backrefs()
- " Check example in change.txt.
- new
--- 
-2.27.0
-

_service:extract_file:backport-CVE-2021-4193.patch Deleted

@@ -1,58 +0,0 @@
-From 94f3192b03ed27474db80b4d3a409e107140738b Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 30 Dec 2021 15:29:18 +0000
-Subject: PATCH patch 8.2.3950: going beyond the end of the line with /\%V
-Conflict:NA
-Reference:https://github.com/vim/vim/commit/94f3192b03ed27474db80b4d3a409e107140738b
-
-Problem: Going beyond the end of the line with /\%V.
-Solution: Check for valid column in getvcol().
-
----
- src/charset.c | 13 +++++++++----
- src/testdir/test_regexp_latin.vim | 8 ++++++++
- 2 files changed, 17 insertions(+), 4 deletions(-)
-
-diff --git a/src/charset.c b/src/charset.c
-index 7505fea..a768c17 100644
---- a/src/charset.c
-+++ b/src/charset.c
-@@ -1226,10 +1226,15 @@ getvcol(
- 	posptr = NULL; // continue until the NUL
- else
- {
--	// Special check for an empty line, which can happen on exit, when
--	// ml_get_buf() always returns an empty string.
--	if (*ptr == NUL)
--	 pos->col = 0;
-+	colnr_T i;
-+
-+	// In a few cases the position can be beyond the end of the line.
-+	for (i = 0; i < pos->col; ++i)
-+	 if (ptri == NUL)
-+	 {
-+		pos->col = i;
-+		break;
-+	 }
- 	posptr = ptr + pos->col;
- 	if (has_mbyte)
- 	 // always start on the first byte
-diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim
-index 3168edc..4f52bac 100644
---- a/src/testdir/test_regexp_latin.vim
-+++ b/src/testdir/test_regexp_latin.vim
-@@ -149,3 +149,11 @@ func Test_using_mark_position()
- call assert_fails("s/\\%')", 'E486:')
- bwipe!
- endfunc
-+
-+func Test_using_invalid_visual_position()
-+ " this was going beyond the end of the line
-+ new
-+ exe "norm 0o000\<Esc>0\<C-V>$s0"
-+ /\%V
-+ bwipe!
-+endfunc
--- 
-2.27.0
-

_service:extract_file:backport-CVE-2022-0213.patch Deleted

@@ -1,62 +0,0 @@
-From de05bb25733c3319e18dca44e9b59c6ee389eb26 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 13 Jan 2022 13:08:14 +0000
-Subject: PATCH patch 8.2.4074: going over the end of NameBuff
-
-Problem: Going over the end of NameBuff.
-Solution: Check length when appending a space.
-
----
- src/drawscreen.c | 9 +++++----
- src/testdir/test_edit.vim | 15 +++++++++++++++
- src/version.c | 2 ++
- 3 files changed, 22 insertions(+), 4 deletions(-)
-
-diff --git a/src/drawscreen.c b/src/drawscreen.c
-index 9acb705..7425ad4 100644
---- a/src/drawscreen.c
-+++ b/src/drawscreen.c
-@@ -437,12 +437,13 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED)
- 	p = NameBuff;
- 	len = (int)STRLEN(p);
- 
--	if (bt_help(wp->w_buffer)
-+	if ((bt_help(wp->w_buffer)
- #ifdef FEAT_QUICKFIX
--		|| wp->w_p_pvw
-+		 || wp->w_p_pvw
- #endif
--		|| bufIsChanged(wp->w_buffer)
--		|| wp->w_buffer->b_p_ro)
-+		 || bufIsChanged(wp->w_buffer)
-+		 || wp->w_buffer->b_p_ro)
-+		&& len < MAXPATHL - 1)
- 	 *(p + len++) = ' ';
- 	if (bt_help(wp->w_buffer))
- 	{
-diff --git a/src/testdir/test_edit.vim b/src/testdir/test_edit.vim
-index c3b1af5..48e6ff2 100644
---- a/src/testdir/test_edit.vim
-+++ b/src/testdir/test_edit.vim
-@@ -1532,3 +1532,18 @@ func Test_edit_put_CTRL_E()
- set encoding=utf-8
- endfunc
- 
-+" Weird long file name was going over the end of NameBuff
-+func Test_edit_overlong_file_name()
-+ CheckUnix
-+
-+ file 0000000000000000000000000000
-+ file %%%%%%%%%%%%%%%%%%%%%%%%%%
-+ file %%%%%%
-+ set readonly
-+ set ls=2
-+
-+ redraw!
-+ set noreadonly ls&
-+ bwipe!
-+endfunc
-+
--- 
-2.23.0
-

_service:extract_file:backport-CVE-2022-0261.patch Deleted

@@ -1,109 +0,0 @@
-From 9f8c304c8a390ade133bac29963dc8e56ab14cbc Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Mon, 17 Jan 2022 17:30:21 +0000
-Subject: PATCH patch 8.2.4120: block insert goes over the end of the line
-
-Problem: Block insert goes over the end of the line.
-Solution: Handle invalid byte better. Fix inserting the wrong text.
----
- src/ops.c | 40 ++++++++++++++++++++++++-------------
- src/testdir/test_visual.vim | 10 ++++++++++
- 2 files changed, 36 insertions(+), 14 deletions(-)
-
-diff --git a/src/ops.c b/src/ops.c
-index d3e1e47..13e6bdb 100644
---- a/src/ops.c
-+++ b/src/ops.c
-@@ -535,22 +535,27 @@ block_insert(
- 	 if (b_insert)
- 	 {
- 		off = (*mb_head_off)(oldp, oldp + offset + spaces);
-+		spaces -= off;
-+		count -= off;
- 	 }
- 	 else
- 	 {
--		off = (*mb_off_next)(oldp, oldp + offset);
--		offset += off;
-+		// spaces fill the gap, the character that's at the edge moves
-+		// right
-+		off = (*mb_head_off)(oldp, oldp + offset);
-+		offset -= off;
- 	 }
--	 spaces -= off;
--	 count -= off;
- 	}
- 
--	newp = alloc(STRLEN(oldp) + s_len + count + 1);
-+	// Make sure the allocated size matches what is actually copied below.
-+	newp = alloc(STRLEN(oldp) + spaces + s_len
-+		 + (spaces > 0 && !bdp->is_short ? ts_val - spaces : 0)
-+								 + count + 1);
- 	if (newp == NULL)
- 	 continue;
- 
- 	// copy up to shifted part
--	mch_memmove(newp, oldp, (size_t)(offset));
-+	mch_memmove(newp, oldp, (size_t)offset);
- 	oldp += offset;
- 
- 	// insert pre-padding
-@@ -560,14 +565,21 @@ block_insert(
- 	mch_memmove(newp + offset + spaces, s, (size_t)s_len);
- 	offset += s_len;
- 
--	if (spaces && !bdp->is_short)
-+	if (spaces > 0 && !bdp->is_short)
- 	{
--	 // insert post-padding
--	 vim_memset(newp + offset + spaces, ' ', (size_t)(ts_val - spaces));
--	 // We're splitting a TAB, don't copy it.
--	 oldp++;
--	 // We allowed for that TAB, remember this now
--	 count++;
-+	 if (*oldp == TAB)
-+	 {
-+		// insert post-padding
-+		vim_memset(newp + offset + spaces, ' ',
-+						 (size_t)(ts_val - spaces));
-+		// we're splitting a TAB, don't copy it
-+		oldp++;
-+		// We allowed for that TAB, remember this now
-+		count++;
-+	 }
-+	 else
-+		// Not a TAB, no extra spaces
-+		count = spaces;
- 	}
- 
- 	if (spaces > 0)
-@@ -1609,7 +1621,7 @@ op_insert(oparg_T *oap, long count1)
- 		oap->start_vcol = t;
- 	 }
- 	 else if (oap->op_type == OP_APPEND
--		 && oap->end.col + oap->end.coladd
-+			&& oap->start.col + oap->start.coladd
- 			>= curbuf->b_op_start_orig.col
- 					 + curbuf->b_op_start_orig.coladd)
- 	 {
-diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
-index 0705fdb..84a8981 100644
---- a/src/testdir/test_visual.vim
-+++ b/src/testdir/test_visual.vim
-@@ -903,3 +903,13 @@ func Test_visual_block_ctrl_w_f()
- endfunc
- 
- " vim: shiftwidth=2 sts=2 expandtab
-+
-+func Test_visual_block_append_invalid_char()
-+ " this was going over the end of the line
-+ new
-+ call setline(1, '	 let xxx', 'xxxxx', 'xxxxxxxxxxx')
-+ exe "normal 0\<C-V>jjA-\<Esc>"
-+ call assert_equal('	- let xxx', 'xxxxx -', 'xxxxxxxx-xxx', getline(1, 3))
-+ bwipe!
-+endfunc
-+
--- 
-2.27.0
-

_service:extract_file:backport-CVE-2022-0318.patch Deleted

@@ -1,63 +0,0 @@
-From 57df9e8a9f9ae1aafdde9b86b10ad907627a87dc Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 20 Jan 2022 12:10:48 +0000
-Subject: PATCH patch 8.2.4151: reading beyond the end of a line
-
-Problem: Reading beyond the end of a line.
-Solution: For block insert only use the offset for correcting the length.
----
- src/ops.c | 20 ++------------------
- src/testdir/test_visual.vim | 9 +++++++++
- 2 files changed, 11 insertions(+), 18 deletions(-)
-
-diff --git a/src/ops.c b/src/ops.c
-index 13e6bdb..2122ff3 100644
---- a/src/ops.c
-+++ b/src/ops.c
-@@ -528,24 +528,8 @@ block_insert(
- 	}
- 
- 	if (has_mbyte && spaces > 0)
--	{
--	 int off;
--
--	 // Avoid starting halfway a multi-byte character.
--	 if (b_insert)
--	 {
--		off = (*mb_head_off)(oldp, oldp + offset + spaces);
--		spaces -= off;
--		count -= off;
--	 }
--	 else
--	 {
--		// spaces fill the gap, the character that's at the edge moves
--		// right
--		off = (*mb_head_off)(oldp, oldp + offset);
--		offset -= off;
--	 }
--	}
-+	 // avoid copying part of a multi-byte character
-+	 offset -= (*mb_head_off)(oldp, oldp + offset);
- 
- 	// Make sure the allocated size matches what is actually copied below.
- 	newp = alloc(STRLEN(oldp) + spaces + s_len
-diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
-index 84a8981..3ed927a 100644
---- a/src/testdir/test_visual.vim
-+++ b/src/testdir/test_visual.vim
-@@ -913,3 +913,12 @@ func Test_visual_block_append_invalid_char()
- bwipe!
- endfunc
- 
-+func Test_visual_block_insert_round_off()
-+ new
-+ " The number of characters are tuned to fill a 4096 byte allocated block,
-+ " so that valgrind reports going over the end.
-+ call setline(1, 'xxxxx', repeat('0', 1350), "\t", repeat('x', 60))
-+ exe "normal gg0\<C-V>GI" .. repeat('0', 1320) .. "\<Esc>"
-+ bwipe!
-+endfunc
-+
--- 
-2.27.0
-

_service:extract_file:backport-CVE-2022-0319.patch Deleted

@@ -1,65 +0,0 @@
-From 05b27615481e72e3b338bb12990fb3e0c2ecc2a9 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 20 Jan 2022 13:32:50 +0000
-Subject: PATCH patch 8.2.4154: ml_get error when exchanging windows in
- Visual mode
-
-Problem: ml_get error when exchanging windows in Visual mode.
-Solution: Correct end of Visual area when entering another buffer
-
-Reference:https://github.com/vim/vim/commit/05b27615481e72e3b338bb12990fb3e0c2ecc2a9
-Conflict:NA
----
- src/testdir/test_visual.vim | 10 ++++++++++
- src/window.c | 7 ++++++-
- 2 files changed, 16 insertions(+), 1 deletion(-)
-
-diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
-index fcf6473..4f8f056 100644
---- a/src/testdir/test_visual.vim
-+++ b/src/testdir/test_visual.vim
-@@ -705,6 +705,16 @@ func Test_visual_undo_deletes_last_line()
- bwipe!
- endfunc
- 
-+" this was causing an ml_get error
-+func Test_visual_exchange_windows()
-+ enew!
-+ new
-+ call setline(1, 'foo', 'bar')
-+ exe "normal G\<C-V>gg\<C-W>\<C-X>OO\<Esc>"
-+ bwipe!
-+ bwipe!
-+endfunc
-+
- func Test_visual_mode_put()
- new
- 
-diff --git a/src/window.c b/src/window.c
-index 5b407d5..bb17167 100644
---- a/src/window.c
-+++ b/src/window.c
-@@ -1661,6 +1661,11 @@ win_exchange(long Prenum)
- 
- (void)win_comp_pos();		// recompute window positions
- 
-+ if (wp->w_buffer != curbuf)
-+	reset_VIsual_and_resel();
-+ else if (VIsual_active)
-+	wp->w_cursor = curwin->w_cursor;
-+
- win_enter(wp, TRUE);
- redraw_all_later(NOT_VALID);
- }
-@@ -5114,7 +5119,7 @@ frame_remove(frame_T *frp)
- win_alloc_lines(win_T *wp)
- {
- wp->w_lines_valid = 0;
-- wp->w_lines = ALLOC_CLEAR_MULT(wline_T, Rows );
-+ wp->w_lines = ALLOC_CLEAR_MULT(wline_T, Rows);
- if (wp->w_lines == NULL)
- 	return FAIL;
- return OK;
--- 
-2.27.0
-

_service:extract_file:backport-CVE-2022-0351.patch Deleted

@@ -1,78 +0,0 @@
-From: Bram Moolenaar <Bram@vim.org>
-Date: Mon, 24 Jan 2022 18:16:12 +0000
-Subject: PATCH patch 8.2.4206: condition with many "(" causes a crash
-
-Problem: Condition with many "(" causes a crash.
-Solution: Limit recursion to 1000.
----
- src/eval.c | 12 ++++++++++++
- src/globals.h | 2 ++
- src/testdir/test_eval_stuff.vim | 5 +++++
- 3 files changed, 19 insertions(+)
-
-diff --git a/src/eval.c b/src/eval.c
-index 3b563f7..95dda90 100644
---- a/src/eval.c
-+++ b/src/eval.c
-@@ -2495,6 +2495,7 @@ eval7(
- char_u	*start_leader, *end_leader;
- int		ret = OK;
- char_u	*alias;
-+ static	int recurse = 0;
- 
- /*
- * Initialise variable so that clear_tv() can't mistake this for a
-@@ -2521,6 +2522,15 @@ eval7(
- 	return FAIL;
- }
- 
-+ // Limit recursion to 1000 levels. At least at 10000 we run out of stack
-+ // and crash.
-+ if (recurse == 1000)
-+ {
-+	semsg(_(e_expression_too_recursive_str), *arg);
-+	return FAIL;
-+ }
-+ ++recurse;
-+
- switch (**arg)
- {
- /*
-@@ -2761,6 +2771,8 @@ eval7(
- */
- if (ret == OK && evaluate && end_leader > start_leader)
- 	ret = eval7_leader(rettv, start_leader, &end_leader);
-+
-+ --recurse;
- return ret;
- }
- 
-diff --git a/src/globals.h b/src/globals.h
-index 75092b7..659bad6 100644
---- a/src/globals.h
-+++ b/src/globals.h
-@@ -1464,6 +1464,8 @@ EXTERN char e_endwhile	INIT(= N_("E170: Missing :endwhile"));
- EXTERN char e_endfor	INIT(= N_("E170: Missing :endfor"));
- EXTERN char e_while		INIT(= N_("E588: :endwhile without :while"));
- EXTERN char e_for		INIT(= N_("E588: :endfor without :for"));
-+EXTERN char e_expression_too_recursive_str
-+ INIT(= N_("E1169: Expression too recursive: %s"));
- #endif
- EXTERN char e_exists	INIT(= N_("E13: File exists (add ! to override)"));
- EXTERN char e_failed	INIT(= N_("E472: Command failed"));
-diff --git a/src/testdir/test_eval_stuff.vim b/src/testdir/test_eval_stuff.vim
-index ec566da..32a5411 100644
---- a/src/testdir/test_eval_stuff.vim
-+++ b/src/testdir/test_eval_stuff.vim
-@@ -216,3 +216,8 @@ func Test_scriptversion_fail()
- call assert_fails('source Xversionscript', 'E999:')
- call delete('Xversionscript')
- endfunc
-+
-+func Test_deep_recursion()
-+ " this was running out of stack
-+ call assert_fails("exe 'if ' .. repeat('(', 1002)", 'E1169: Expression too recursive: ((')+endfunc
-+endfunc
--- 
-1.8.3.1
-

_service:extract_file:backport-CVE-2022-0359.patch Deleted

_service:extract_file:backport-CVE-2022-0361.patch Deleted

@@ -1,60 +0,0 @@
-From dc5490e2cbc8c16022a23b449b48c1bd0083f366 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 25 Jan 2022 13:52:53 +0000
-Subject: PATCH patch 8.2.4215: illegal memory access when copying lines in
- Visual mode
-
-Problem: Illegal memory access when copying lines in Visual mode.
-Solution: Adjust the Visual position after copying lines.
----
- src/ex_cmds.c | 2 ++
- src/testdir/test_visual.vim | 13 +++++++++++--
- 2 files changed, 13 insertions(+), 2 deletions(-)
-
-diff --git a/src/ex_cmds.c b/src/ex_cmds.c
-index fea6dfa..aa97b40 100644
---- a/src/ex_cmds.c
-+++ b/src/ex_cmds.c
-@@ -864,6 +864,8 @@ ex_copy(linenr_T line1, linenr_T line2, linenr_T n)
- }
- 
- appended_lines_mark(n, count);
-+ if (VIsual_active)
-+	check_pos(curbuf, &VIsual);
- 
- msgmore((long)count);
- }
-diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
-index 3ed927a..f82d75b 100644
---- a/src/testdir/test_visual.vim
-+++ b/src/testdir/test_visual.vim
-@@ -658,8 +658,6 @@ func Test_linewise_select_mode()
- call append('$', 'a', 'b', 'c')
- exe "normal GkkgH\<Del>"
- call assert_equal('', 'b', 'c', getline(1, '$'))
--
--
- " linewise select mode: delete middle two lines
- call deletebufline('', 1, '$')
- call append('$', 'a', 'b', 'c')
-@@ -681,6 +679,17 @@ func Test_linewise_select_mode()
- bwipe!
- endfunc
- 
-+" this was leaving the end of the Visual area beyond the end of a line
-+func Test_visual_ex_copy_line()
-+ new
-+ call setline(1, "aaa", "bbbbbbbbbxbb")
-+ /x
-+ exe "normal ggvjfxO"
-+ t0
-+ normal gNU
-+ bwipe!
-+endfunc
-+
- func Test_visual_mode_put()
- new
- 
--- 
-2.27.0
-

_service:extract_file:backport-CVE-2022-0368.patch Deleted

@@ -1,55 +0,0 @@
-From 8d02ce1ed75d008c34a5c9aaa51b67cbb9d33baa Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 25 Jan 2022 18:24:00 +0000
-Subject: PATCH patch 8.2.4217: illegal memory access when undo makes Visual
- area invalid
-
-Problem: Illegal memory access when undo makes Visual area invalid.
-Solution: Correct the Visual area after undo.
----
- src/testdir/test_visual.vim | 15 +++++++++++++++
- src/undo.c | 2 ++
- 2 files changed, 17 insertions(+)
-
-diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
-index f82d75b..fcf6473 100644
---- a/src/testdir/test_visual.vim
-+++ b/src/testdir/test_visual.vim
-@@ -690,6 +690,21 @@ func Test_visual_ex_copy_line()
- bwipe!
- endfunc
- 
-+" This was leaving the end of the Visual area beyond the end of a line.
-+" Set 'undolevels' to start a new undo block.
-+func Test_visual_undo_deletes_last_line()
-+ new
-+ call setline(1, "aaa", "ccc", "dyd")
-+ set undolevels=100
-+ exe "normal obbbbbbbbbxbb\<Esc>"
-+ set undolevels=100
-+ /y
-+ exe "normal ggvjfxO"
-+ undo
-+ normal gNU
-+ bwipe!
-+endfunc
-+
- func Test_visual_mode_put()
- new
- 
-diff --git a/src/undo.c b/src/undo.c
-index 54a6e1c..706dee9 100644
---- a/src/undo.c
-+++ b/src/undo.c
-@@ -2985,6 +2985,8 @@ u_undo_end(
- 	}
- }
- #endif
-+ if (VIsual_active)
-+	check_pos(curbuf, &VIsual);
- 
- smsg_attr_keep(0, _("%ld %s; %s #%ld %s"),
- 	 u_oldcount < 0 ? -u_oldcount : u_oldcount,
--- 
-2.27.0
-

_service:extract_file:backport-CVE-2022-0392.patch Deleted

@@ -1,50 +0,0 @@
-From 806d037671e133bd28a7864248763f643967973a Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 25 Jan 2022 20:45:16 +0000
-Subject: PATCH patch 8.2.4218: illegal memory access with bracketed paste in
- Ex mode
-
-Problem: Illegal memory access with bracketed paste in Ex mode.
-Solution: Reserve space for the trailing NUL.
-
----
- src/edit.c | 3 ++-
- src/testdir/test_paste.vim | 11 +++++++++++
- 2 files changed, 13 insertions(+), 1 deletion(-)
-
-diff --git a/src/edit.c b/src/edit.c
-index c67f67c..3767769 100644
---- a/src/edit.c
-+++ b/src/edit.c
-@@ -4984,7 +4984,8 @@ bracketed_paste(paste_mode_T mode, int drop, garray_T *gap)
- 		 break;
- 
- 		case PASTE_EX:
--		 if (gap != NULL && ga_grow(gap, idx) == OK)
-+	 // add one for the NUL that is going to be appended
-+		 if (gap != NULL && ga_grow(gap, idx + 1) == OK)
- 		 {
- 			mch_memmove((char *)gap->ga_data + gap->ga_len,
- 							 buf, (size_t)idx);
-diff --git a/src/testdir/test_paste.vim b/src/testdir/test_paste.vim
-index c30140f..263f084 100644
---- a/src/testdir/test_paste.vim
-+++ b/src/testdir/test_paste.vim
-@@ -134,3 +134,14 @@ func Test_xrestore()
- 
- bwipe!
- endfunc
-+
-+" bracketed paste in Ex-mode
-+func Test_paste_ex_mode()
-+ unlet! foo
-+ call feedkeys("Qlet foo=\"\<Esc>200~foo\<CR>bar\<Esc>201~\"\<CR>vi\<CR>", 'xt')
-+ call assert_equal("foo\rbar", foo)
-+
-+
-+ " pasting more than 40 bytes
-+ exe "norm Q\<PasteStart>0000000000000000000000000000000000000000000000000000000000000000000000\<C-C>"
-+endfunc
--- 
-2.27.0
-

_service:extract_file:backport-CVE-2022-0408.patch Deleted

@@ -1,92 +0,0 @@
-From 06f15416bb8d5636200a10776f1752c4d6e49f31 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sat, 29 Jan 2022 10:51:59 +0000
-Subject: PATCH patch 8.2.4247: stack corruption when looking for spell
- suggestions
-
-Problem: Stack corruption when looking for spell suggestions.
-Solution: Prevent the depth increased too much. Add a five second time
-limit to finding suggestions.
----
- src/spellsuggest.c | 17 +++++++++++++++--
- src/testdir/test_spell.vim | 8 ++++++++
- 2 files changed, 23 insertions(+), 2 deletions(-)
-
-diff --git a/src/spellsuggest.c b/src/spellsuggest.c
-index 8615d52..a73e695 100644
---- a/src/spellsuggest.c
-+++ b/src/spellsuggest.c
-@@ -1187,7 +1187,7 @@ suggest_try_change(suginfo_T *su)
- 
- // Check the maximum score, if we go over it we won't try this change.
- #define TRY_DEEPER(su, stack, depth, add) \
--		(stackdepth.ts_score + (add) < su->su_maxscore)
-+	 (depth < MAXWLEN && stackdepth.ts_score + (add) < su->su_maxscore)
- 
- /*
- * Try finding suggestions by adding/removing/swapping letters.
-@@ -1259,6 +1259,9 @@ suggest_trie_walk(
- char_u	changenameMAXWLEN80;
- #endif
- int		breakcheckcount = 1000;
-+#ifdef FEAT_RELTIME
-+ proftime_T	time_limit;
-+#endif
- int		compound_ok;
- 
- // Go through the whole case-fold tree, try changes at each node.
-@@ -1303,6 +1306,11 @@ suggest_trie_walk(
- 	 sp->ts_state = STATE_START;
- 	}
- }
-+#ifdef FEAT_RELTIME
-+ // The loop may take an indefinite amount of time. Break out after five
-+ // sectonds. TODO: add an option for the time limit.
-+ profile_setlimit(5000, &time_limit);
-+#endif
- 
- // Loop to find all suggestions. At each round we either:
- // - For the current state try one operation, advance "ts_curi",
-@@ -1337,7 +1345,8 @@ suggest_trie_walk(
- 
- 		// At end of a prefix or at start of prefixtree: check for
- 		// following word.
--		if (bytsarridx == 0 || n == (int)STATE_NOPREFIX)
-+		if (depth < MAXWLEN
-+			 && (bytsarridx == 0 || n == (int)STATE_NOPREFIX))
- 		{
- 		 // Set su->su_badflags to the caps type at this position.
- 		 // Use the caps type until here for the prefix itself.
-@@ -2630,6 +2639,10 @@ suggest_trie_walk(
- 	 {
- 		ui_breakcheck();
- 		breakcheckcount = 1000;
-+#ifdef FEAT_RELTIME
-+		if (profile_passed_limit(&time_limit))
-+		 got_int = TRUE;
-+#endif
- 	 }
- 	}
- }
-diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
-index e435e91..271d034 100644
---- a/src/testdir/test_spell.vim
-+++ b/src/testdir/test_spell.vim
-@@ -427,6 +427,14 @@ func Test_spell_long_word()
- set nospell
- endfunc
- 
-+func Test_spellsuggest_too_deep()
-+ " This was incrementing "depth" over MAXWLEN.
-+ new
-+ norm &#x16;s000G00ý000000000000
-+ sil norm ..vzG................vvzG0 v z=
-+ bwipe!
-+endfunc
-+
- func LoadAffAndDic(aff_contents, dic_contents)
- set enc=latin1
- set spellfile=
--- 
-1.8.3.1
-

_service:extract_file:backport-CVE-2022-0413.patch Deleted

@@ -1,85 +0,0 @@
-From 37f47958b8a2a44abc60614271d9537e7f14e51a Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sat, 29 Jan 2022 14:21:51 +0000
-Subject: PATCH patch 8.2.4253: using freed memory when substitute with
- function call
-
-Problem: Using freed memory when substitute uses a recursive function call.
-Solution: Make a copy of the substitute text.
----
- src/ex_cmds.c | 19 +++++++++++++++----
- src/testdir/test_substitute.vim | 16 ++++++++++++++++
- 2 files changed, 31 insertions(+), 4 deletions(-)
-
-diff --git a/src/ex_cmds.c b/src/ex_cmds.c
-index cccdf47..aa97b40 100644
---- a/src/ex_cmds.c
-+++ b/src/ex_cmds.c
-@@ -3577,6 +3577,7 @@ do_sub(exarg_T *eap)
- int		save_do_all;		// remember user specified 'g' flag
- int		save_do_ask;		// remember user specified 'c' flag
- char_u	*pat = NULL, *sub = NULL;	// init for GCC
-+ char_u	*sub_copy = NULL;
- int		delimiter;
- int		sublen;
- int		got_quit = FALSE;
-@@ -3866,11 +3867,20 @@ do_sub(exarg_T *eap)
- sub_firstline = NULL;
- 
- /*
-- * ~ in the substitute pattern is replaced with the old pattern.
-- * We do it here once to avoid it to be replaced over and over again.
-- * But don't do it when it starts with "\=", then it's an expression.
-+ * If the substitute pattern starts with "\=" then it's an expression.
-+ * Make a copy, a recursive function may free it.
-+ * Otherwise, '~' in the substitute pattern is replaced with the old
-+ * pattern. We do it here once to avoid it to be replaced over and over
-+ * again.
- */
-- if (!(sub0 == '\\' && sub1 == '='))
-+ if (sub0 == '\\' && sub1 == '=')
-+ {
-+ sub = vim_strsave(sub);
-+ if (sub == NULL)
-+ return;
-+ sub_copy = sub;
-+ }
-+ else
- 	sub = regtilde(sub, p_magic);
- 
- /*
-@@ -4670,6 +4680,7 @@ outofmem:
- #endif
- 
- vim_regfree(regmatch.regprog);
-+ vim_free(sub_copy);
- 
- // Restore the flag values, they can be used for ":&&".
- subflags.do_all = save_do_all;
-diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
-index c7532fb..3e6bc5c 100644
---- a/src/testdir/test_substitute.vim
-+++ b/src/testdir/test_substitute.vim
-@@ -745,3 +745,19 @@ func Test_sub_beyond_end()
- call assert_equal('#', getline(1))
- bwipe!
- endfunc
-+
-+" This was using "old_sub" after it was freed.
-+func Test_using_old_sub()
-+ set compatible maxfuncdepth=10
-+ new
-+ call setline(1, 'some text.')
-+ func Repl()
-+ ~
-+ s/
-+ endfunc
-+ silent! s/\%')/\=Repl()
-+
-+ delfunc Repl
-+ bwipe!
-+ set nocompatible
-+endfunc
--- 
-1.8.3.1
-

_service:extract_file:backport-CVE-2022-0417.patch Deleted

@@ -1,117 +0,0 @@
-From 652dee448618589de5528a9e9a36995803f5557a Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Fri, 28 Jan 2022 20:47:49 +0000
-Subject: PATCH patch 8.2.4245: ":retab 0" may cause illegal memory access
-
-Problem: ":retab 0" may cause illegal memory access.
-Solution: Limit the value of 'tabstop' to 10000.
-
----
- src/indent.c | 4 ++--
- src/option.c | 16 +++++++++-------
- src/testdir/test_options.vim | 2 ++
- src/vim.h | 2 ++
- 4 files changed, 15 insertions(+), 9 deletions(-)
-
-diff --git a/src/indent.c b/src/indent.c
-index 7d04373..e8e93b9 100644
---- a/src/indent.c
-+++ b/src/indent.c
-@@ -71,7 +71,7 @@ tabstop_set(char_u *var, int **array)
- 	int n = atoi((char *)cp);
- 
- 	// Catch negative values, overflow and ridiculous big values.
--	if (n < 0 || n > 9999)
-+	if (n < 0 || n > TABSTOP_MAX)
- 	{
- 	 semsg(_(e_invarg2), cp);
- 	 vim_free(*array);
-@@ -1590,7 +1590,7 @@ ex_retab(exarg_T *eap)
- 	emsg(_(e_positive));
- 	return;
- }
-- if (new_ts < 0 || new_ts > 9999)
-+ if (new_ts < 0 || new_ts > TABSTOP_MAX)
- {
- 	semsg(_(e_invarg2), eap->arg);
- 	return;
-diff --git a/src/option.c b/src/option.c
-index e9598d6..382b01b 100644
---- a/src/option.c
-+++ b/src/option.c
-@@ -3557,6 +3557,11 @@ set_num_option(
- 	errmsg = e_positive;
- 	curbuf->b_p_ts = 8;
- }
-+ else if (curbuf->b_p_ts > TABSTOP_MAX)
-+ {
-+	errmsg = e_invalid_argument;
-+	curbuf->b_p_ts = 8;
-+ }
- if (p_tm < 0)
- {
- 	errmsg = e_positive;
-@@ -5758,7 +5763,7 @@ buf_copy_options(buf_T *buf, int flags)
- 	 if (p_vsts && p_vsts != empty_option)
- 		(void)tabstop_set(p_vsts, &buf->b_p_vsts_array);
- 	 else
--		buf->b_p_vsts_array = 0;
-+		buf->b_p_vsts_array = NULL;
- 	 buf->b_p_vsts_nopaste = p_vsts_nopaste
- 				 ? vim_strsave(p_vsts_nopaste) : NULL;
- #endif
-@@ -6583,9 +6588,7 @@ paste_option_changed(void)
- 	 if (buf->b_p_vsts)
- 		free_string_option(buf->b_p_vsts);
- 	 buf->b_p_vsts = empty_option;
--	 if (buf->b_p_vsts_array)
--		vim_free(buf->b_p_vsts_array);
--	 buf->b_p_vsts_array = 0;
-+	 VIM_CLEAR(buf->b_p_vsts_array);
- #endif
- 	}
- 
-@@ -6631,12 +6634,11 @@ paste_option_changed(void)
- 		free_string_option(buf->b_p_vsts);
- 	 buf->b_p_vsts = buf->b_p_vsts_nopaste
- 			 ? vim_strsave(buf->b_p_vsts_nopaste) : empty_option;
--	 if (buf->b_p_vsts_array)
--		vim_free(buf->b_p_vsts_array);
-+	 vim_free(buf->b_p_vsts_array);
- 	 if (buf->b_p_vsts && buf->b_p_vsts != empty_option)
- 		(void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
- 	 else
--		buf->b_p_vsts_array = 0;
-+		buf->b_p_vsts_array = NULL;
- #endif
- 	}
- 
-diff --git a/src/testdir/test_options.vim b/src/testdir/test_options.vim
-index 65600ee..d4213c1 100644
---- a/src/testdir/test_options.vim
-+++ b/src/testdir/test_options.vim
-@@ -263,6 +263,8 @@ func Test_set_errors()
- call assert_fails('set shiftwidth=-1', 'E487:')
- call assert_fails('set sidescroll=-1', 'E487:')
- call assert_fails('set tabstop=-1', 'E487:')
-+ call assert_fails('set tabstop=10000', 'E474:')
-+ call assert_fails('set tabstop=5500000000', 'E474:')
- call assert_fails('set textwidth=-1', 'E487:')
- call assert_fails('set timeoutlen=-1', 'E487:')
- call assert_fails('set updatecount=-1', 'E487:')
-diff --git a/src/vim.h b/src/vim.h
-index 68e2de1..cd917a3 100644
---- a/src/vim.h
-+++ b/src/vim.h
-@@ -2031,6 +2031,8 @@ typedef int sock_T;
- 
- #define DICT_MAXNEST 100	// maximum nesting of lists and dicts
- 
-+#define TABSTOP_MAX 9999
-+
- #ifdef FEAT_CLIPBOARD
- 
- // VIM_ATOM_NAME is the older Vim-specific selection type for X11. Still
--- 
-2.27.0
-

_service:extract_file:backport-CVE-2022-0443.patch Deleted

@@ -1,91 +0,0 @@
-From 9b4a80a66544f2782040b641498754bcb5b8d461 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 1 Feb 2022 13:54:17 +0000
-Subject: PATCH patch 8.2.4281: using freed memory with :lopen and :bwipe
-
-Problem: Using freed memory with :lopen and :bwipe.
-Solution: Do not use a wiped out buffer.
----
- src/buffer.c | 14 ++++++++++----
- src/testdir/test_quickfix.vim | 16 ++++++++++++++++
- 2 files changed, 26 insertions(+), 4 deletions(-)
-
-diff --git a/src/buffer.c b/src/buffer.c
-index b4992dd..0f4957d 100644
---- a/src/buffer.c
-+++ b/src/buffer.c
-@@ -1666,6 +1666,7 @@ set_curbuf(buf_T *buf, int action)
- #endif
- bufref_T	newbufref;
- bufref_T	prevbufref;
-+ int		valid;
- 
- setpcmark();
- if (!cmdmod.keepalt)
-@@ -1717,13 +1718,19 @@ set_curbuf(buf_T *buf, int action)
- // An autocommand may have deleted "buf", already entered it (e.g., when
- // it did ":bunload") or aborted the script processing.
- // If curwin->w_buffer is null, enter_buffer() will make it valid again
-- if ((buf_valid(buf) && buf != curbuf
-+ valid = buf_valid(buf);
-+ if ((valid && buf != curbuf
- #ifdef FEAT_EVAL
- 		&& !aborting()
- #endif
- 	) || curwin->w_buffer == NULL)
- {
--	enter_buffer(buf);
-+	// If the buffer is not valid but curwin->w_buffer is NULL we must
-+	// enter some buffer. Using the last one is hopefully OK.
-+	if (!valid)
-+	 enter_buffer(lastbuf);
-+	else
-+	 enter_buffer(buf);
- #ifdef FEAT_SYN_HL
- 	if (old_tw != curbuf->b_p_tw)
- 	 check_colorcolumn(curwin);
-@@ -2236,8 +2243,7 @@ free_buf_options(
- clear_string_option(&buf->b_p_vsts);
- vim_free(buf->b_p_vsts_nopaste);
- buf->b_p_vsts_nopaste = NULL;
-- vim_free(buf->b_p_vsts_array);
-- buf->b_p_vsts_array = NULL;
-+ VIM_CLEAR(buf->b_p_vsts_array);
- clear_string_option(&buf->b_p_vts);
- VIM_CLEAR(buf->b_p_vts_array);
- #endif
-diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
-index f7c73f4..38a5236 100644
---- a/src/testdir/test_quickfix.vim
-+++ b/src/testdir/test_quickfix.vim
-@@ -876,6 +876,7 @@ func Test_locationlist_curwin_was_closed()
- call assert_fails('lrewind', 'E924:')
- 
- augroup! testgroup
-+ delfunc R
- endfunc
- 
- func Test_locationlist_cross_tab_jump()
-@@ -4674,4 +4675,19 @@ func Test_search_in_dirstack()
- call delete('Xtestdir', 'rf')
- endfunc
- 
-+" Weird sequence of commands that caused entering a wiped-out buffer
-+func Test_lopen_bwipe()
-+ func R()
-+ silent! tab lopen
-+ e x
-+ silent! lfile
-+ endfunc
-+
-+ cal R()
-+ cal R()
-+ cal R()
-+ bw!
-+ delfunc R
-+endfunc
-+
- " vim: shiftwidth=2 sts=2 expandtab
--- 
-2.27.0
-

_service:extract_file:backport-CVE-2022-0554.patch Deleted

@@ -1,113 +0,0 @@
-From e3537aec2f8d6470010547af28dcbd83d41461b8 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 8 Feb 2022 15:05:20 +0000
-Subject: PATCH patch 8.2.4327: may end up with no current buffer
-
-Problem: May end up with no current buffer.
-Solution: When deleting the current buffer to not pick a quickfix buffer as
- the new current buffer
-
-Reference:https://github.com/vim/vim/commit/e3537aec2f8d6470010547af28dcbd83d41461b8
-Conflict:NA
----
- src/buffer.c | 26 ++++++++++++++++++++++----
- src/testdir/test_quickfix.vim | 25 +++++++++++++++++++++++++
- 2 files changed, 47 insertions(+), 4 deletions(-)
-
-diff --git a/src/buffer.c b/src/buffer.c
-index e5f6a9b..3617c63 100644
---- a/src/buffer.c
-+++ b/src/buffer.c
-@@ -1520,8 +1520,14 @@ do_buffer(
- 		buf = buflist_findnr(curwin->w_jumplistjumpidx.fmark.fnum);
- 		if (buf != NULL)
- 		{
--		 if (buf == curbuf || !buf->b_p_bl)
--			buf = NULL;	// skip current and unlisted bufs
-+		 // Skip current and unlisted bufs. Also skip a quickfix
-+		 // buffer, it might be deleted soon.
-+		 if (buf == curbuf || !buf->b_p_bl
-+#if defined(FEAT_QUICKFIX)
-+			 || bt_quickfix(buf)
-+#endif
-+			 )
-+			buf = NULL;
- 		 else if (buf->b_ml.ml_mfp == NULL)
- 		 {
- 			// skip unloaded buf, but may keep it for later
-@@ -1558,7 +1564,11 @@ do_buffer(
- 		 continue;
- 		}
- 		// in non-help buffer, try to skip help buffers, and vv
--		if (buf->b_help == curbuf->b_help && buf->b_p_bl)
-+		if (buf->b_help == curbuf->b_help && buf->b_p_bl
-+#if defined(FEAT_QUICKFIX)
-+			 && !bt_quickfix(buf)
-+#endif
-+			 )
- 		{
- 		 if (buf->b_ml.ml_mfp != NULL) // found loaded buffer
- 			break;
-@@ -1576,7 +1586,11 @@ do_buffer(
- 	if (buf == NULL)	// No loaded buffer, find listed one
- 	{
- 	 FOR_ALL_BUFFERS(buf)
--		if (buf->b_p_bl && buf != curbuf)
-+		if (buf->b_p_bl && buf != curbuf
-+#if defined(FEAT_QUICKFIX)
-+			 && !bt_quickfix(buf)
-+#endif
-+		 )
- 		 break;
- 	}
- 	if (buf == NULL)	// Still no buffer, just take one
-@@ -1585,6 +1599,10 @@ do_buffer(
- 		buf = curbuf->b_next;
- 	 else
- 		buf = curbuf->b_prev;
-+#if defined(FEAT_QUICKFIX)
-+	 if (bt_quickfix(buf))
-+		buf = NULL;
-+#endif
- 	}
- }
- 
-diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
-index 38a5236..72f3172 100644
---- a/src/testdir/test_quickfix.vim
-+++ b/src/testdir/test_quickfix.vim
-@@ -325,6 +325,31 @@ func Test_copenHeight_tabline()
- set tabline& showtabline&
- endfunc
- 
-+" Another sequence of commands that caused all buffers to be wiped out
-+func Test_lopen_bwipe_all()
-+ let lines =<< trim END
-+ func R()
-+ silent! tab lopen
-+ e foo
-+ silent! lfile
-+ endfunc
-+ cal R()
-+ exe "norm \<C-W>\<C-V>0"
-+ cal R()
-+ bwipe
-+
-+ call writefile('done', 'Xresult')
-+ qall!
-+ END
-+ call writefile(lines, 'Xscript')
-+ if RunVim(, , '-u NONE -n -X -Z -e -m -s -S Xscript')
-+ call assert_equal('done', readfile('Xresult'))
-+ endif
-+
-+ call delete('Xscript')
-+ call delete('Xresult')
-+endfunc
-+
- 
- " Tests for the :cfile, :lfile, :caddfile, :laddfile, :cgetfile and :lgetfile
- " commands.
--- 
-2.27.0
-

_service:extract_file:backport-CVE-2022-0572.patch Deleted

@@ -1,66 +0,0 @@
-From 6e28703a8e41f775f64e442c5d11ce1ff599aa3f Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sat, 12 Feb 2022 15:42:18 +0000
-Subject: PATCH patch 8.2.4359: crash when repeatedly using :retab
-
-Problem: crash when repeatedly using :retab.
-Solution: Bail out when the line is getting too long.
----
- src/indent.c | 5 +++++
- src/testdir/test_retab.vim | 20 ++++++++++++++++++++
- 2 files changed, 25 insertions(+)
-
-diff --git a/src/indent.c b/src/indent.c
-index e8e93b9..075802c 100644
---- a/src/indent.c
-+++ b/src/indent.c
-@@ -1689,6 +1689,11 @@ ex_retab(exarg_T *eap)
- 	 if (ptrcol == NUL)
- 		break;
- 	 vcol += chartabsize(ptr + col, (colnr_T)vcol);
-+	 if (vcol >= MAXCOL)
-+	 {
-+		emsg(_(e_resulting_text_too_long));
-+		break;
-+	 }
- 	 if (has_mbyte)
- 		col += (*mb_ptr2len)(ptr + col);
- 	 else
-diff --git a/src/testdir/test_retab.vim b/src/testdir/test_retab.vim
-index e7b8946..5376f92 100644
---- a/src/testdir/test_retab.vim
-+++ b/src/testdir/test_retab.vim
-@@ -69,6 +69,8 @@ func Test_retab()
- call assert_equal(" a b c ", Retab('!', 3))
- call assert_equal(" a b c ", Retab('', 5))
- call assert_equal(" a b c ", Retab('!', 5))
-+
-+ set tabstop& expandtab&
- endfunc
- 
- func Test_retab_error()
-@@ -78,3 +80,21 @@ func Test_retab_error()
- call assert_fails('ret 10000', 'E475:')
- call assert_fails('ret 80000000000000000000', 'E475:')
- endfunc
-+
-+func Test_retab_endless()
-+ new
-+ call setline(1, "\t0\t")
-+ let caught = 'no'
-+ try
-+ while 1
-+ set ts=4000
-+ retab 4
-+ endwhile
-+ catch /E1240/
-+ let caught = 'yes'
-+ endtry
-+ bwipe!
-+ set tabstop&
-+endfunc
-+
-+" vim: shiftwidth=2 sts=2 expandtab
--- 
-2.27.0
-

_service:extract_file:backport-CVE-2022-0629.patch Deleted

@@ -1,48 +0,0 @@
-From 34f8117dec685ace52cd9e578e2729db278163fc Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Wed, 16 Feb 2022 12:16:19 +0000
-Subject: PATCH patch 8.2.4397: crash when using many composing characters in
- error message
-
-Problem: Crash when using many composing characters in error message.
-Solution: Use mb_cptr2char_adv() instead of mb_ptr2char_adv().
----
- src/testdir/test_assert.vim | 8 ++++++++
- src/testing.c | 2 +-
- 2 files changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/src/testdir/test_assert.vim b/src/testdir/test_assert.vim
-index 1b1f9e5..1e7d66f 100644
---- a/src/testdir/test_assert.vim
-+++ b/src/testdir/test_assert.vim
-@@ -45,6 +45,14 @@ func Test_assert_equal()
- call assert_equal('XxxxxxxxxxxxxxxxxxxxxxX', 'XyyyyyyyyyyyyyyyyyyyyyyyyyX')
- call assert_match("Expected 'X\\\\\\x occurs 21 timesX' but got 'X\\\\\\y occurs 25 timesX'", v:errors0)
- call remove(v:errors, 0)
-+
-+ " many composing characters are handled properly
-+ call setline(1, ' ')
-+ norm 100gr݀
-+ call assert_equal(1, getline(1))
-+ call assert_match("Expected 1 but got '.* occurs 100 times'", v:errors0)
-+ call remove(v:errors, 0)
-+ bwipe!
- endfunc
- 
- func Test_assert_equalfile()
-diff --git a/src/testing.c b/src/testing.c
-index f879f1e..f19481f 100644
---- a/src/testing.c
-+++ b/src/testing.c
-@@ -99,7 +99,7 @@ ga_concat_shorten_esc(garray_T *gap, char_u *str)
- {
- 	same_len = 1;
- 	s = p;
--	c = mb_ptr2char_adv(&s);
-+	c = mb_cptr2char_adv(&s);
- 	clen = s - p;
- 	while (*s != NUL && c == mb_ptr2char(s))
- 	{
--- 
-2.27.0
-

_service:extract_file:backport-CVE-2022-0685.patch Deleted

@@ -1,85 +0,0 @@
-From 5921aeb5741fc6e84c870d68c7c35b93ad0c9f87 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sat, 19 Feb 2022 11:20:12 +0000
-Subject: PATCH patch 8.2.4418: crash when using special multi-byte character
-
-Problem: Crash when using special multi-byte character.
-Solution: Don't use isalpha() for an arbitrary character.
-
-Conflict:
-upstream patches:
-+ call assert_fails('tc űŤŤŤ¦*', 'E344:')
-openEuler patches:
-+ call assert_fails('tc űŤŤŤ¦*', 'E472:')
----
- src/charset.c | 6 ++++++
- src/filepath.c | 2 +-
- src/proto/charset.pro | 2 +-
- src/testdir/test_autochdir.vim | 7 +++++++
- 4 files changed, 15 insertions(+), 2 deletions(-)
-
-diff --git a/src/charset.c b/src/charset.c
-index a768c17..847a01a 100644
---- a/src/charset.c
-+++ b/src/charset.c
-@@ -1654,6 +1654,12 @@ vim_isupper(int c)
- return isupper(c);
- }
- 
-+ int
-+vim_isalpha(int c)
-+{
-+ return vim_islower(c) || vim_isupper(c);
-+}
-+
- int
- vim_toupper(int c)
- {
-diff --git a/src/filepath.c b/src/filepath.c
-index 01d2dcb..c7f0265 100644
---- a/src/filepath.c
-+++ b/src/filepath.c
-@@ -3300,7 +3300,7 @@ unix_expandpath(
- 	else if (path_end >= path + wildoff
- 			 && (vim_strchr((char_u *)"*?{~$", *path_end) != NULL
- 			 || (!p_fic && (flags & EW_ICASE)
--					 && isalpha(PTR2CHAR(path_end)))))
-+					 && vim_isalpha(PTR2CHAR(path_end)))))
- 	 e = p;
- 	if (has_mbyte)
- 	{
-diff --git a/src/proto/charset.pro b/src/proto/charset.pro
-index c582a8c..2a928e3 100644
---- a/src/proto/charset.pro
-+++ b/src/proto/charset.pro
-@@ -47,6 +47,7 @@ int vim_isxdigit(int c);
- int vim_isbdigit(int c);
- int vim_islower(int c);
- int vim_isupper(int c);
-+int vim_isalpha(int c);
- int vim_toupper(int c);
- int vim_tolower(int c);
- char_u *skiptowhite(char_u *p);
-@@ -59,5 +60,4 @@ int hexhex2nr(char_u *p);
- int rem_backslash(char_u *str);
- void backslash_halve(char_u *p);
- char_u *backslash_halve_save(char_u *p);
--void ebcdic2ascii(char_u *buffer, int len);
- /* vim: set ft=c : */
-diff --git a/src/testdir/test_autochdir.vim b/src/testdir/test_autochdir.vim
-index 1473854..99fc9ae 100644
---- a/src/testdir/test_autochdir.vim
-+++ b/src/testdir/test_autochdir.vim
-@@ -24,3 +24,10 @@ func Test_set_filename()
- call chdir(cwd)
- call delete('samples/Xtest')
- endfunc
-+
-+func Test_multibyte()
-+ " using an invalid character should not cause a crash
-+ set wic
-+ call assert_fails('tc űŤŤŤ¦*', 'E472:')
-+ set nowic
-+endfunc
--- 
-2.27.0

_service:extract_file:backport-CVE-2022-0714.patch Deleted

@@ -1,51 +0,0 @@
-From 4e889f98e95ac05d7c8bd3ee933ab4d47820fdfa Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Mon, 21 Feb 2022 19:36:12 +0000
-Subject: PATCH patch 8.2.4436: crash with weird 'vartabstop' value
-
-Problem: Crash with weird 'vartabstop' value.
-Solution: Check for running into the end of the line.
-
----
- src/indent.c | 2 ++
- src/testdir/test_vartabs.vim | 14 ++++++++++++++
- 2 files changed, 16 insertions(+)
-
-diff --git a/src/indent.c b/src/indent.c
-index 075802c..6b8900f 100644
---- a/src/indent.c
-+++ b/src/indent.c
-@@ -1279,6 +1279,8 @@ change_indent(
- 		new_cursor_col += (*mb_ptr2len)(ptr + new_cursor_col);
- 	 else
- 		++new_cursor_col;
-+	 if (ptrnew_cursor_col == NUL)
-+		break;
- 	 vcol += lbr_chartabsize(ptr, ptr + new_cursor_col, (colnr_T)vcol);
- 	}
- 	vcol = last_vcol;
-diff --git a/src/testdir/test_vartabs.vim b/src/testdir/test_vartabs.vim
-index 47844fb..c2919d8 100644
---- a/src/testdir/test_vartabs.vim
-+++ b/src/testdir/test_vartabs.vim
-@@ -378,3 +378,17 @@ func Test_vartabs_reset()
- set all&
- call assert_equal('', &vts)
- endfunc
-+
-+func Test_vartabstop_latin1()
-+ let save_encoding = &encoding
-+ new
-+ set encoding=iso8859
-+ silent norm :se &#x1;&#x1b;
-+ set vartabstop=400
-+ norm i00	&#x4;
-+ bwipe!
-+ let &encoding = save_encoding
-+endfunc
-+
-+
-+" vim: shiftwidth=2 sts=2 expandtab
--- 
-2.27.0
-

_service:extract_file:backport-CVE-2022-0729.patch Deleted

@@ -1,47 +0,0 @@
-From 6456fae9ba8e72c74b2c0c499eaf09974604ff30 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 22 Feb 2022 13:37:31 +0000
-Subject: PATCH patch 8.2.4440: crash with specific regexp pattern and string
-
-Problem: Crash with specific regexp pattern and string.
-Solution: Stop at the start of the string.
-
----
- src/regexp_bt.c | 5 +++++
- src/testdir/test_regexp_utf8.vim | 7 +++++++
- 2 files changed, 12 insertions(+)
-
-diff --git a/src/regexp_bt.c b/src/regexp_bt.c
-index b71b862..e017ba5 100644
---- a/src/regexp_bt.c
-+++ b/src/regexp_bt.c
-@@ -4431,6 +4431,11 @@ regmatch(
- 			 if (rex.input == rex.line)
- 			 {
- 				// backup to last char of previous line
-+				if (rex.lnum == 0)
-+				{
-+				 status = RA_NOMATCH;
-+				 break;
-+				}
- 				--rex.lnum;
- 				rex.line = reg_getline(rex.lnum);
- 				// Just in case regrepeat() didn't count
-diff --git a/src/testdir/test_regexp_utf8.vim b/src/testdir/test_regexp_utf8.vim
-index 6d0ce59..5d1bd47 100644
---- a/src/testdir/test_regexp_utf8.vim
-+++ b/src/testdir/test_regexp_utf8.vim
-@@ -223,3 +223,10 @@ func Test_match_invalid_byte()
- call delete('Xinvalid')
- endfunc
- 
-+func Test_match_too_complicated()
-+ set regexpengine=1
-+ exe "vsplit \xeb\xdb\x99"
-+ silent! buf \&\zs*\zs*0
-+ bwipe!
-+ set regexpengine=0
-+endfunc
--- 
-2.27.0
-

_service:extract_file:backport-CVE-2022-0943.patch Deleted

@@ -1,57 +0,0 @@
-From 5c68617d395f9d7b824f68475b24ce3e38d653a3 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sun, 13 Mar 2022 20:12:25 +0000
-Subject: PATCH patch 8.2.4563: "z=" in Visual mode may go beyond the end of
- the line
-
-Problem: "z=" in Visual mode may go beyond the end of the line.
-Solution: Adjust "badlen".
----
- src/spellsuggest.c | 4 ++++
- src/testdir/test_spell.vim | 15 +++++++++++++++
- 2 files changed, 19 insertions(+)
-
-diff --git a/src/spellsuggest.c b/src/spellsuggest.c
-index cd28798..429e292 100644
---- a/src/spellsuggest.c
-+++ b/src/spellsuggest.c
-@@ -501,6 +501,10 @@ spell_suggest(int count)
- 	 curwin->w_cursor.col = VIsual.col;
- 	++badlen;
- 	end_visual_mode();
-+	// make sure we don't include the NUL at the end of the line
-+	line = ml_get_curline();
-+	if (badlen > STRLEN(line) - curwin->w_cursor.col)
-+	 badlen = STRLEN(line) - curwin->w_cursor.col;
- }
- // Find the start of the badly spelled word.
- else if (spell_move_to(curwin, FORWARD, TRUE, TRUE, NULL) == 0
-diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
-index de49b42..49118a9 100644
---- a/src/testdir/test_spell.vim
-+++ b/src/testdir/test_spell.vim
-@@ -131,6 +131,21 @@ func Test_spellreall()
- bwipe!
- endfunc
- 
-+func Test_spellsuggest_visual_end_of_line()
-+ let enc_save = &encoding
-+ set encoding=iso8859
-+
-+ " This was reading beyond the end of the line.
-+ norm R00000000000
-+ sil norm &#x16;0
-+ sil! norm &#x16;i00000)
-+ sil! norm &#x16;i00000)
-+ call feedkeys("\<CR>")
-+ norm z=
-+
-+ let &encoding = enc_save
-+endfunc
-+
- func Test_spellinfo()
- new
- let runtime = substitute($VIMRUNTIME, '\\', '/', 'g')
--- 
-2.27.0
-

_service:extract_file:backport-CVE-2022-1154.patch Deleted

@@ -1,59 +0,0 @@
-From b55986c52d4cd88a22d0b0b0e8a79547ba13e1d5 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 29 Mar 2022 13:24:58 +0100
-Subject: PATCH patch 8.2.4646: using buffer line after it has been freed
-
-Problem: Using buffer line after it has been freed in old regexp engine.
-Solution: After getting mark get the line again.
----
- src/regexp_bt.c | 9 +++++++++
- src/testdir/test_regexp_latin.vim | 7 +++++++
- 2 files changed, 16 insertions(+)
-
-diff --git a/src/regexp_bt.c b/src/regexp_bt.c
-index e017ba5..ff92576 100644
---- a/src/regexp_bt.c
-+++ b/src/regexp_bt.c
-@@ -3188,8 +3188,17 @@ regmatch(
- 		int	mark = OPERAND(scan)0;
- 		int	cmp = OPERAND(scan)1;
- 		pos_T	*pos;
-+		size_t	col = REG_MULTI ? rex.input - rex.line : 0;
- 
- 		pos = getmark_buf(rex.reg_buf, mark, FALSE);
-+
-+		// Line may have been freed, get it again.
-+		if (REG_MULTI)
-+		{
-+		 rex.line = reg_getline(rex.lnum);
-+		 rex.input = rex.line + col;
-+		}
-+
- 		if (pos == NULL		 // mark doesn't exist
- 			|| pos->lnum <= 0 // mark isn't set in reg_buf
- 			|| (pos->lnum == rex.lnum + rex.reg_firstlnum
-diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim
-index 5b1db5a..a242d91 100644
---- a/src/testdir/test_regexp_latin.vim
-+++ b/src/testdir/test_regexp_latin.vim
-@@ -152,10 +152,17 @@ endfunc
- 
- func Test_using_mark_position()
- " this was using freed memory
-+ " new engine
- new
- norm O0
- call assert_fails("s/\\%')", 'E486:')
- bwipe!
-+
-+ " old engine
-+ new
-+ norm O0
-+ call assert_fails("s/\\%#=1\\%')", 'E486:')
-+ bwipe!
- endfunc
- 
- func Test_using_invalid_visual_position()
--- 
-1.8.3.1
-

_service:extract_file:backport-CVE-2022-1616.patch Deleted

@@ -1,58 +0,0 @@
-From d88934406c5375d88f8f1b65331c9f0cab68cc6c Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Fri, 6 May 2022 20:38:47 +0100
-Subject: PATCH patch 8.2.4895: buffer overflow with invalid command with
- composing chars
-
-Problem: Buffer overflow with invalid command with composing chars.
-Solution: Check that the whole character fits in the buffer.
----
- src/ex_docmd.c | 4 +++-
- src/testdir/test_cmdline.vim | 11 +++++++++++
- 2 files changed, 14 insertions(+), 1 deletion(-)
-
-diff --git a/src/ex_docmd.c b/src/ex_docmd.c
-index dfcbf37..f142c46 100644
---- a/src/ex_docmd.c
-+++ b/src/ex_docmd.c
-@@ -3092,7 +3092,7 @@ append_command(char_u *cmd)
- 
- STRCAT(IObuff, ": ");
- d = IObuff + STRLEN(IObuff);
-- while (*s != NUL && d - IObuff < IOSIZE - 7)
-+ while (*s != NUL && d - IObuff + 5 < IOSIZE)
- {
- 	if (enc_utf8 ? (s0 == 0xc2 && s1 == 0xa0) : *s == 0xa0)
- 	{
-@@ -3100,6 +3100,8 @@ append_command(char_u *cmd)
- 	 STRCPY(d, "<a0>");
- 	 d += 4;
- 	}
-+	else if (d - IObuff + (*mb_ptr2len)(s) + 1 >= IOSIZE)
-+	 break;
- 	else
- 	 MB_COPY_CHAR(s, d);
- }
-diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
-index 5297951..41a73d2 100644
---- a/src/testdir/test_cmdline.vim
-+++ b/src/testdir/test_cmdline.vim
-@@ -870,4 +870,15 @@ func Test_cmdwin_cedit()
- delfunc CmdWinType
- endfunc
- 
-+" this was going over the end of IObuff
-+func Test_report_error_with_composing()
-+ let caught = 'no'
-+ try
-+ exe repeat('0', 987) .. "0\xdd\x80\xdd\x80\xdd\x80\xdd\x80"
-+ catch /E492:/
-+ let caught = 'yes'
-+ endtry
-+ call assert_equal('yes', caught)
-+endfunc
-+
- " vim: shiftwidth=2 sts=2 expandtab
--- 
-2.27.0
-

_service:extract_file:backport-CVE-2022-1619.patch Deleted

@@ -1,53 +0,0 @@
-From ef02f16609ff0a26ffc6e20263523424980898fe Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sat, 7 May 2022 10:49:10 +0100
-Subject: PATCH patch 8.2.4899: with latin1 encoding CTRL-W might go before
- the cmdline
-
-Problem: With latin1 encoding CTRL-W might go before the start of the
-command line.
-Solution: Check already being at the start of the command line.
----
- src/ex_getln.c | 11 +++++++----
- src/testdir/test_cmdline.vim | 3 +++
- 2 files changed, 10 insertions(+), 4 deletions(-)
-
-diff --git a/src/ex_getln.c b/src/ex_getln.c
-index 68b4757..771a9cd 100644
---- a/src/ex_getln.c
-+++ b/src/ex_getln.c
-@@ -1583,10 +1583,13 @@ getcmdline_int(
- 		 {
- 			while (p > ccline.cmdbuff && vim_isspace(p-1))
- 			 --p;
--			i = vim_iswordc(p-1);
--			while (p > ccline.cmdbuff && !vim_isspace(p-1)
--				&& vim_iswordc(p-1) == i)
--			 --p;
-+			if (p > ccline.cmdbuff)
-+			{
-+				i = vim_iswordc(p-1);
-+				while (p > ccline.cmdbuff && !vim_isspace(p-1)
-+					&& vim_iswordc(p-1) == i)
-+			 	 --p;
-+			}
- 		 }
- 		 else
- 			--p;
-diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
-index cbf7986..1ccdbe2 100644
---- a/src/testdir/test_cmdline.vim
-+++ b/src/testdir/test_cmdline.vim
-@@ -476,6 +476,9 @@ func Test_cmdline_remove_char()
- 
- call feedkeys(":abc def\<S-Left>\<C-U>\<C-B>\"\<CR>", 'tx')
- call assert_equal('"def', @:, e)
-+
-+ " This was going before the start in latin1.
-+ call feedkeys(": \<C-W>\<CR>", 'tx')
- endfor
- 
- let &encoding = encoding_save
--- 
-1.8.3.1
-

_service:extract_file:backport-CVE-2022-1620.patch Deleted

@@ -1,45 +0,0 @@
-From 8e4b76da1d7e987d43ca960dfbc372d1c617466f Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sat, 7 May 2022 11:28:06 +0100
-Subject: PATCH patch 8.2.4901: NULL pointer access when using invalid
- pattern
-
-Problem: NULL pointer access when using invalid pattern.
-Solution: Check for failed regexp program.
----
- src/buffer.c | 2 +-
- src/testdir/test_buffer.vim | 7 +++++++
- 2 files changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/src/buffer.c b/src/buffer.c
-index 5801bce..758d920 100644
---- a/src/buffer.c
-+++ b/src/buffer.c
-@@ -2830,7 +2830,7 @@ fname_match(
- 	rmp->rm_ic = p_fic || ignore_case;
- 	if (vim_regexec(rmp, name, (colnr_T)0))
- 	 match = name;
--	else
-+	else if (rmp->regprog != NULL)
- 	{
- 	 // Replace $(HOME) with '~' and try matching again.
- 	 p = home_replace_save(NULL, name);
-diff --git a/src/testdir/test_buffer.vim b/src/testdir/test_buffer.vim
-index dc35bb4..8300f3d 100644
---- a/src/testdir/test_buffer.vim
-+++ b/src/testdir/test_buffer.vim
-@@ -63,4 +63,11 @@ func Test_bunload_with_offset()
- call delete('b4')
- endfunc
- 
-+" this was using a NULL pointer after failing to use the pattern
-+func Test_buf_pattern_invalid()
-+ vsplit 0000000
-+ silent! buf 0--\&\zs*\zs*e
-+ bwipe!
-+endfunc
-+
- " vim: shiftwidth=2 sts=2 expandtab
--- 
-1.8.3.1
-

_service:extract_file:backport-CVE-2022-1621.patch Deleted

@@ -1,85 +0,0 @@
-From 7c824682d2028432ee082703ef0ab399867a089b Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sun, 8 May 2022 22:32:58 +0100
-Subject: PATCH patch 8.2.4919: can add invalid bytes with :spellgood
-
-Problem: Can add invalid bytes with :spellgood.
-Solution: Check for a valid word string.
----
- src/globals.h | 5 +++++
- src/mbyte.c | 2 +-
- src/spellfile.c | 10 ++++++++++
- src/testdir/test_spellfile.vim | 6 ++++++
- 4 files changed, 22 insertions(+), 1 deletion(-)
-
-diff --git a/src/globals.h b/src/globals.h
-index 7be3bfd..086d04e 100644
---- a/src/globals.h
-+++ b/src/globals.h
-@@ -1745,3 +1745,8 @@ EXTERN int did_repeated_msg INIT(= 0);
- # define REPEATED_MSG_LOOKING	 1
- # define REPEATED_MSG_SAFESTATE	 2
- #endif
-+
-+#ifdef FEAT_SPELL
-+EXTERN char e_illegal_character_in_word
-+ INIT(= N_("E1280: Illegal character in word"));
-+#endif
-diff --git a/src/mbyte.c b/src/mbyte.c
-index 5dd2562..28c5e85 100644
---- a/src/mbyte.c
-+++ b/src/mbyte.c
-@@ -4045,7 +4045,7 @@ theend:
- convert_setup(&vimconv, NULL, NULL);
- }
- 
--#if defined(FEAT_GUI_GTK) || defined(PROTO)
-+#if defined(FEAT_GUI_GTK) || defined(FEAT_SPELL) || defined(PROTO)
- /*
- * Return TRUE if string "s" is a valid utf-8 string.
- * When "end" is NULL stop at the first NUL.
-diff --git a/src/spellfile.c b/src/spellfile.c
-index b9451ec..5171572 100644
---- a/src/spellfile.c
-+++ b/src/spellfile.c
-@@ -4366,6 +4366,10 @@ store_word(
- int		res = OK;
- char_u	*p;
- 
-+ // Avoid adding illegal bytes to the word tree.
-+ if (enc_utf8 && !utf_valid_string(word, NULL))
-+ return FAIL;
-+
- (void)spell_casefold(word, len, foldword, MAXWLEN);
- for (p = pfxlist; res == OK; ++p)
- {
-@@ -6167,6 +6171,12 @@ spell_add_word(
- int		i;
- char_u	*spf;
- 
-+ if (enc_utf8 && !utf_valid_string(word, NULL))
-+ {
-+	emsg(_(e_illegal_character_in_word));
-+	return;
-+ }
-+
- if (idx == 0)	 // use internal wordlist
- {
- 	if (int_wordlist == NULL)
-diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim
-index 53eca84..1382c02 100644
---- a/src/testdir/test_spellfile.vim
-+++ b/src/testdir/test_spellfile.vim
-@@ -170,3 +170,9 @@ func Test_spell_normal()
- set spellfile=
- bw!
- endfunc
-+
-+" Invalid bytes may cause trouble when creating the word list.
-+func Test_check_for_valid_word()
-+ call assert_fails("spellgood! 0^B\xac", 'E1280:')
-+endfunc
-+
--- 
-1.8.3.1
-

_service:extract_file:backport-CVE-2022-1629.patch Deleted

@@ -1,56 +0,0 @@
-From 53a70289c2712808e6d4e88927e03cac01b470dd Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Mon, 9 May 2022 13:15:07 +0100
-Subject: PATCH patch 8.2.4925: trailing backslash may cause reading past end
- of line
-
-Problem: Trailing backslash may cause reading past end of line.
-Solution: Check for NUL after backslash.
----
- src/search.c | 4 ++++
- src/testdir/test_textobjects.vim | 10 +++++++++-
- 2 files changed, 13 insertions(+), 1 deletion(-)
-
-diff --git a/src/search.c b/src/search.c
-index 1a5dc1a..75f0c59 100644
---- a/src/search.c
-+++ b/src/search.c
-@@ -4457,7 +4457,11 @@ find_next_quote(
- 	if (c == NUL)
- 	 return -1;
- 	else if (escape != NULL && vim_strchr(escape, c))
-+	{
- 	 ++col;
-+	 if (linecol == NUL)
-+		return -1;
-+	}
- 	else if (c == quotechar)
- 	 break;
- 	if (has_mbyte)
-diff --git a/src/testdir/test_textobjects.vim b/src/testdir/test_textobjects.vim
-index 49fc9c8..3fc0283 100644
---- a/src/testdir/test_textobjects.vim
-+++ b/src/testdir/test_textobjects.vim
-@@ -154,10 +154,18 @@ func Test_string_html_objects()
- call assert_equal('-', getline('.'), e)
- 
- set quoteescape&
-+
-+ " this was going beyond the end of the line
-+ %del
-+ sil! norm &#x16;i"\
-+ sil! norm &#x16;i"\
-+ sil! norm &#x16;i"\
-+ call assert_equal('"\', getline(1))
-+
-+ bwipe!
- endfor
- 
- set enc=utf-8
-- bwipe!
- endfunc
- 
- func Test_empty_html_tag()
--- 
-1.8.3.1
-

_service:extract_file:backport-CVE-2022-1674.patch Deleted

@@ -1,44 +0,0 @@
-From a59f2dfd0cf9ee1a584d3de5b7c2d47648e79060 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Wed, 11 May 2022 11:42:28 +0100
-Subject: PATCH patch 8.2.4938: crash when matching buffer with invalid
- pattern
-
-Problem: Crash when matching buffer with invalid pattern.
-Solution: Check for NULL regprog.
----
- src/buffer.c | 2 +-
- src/testdir/test_buffer.vim | 4 ++++
- 2 files changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/src/buffer.c b/src/buffer.c
-index 758d920..88094ee 100644
---- a/src/buffer.c
-+++ b/src/buffer.c
-@@ -2805,7 +2805,7 @@ buflist_match(
- 
- // First try the short file name, then the long file name.
- match = fname_match(rmp, buf->b_sfname, ignore_case);
-- if (match == NULL)
-+ if (match == NULL && rmp->regprog != NULL)
- 	match = fname_match(rmp, buf->b_ffname, ignore_case);
- 
- return match;
-diff --git a/src/testdir/test_buffer.vim b/src/testdir/test_buffer.vim
-index 8300f3d..6039ff8 100644
---- a/src/testdir/test_buffer.vim
-+++ b/src/testdir/test_buffer.vim
-@@ -68,6 +68,10 @@ func Test_buf_pattern_invalid()
- vsplit 0000000
- silent! buf 0--\&\zs*\zs*e
- bwipe!
-+
-+ vsplit 00000000000000000000000000
-+ silent! buf 0--\&\zs*\zs*e
-+ bwipe!
- endfunc
- 
- " vim: shiftwidth=2 sts=2 expandtab
--- 
-1.8.3.1
-

_service:extract_file:backport-CVE-2022-1733.patch Deleted

@@ -1,44 +0,0 @@
-From 60ae0e71490c97f2871a6344aca61cacf220f813 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Mon, 16 May 2022 18:06:15 +0100
-Subject: PATCH patch 8.2.4968: reading past end of the line when C-indenting
-
-Problem: Reading past end of the line when C-indenting.
-Solution: Check for NUL.
----
- src/cindent.c | 2 +-
- src/testdir/test_cindent.vim | 7 +++++++
- 2 files changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/src/cindent.c b/src/cindent.c
-index 28d1558..1b2763f 100644
---- a/src/cindent.c
-+++ b/src/cindent.c
-@@ -91,7 +91,7 @@ skip_string(char_u *p)
- 		while (vim_isdigit(pi - 1)) // '\000'
- 		 ++i;
- 	 }
--	 if (pi == '\'')		 // check for trailing '
-+	 if (pi - 1 != NUL && pi == '\'') // check for trailing '
- 	 {
- 		p += i;
- 		continue;
-diff --git a/src/testdir/test_cindent.vim b/src/testdir/test_cindent.vim
-index 2a87460..3b2200a 100644
---- a/src/testdir/test_cindent.vim
-+++ b/src/testdir/test_cindent.vim
-@@ -5263,4 +5263,11 @@ func Test_find_brace_backwards()
- endfunc
- 
- 
-+" This was reading past the end of the line
-+func Test_cindent_check_funcdecl()
-+ new
-+ sil norm o0&#xf;('\0&#xf;=L
-+ bwipe!
-+endfunc
-+
- " vim: shiftwidth=2 sts=2 expandtab
--- 
-1.8.3.1
-

_service:extract_file:backport-CVE-2022-1735.patch Deleted

@@ -1,122 +0,0 @@
-From 7ce5b2b590256ce53d6af28c1d203fb3bc1d2d97 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Mon, 16 May 2022 19:40:59 +0100
-Subject: PATCH patch 8.2.4969: changing text in Visual mode may cause
- invalid memory access
-
-Problem: Changing text in Visual mode may cause invalid memory access.
-Solution: Check the Visual position after making a change.
----
- src/change.c | 3 +++
- src/edit.c | 12 ++----------
- src/misc2.c | 25 +++++++++++++++++++++++++
- src/proto/misc2.pro | 1 +
- src/testdir/test_visual.vim | 10 ++++++++++
- 5 files changed, 41 insertions(+), 10 deletions(-)
-
-diff --git a/src/change.c b/src/change.c
-index f2dfc93..a5ebbdf 100644
---- a/src/change.c
-+++ b/src/change.c
-@@ -523,6 +523,9 @@ changed_common(
- #endif
- }
- 
-+ if (VIsual_active)
-+	check_visual_pos();
-+
- FOR_ALL_TAB_WINDOWS(tp, wp)
- {
- 	if (wp->w_buffer == curbuf)
-diff --git a/src/edit.c b/src/edit.c
-index f77cc05..0dd6b93 100644
---- a/src/edit.c
-+++ b/src/edit.c
-@@ -3101,16 +3101,8 @@ stop_insert(
- 
- 	 // <C-S-Right> may have started Visual mode, adjust the position for
- 	 // deleted characters.
--	 if (VIsual_active && VIsual.lnum == curwin->w_cursor.lnum)
--	 {
--		int len = (int)STRLEN(ml_get_curline());
--
--		if (VIsual.col > len)
--		{
--		 VIsual.col = len;
--		 VIsual.coladd = 0;
--		}
--	 }
-+	 if (VIsual_active)
-+		check_visual_pos();
- 	}
- }
- did_ai = FALSE;
-diff --git a/src/misc2.c b/src/misc2.c
-index 80731f0..51244da 100644
---- a/src/misc2.c
-+++ b/src/misc2.c
-@@ -618,6 +618,31 @@ check_cursor(void)
- check_cursor_col();
- }
- 
-+/*
-+ * Check if VIsual position is valid, correct it if not.
-+ * Can be called when in Visual mode and a change has been made.
-+ */
-+ void
-+check_visual_pos(void)
-+{
-+ if (VIsual.lnum > curbuf->b_ml.ml_line_count)
-+ {
-+	VIsual.lnum = curbuf->b_ml.ml_line_count;
-+	VIsual.col = 0;
-+	VIsual.coladd = 0;
-+ }
-+ else
-+ {
-+	int len = (int)STRLEN(ml_get(VIsual.lnum));
-+
-+	if (VIsual.col > len)
-+	{
-+	 VIsual.col = len;
-+	 VIsual.coladd = 0;
-+	}
-+ }
-+}
-+
- #if defined(FEAT_TEXTOBJ) || defined(PROTO)
- /*
- * Make sure curwin->w_cursor is not on the NUL at the end of the line.
-diff --git a/src/proto/misc2.pro b/src/proto/misc2.pro
-index a52b462..6e6e22d 100644
---- a/src/proto/misc2.pro
-+++ b/src/proto/misc2.pro
-@@ -17,6 +17,7 @@ void check_cursor_lnum(void);
- void check_cursor_col(void);
- void check_cursor_col_win(win_T *win);
- void check_cursor(void);
-+void check_visual_pos(void);
- void adjust_cursor_col(void);
- int leftcol_changed(void);
- void vim_mem_profile_dump(void);
-diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
-index 4f8f056..d21f8f1 100644
---- a/src/testdir/test_visual.vim
-+++ b/src/testdir/test_visual.vim
-@@ -956,3 +956,13 @@ func Test_visual_block_insert_round_off()
- bwipe!
- endfunc
- 
-+func Test_visual_block_with_substitute()
-+ " this was reading beyond the end of the line
-+ new
-+ norm a0)
-+ sil! norm &#x16; O
-+ s/)
-+ sil! norm &#x1d;
-+ bwipe!
-+endfunc
-+
--- 
-1.8.3.1
-

_service:extract_file:backport-Configure-does-not-recognize-gcc-10.0-and-later.patch Deleted

@@ -1,49 +0,0 @@
-From 7077892a7918845a00ce8d7833b43cc6cbed2081 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Wed, 5 Feb 2020 20:44:24 +0100
-Subject: PATCH patch 8.2.0213: configure does not recognize gcc 10.0 and
- later
-
-Problem: Configure does not recognize gcc 10.0 and later.
-Solution: Adjust the pattern matching the version number. (Sergei
- Trofimovich, closes #5580)
----
- src/auto/configure | 2 +-
- src/configure.ac | 4 ++--
- 3 files changed, 5 insertions(+), 3 deletions(-)
-
-diff --git a/src/auto/configure b/src/auto/configure
-index 1b5094e972b2..59f3e68d63cf 100755
---- a/src/auto/configure
-+++ b/src/auto/configure
-@@ -14762,7 +14762,7 @@ DEPEND_CFLAGS_FILTER=
- if test "$GCC" = yes; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GCC 3 or later" >&5
- $as_echo_n "checking for GCC 3 or later... " >&6; }
-- gccmajor=`echo "$gccversion" | sed -e 's/^$1-9$\..*$/\1/g'`
-+ gccmajor=`echo "$gccversion" | sed -e 's/^$0-9\+$\..*$/\1/g'`
- if test "$gccmajor" -gt "2"; then
- DEPEND_CFLAGS_FILTER="| sed 's+-I */+-isystem /+g'"
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-diff --git a/src/configure.ac b/src/configure.ac
-index a098da82ec84..bf10eac5511b 100644
---- a/src/configure.ac
-+++ b/src/configure.ac
-@@ -2195,7 +2195,7 @@ else
- fi
- 
- dnl On my HPUX system the X include dir is found, but the lib dir not.
-- dnl This is a desparate try to fix this.
-+ dnl This is a desperate try to fix this.
- 
- if test -d "$x_includes" && test ! -d "$x_libraries"; then
- x_libraries=`echo "$x_includes" | sed s/include/lib/`
-@@ -4447,7 +4447,7 @@ dnl the number before the version number.
- DEPEND_CFLAGS_FILTER=
- if test "$GCC" = yes; then
- AC_MSG_CHECKING(for GCC 3 or later)
-- gccmajor=`echo "$gccversion" | sed -e 's/^$1-9$\..*$/\1/g'`
-+ gccmajor=`echo "$gccversion" | sed -e 's/^$0-9\+$\..*$/\1/g'`
- if test "$gccmajor" -gt "2"; then
- DEPEND_CFLAGS_FILTER="| sed 's+-I */+-isystem /+g'"
- AC_MSG_RESULT(yes)

_service:extract_file:backport-PyEval_InitThreads-is-deprecated-in-Python-3.9.patch Deleted

@@ -1,90 +0,0 @@
-From efc0d94afc48a03b07955e91315e7e67945cd079 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sun, 11 Oct 2020 18:05:02 +0200
-Subject: PATCH patch 8.2.1834: PyEval_InitThreads() is deprecated in Python
- 3.9
-
-Problem: PyEval_InitThreads() is deprecated in Python 3.9.
-Solution: Do not call PyEval_InitThreads in Python 3.9 and later. (Ken
-Takata, closes #7113) Avoid warnings for functions.
----
- src/if_py_both.h | 8 ++++----
- src/if_python3.c | 21 +++++++++++----------
- 2 files changed, 15 insertions(+), 14 deletions(-)
-
-diff --git a/src/if_py_both.h b/src/if_py_both.h
-index 0763c65..63f4329 100644
---- a/src/if_py_both.h
-+++ b/src/if_py_both.h
-@@ -306,7 +306,7 @@ ObjectDir(PyObject *self, char **attributes)
- // Output buffer management
- 
- // Function to write a line, points to either msg() or emsg().
--typedef void (*writefn)(char_u *);
-+typedef int (*writefn)(char *);
- 
- static PyTypeObject OutputType;
- 
-@@ -358,8 +358,8 @@ PythonIO_Flush(void)
- {
- if (old_fn != NULL && io_ga.ga_len > 0)
- {
--	((char_u *)io_ga.ga_data)io_ga.ga_len = NUL;
--	old_fn((char_u *)io_ga.ga_data);
-+	((char *)io_ga.ga_data)io_ga.ga_len = NUL;
-+	old_fn((char *)io_ga.ga_data);
- }
- io_ga.ga_len = 0;
- }
-@@ -389,7 +389,7 @@ writer(writefn fn, char_u *str, PyInt n)
- 
- 	mch_memmove(((char *)io_ga.ga_data) + io_ga.ga_len, str, (size_t)len);
- 	((char *)io_ga.ga_data)io_ga.ga_len + len = NUL;
--	fn((char_u *)io_ga.ga_data);
-+	fn((char *)io_ga.ga_data);
- 	str = ptr + 1;
- 	n -= len + 1;
- 	io_ga.ga_len = 0;
-diff --git a/src/if_python3.c b/src/if_python3.c
-index 45dc308..7c9e140 100644
---- a/src/if_python3.c
-+++ b/src/if_python3.c
-@@ -958,11 +958,10 @@ Python3_Init(void)
- 
- 	Py_Initialize();
- 
--	// Initialise threads, and below save the state using
--	// PyEval_SaveThread. Without the call to PyEval_SaveThread, thread
--	// specific state (such as the system trace hook), will be lost
--	// between invocations of Python code.
-+#if PY_VERSION_HEX < 0x03090000
-+	// Initialise threads. This is deprecated since Python 3.9.
- 	PyEval_InitThreads();
-+#endif
- #ifdef DYNAMIC_PYTHON3
- 	get_py3_exceptions();
- #endif
-@@ -980,12 +979,14 @@ Python3_Init(void)
- 	// sys.path.
- 	PyRun_SimpleString("import vim; import sys; sys.path = list(filter(lambda x: not x.endswith('must>not&exist'), sys.path))");
- 
--	// lock is created and acquired in PyEval_InitThreads() and thread
--	// state is created in Py_Initialize()
--	// there _PyGILState_NoteThreadState() also sets gilcounter to 1
--	// (python must have threads enabled!)
--	// so the following does both: unlock GIL and save thread state in TLS
--	// without deleting thread state
-+	// Without the call to PyEval_SaveThread, thread specific state (such
-+	// as the system trace hook), will be lost between invocations of
-+	// Python code.
-+	// GIL may have been created and acquired in PyEval_InitThreads() and
-+	// thread state is created in Py_Initialize(); there
-+	// _PyGILState_NoteThreadState() also sets gilcounter to 1 (python must
-+	// have threads enabled!), so the following does both: unlock GIL and
-+	// save thread state in TLS without deleting thread state
- 	PyEval_SaveThread();
- 
- 	py3initialised = 1;
--- 
-1.8.3.1
-

_service:extract_file:backport-Python-3.9-does-not-define-_Py_DEC_REFTOTAL.patch Deleted

_service:extract_file:backport-Ruby-missing-function-prototype.patch Deleted

_service:extract_file:backport-add-the-arglist_locked-flag.patch Deleted

@@ -1,173 +0,0 @@
-From 5ed58c7b700fcb9fd03c418300145b616f4bdcdd Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 28 Jan 2021 14:24:55 +0100
-Subject: PATCH patch 8.2.2421: double free when using autocommand with
- "argdel"
-Conflict:NA
-Reference:https://github.com/vim/vim/commit/5ed58c7b700fcb9fd03c418300145b616f4bdcdd
- 
-Problem: Double free when using autocommand with "argdel". (Houyunsong)
-Solution: Add the arglist_locked flag.
-
----
- src/arglist.c | 47 +++++++++++++++++++++++++++++-------
- src/testdir/test_autocmd.vim | 6 +++++
- 2 files changed, 44 insertions(+), 9 deletions(-)
-
-diff --git a/src/arglist.c b/src/arglist.c
-index cab74f8..68befa4 100644
---- a/src/arglist.c
-+++ b/src/arglist.c
-@@ -17,12 +17,29 @@
- #define AL_ADD	2
- #define AL_DEL	3
- 
-+// This flag is set whenever the argument list is being changed and calling a
-+// function that might trigger an autocommand.
-+static int arglist_locked = FALSE;
-+
-+ static int
-+check_arglist_locked(void)
-+{
-+ if (arglist_locked)
-+ {
-+	emsg(_(e_cannot_change_arglist_recursively));
-+	return FAIL;
-+ }
-+ return OK;
-+}
-+
- /*
- * Clear an argument list: free all file names and reset it to zero entries.
- */
- void
- alist_clear(alist_T *al)
- {
-+ if (check_arglist_locked() == FAIL)
-+	return;
- while (--al->al_ga.ga_len >= 0)
- 	vim_free(AARGLIST(al)al->al_ga.ga_len.ae_fname);
- ga_clear(&al->al_ga);
-@@ -126,14 +143,9 @@ alist_set(
- int		fnum_len)
- {
- int		i;
-- static int recursive = 0;
- 
-- if (recursive)
-- {
--	emsg(_(e_au_recursive));
-+ if (check_arglist_locked() == FAIL)
- 	return;
-- }
-- ++recursive;
- 
- alist_clear(al);
- if (ga_grow(&al->al_ga, count) == OK)
-@@ -152,7 +164,11 @@ alist_set(
- 	 // May set buffer name of a buffer previously used for the
- 	 // argument list, so that it's re-used by alist_add.
- 	 if (fnum_list != NULL && i < fnum_len)
-+	 {
-+		arglist_locked = TRUE;
- 		buf_set_name(fnum_listi, filesi);
-+		arglist_locked = FALSE;
-+	 }
- 
- 	 alist_add(al, filesi, use_curbuf ? 2 : 1);
- 	 ui_breakcheck();
-@@ -163,8 +179,6 @@ alist_set(
- 	FreeWild(count, files);
- if (al == &global_alist)
- 	arg_had_last = FALSE;
--
-- --recursive;
- }
- 
- /*
-@@ -179,6 +193,10 @@ alist_add(
- {
- if (fname == NULL)		// don't add NULL file names
- 	return;
-+ if (check_arglist_locked() == FAIL)
-+	return;
-+ arglist_locked = TRUE;
-+
- #ifdef BACKSLASH_IN_FILENAME
- slash_adjust(fname);
- #endif
-@@ -187,6 +205,8 @@ alist_add(
- 	AARGLIST(al)al->al_ga.ga_len.ae_fnum =
- 	 buflist_add(fname, BLN_LISTED | (set_fnum == 2 ? BLN_CURBUF : 0));
- ++al->al_ga.ga_len;
-+
-+ arglist_locked = FALSE;
- }
- 
- #if defined(BACKSLASH_IN_FILENAME) || defined(PROTO)
-@@ -334,7 +354,8 @@ alist_add_list(
- int		i;
- int		old_argcount = ARGCOUNT;
- 
-- if (ga_grow(&ALIST(curwin)->al_ga, count) == OK)
-+ if (check_arglist_locked() != FAIL
-+	 && ga_grow(&ALIST(curwin)->al_ga, count) == OK)
- {
- 	if (after < 0)
- 	 after = 0;
-@@ -343,6 +364,7 @@ alist_add_list(
- 	if (after < ARGCOUNT)
- 	 mch_memmove(&(ARGLISTafter + count), &(ARGLISTafter),
- 				 (ARGCOUNT - after) * sizeof(aentry_T));
-+	arglist_locked = TRUE;
- 	for (i = 0; i < count; ++i)
- 	{
- 	 int flags = BLN_LISTED | (will_edit ? BLN_CURBUF : 0);
-@@ -350,6 +372,7 @@ alist_add_list(
- 	 ARGLISTafter + i.ae_fname = filesi;
- 	 ARGLISTafter + i.ae_fnum = buflist_add(filesi, flags);
- 	}
-+	arglist_locked = FALSE;
- 	ALIST(curwin)->al_ga.ga_len += count;
- 	if (old_argcount > 0 && curwin->w_arg_idx >= after)
- 	 curwin->w_arg_idx += count;
-@@ -382,6 +405,9 @@ do_arglist(
- int		match;
- int		arg_escaped = TRUE;
- 
-+ if (check_arglist_locked() == FAIL)
-+	return FAIL;
-+
- // Set default argument for ":argadd" command.
- if (what == AL_ADD && *str == NUL)
- {
-@@ -776,6 +802,9 @@ ex_argdelete(exarg_T *eap)
- int		i;
- int		n;
- 
-+ if (check_arglist_locked() == FAIL)
-+	return;
-+
- if (eap->addr_count > 0 || *eap->arg == NUL)
- {
- 	// ":argdel" works like ":argdel"
-diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
-index ab02402..4fa3b51 100755
---- a/src/testdir/test_autocmd.vim
-+++ b/src/testdir/test_autocmd.vim
-@@ -147,6 +147,12 @@ func Test_autocmd_bufunload_with_tabnext()
- quit
- endfunc
- 
-+func Test_argdelete_in_next()
-+ au BufNew,BufEnter,BufLeave,BufWinEnter * argdel
-+ call assert_fails('next a b', 'E1156:')
-+ au! BufNew,BufEnter,BufLeave,BufWinEnter *
-+endfunc
-+
- func Test_autocmd_bufwinleave_with_tabfirst()
- tabedit
- augroup sample
--- 
-2.27.0
-

_service:extract_file:backport-build-failure-with-Perl5.32.patch Deleted

@@ -1,50 +0,0 @@
-From f5433fbfe4324fd443664fb924116b5ed675bef5 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sun, 21 Jun 2020 20:06:54 +0200
-Subject: PATCH patch 8.2.1031: build failure with Perl5.32
-
-Problem: Build failure with Perl5.32.
-Solution: Define a few more functions. (Felix Yan, closes #6310)
----
- src/if_perl.xs | 19 +++++++++++++++++++
- 1 file changed, 19 insertions(+)
-
-diff --git a/src/if_perl.xs b/src/if_perl.xs
-index 099d386..5adccce 100644
---- a/src/if_perl.xs
-+++ b/src/if_perl.xs
-@@ -651,6 +651,11 @@ S_SvREFCNT_dec(pTHX_ SV *sv)
- }
- # endif
-
-+/* perl-5.32 needs Perl_SvREFCNT_dec */
-+# if (PERL_REVISION == 5) && (PERL_VERSION >= 32)
-+# define Perl_SvREFCNT_dec S_SvREFCNT_dec
-+# endif
-+
- /* perl-5.26 also needs S_TOPMARK and S_POPMARK. */
- # if (PERL_REVISION == 5) && (PERL_VERSION >= 26)
- PERL_STATIC_INLINE I32
-@@ -675,6 +680,20 @@ S_POPMARK(pTHX)
- }
- # endif
-
-+/* perl-5.32 needs Perl_POPMARK */
-+# if (PERL_REVISION == 5) && (PERL_VERSION >= 32)
-+# define Perl_POPMARK S_POPMARK
-+
-+/* perl-5.32 needs Perl_SvTRUE */
-+PERL_STATIC_INLINE bool
-+Perl_SvTRUE(pTHX_ SV *sv) {
-+ if (!LIKELY(sv))
-+ return FALSE;
-+ SvGETMAGIC(sv);
-+ return SvTRUE_nomg_NN(sv);
-+}
-+# endif
-+
- /*
- * Make all runtime-links of perl.
- *
---
-2.27.0
\ No newline at end of file

_service:extract_file:backport-build-failure-with-Ruby-3.0-and-32-bits.patch Deleted

_service:extract_file:backport-build-failure-with-some-Ruby-versions.patch Deleted

@@ -1,294 +0,0 @@
-From dace9f785fca6cc802b2fb7f11a5ee4fab896432 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Mon, 28 Dec 2020 15:07:45 +0100
-Subject: PATCH patch 8.2.2235: build failure with some Ruby versions
-
-Problem: Build failure with some Ruby versions.
-Solution: Adjust the code for Ruby 3.0. (Ozaki Kiichi, closes #7564)
----
- src/if_ruby.c | 143 ++++++++++++++++++++++++++++++++++++----------------------
- 1 file changed, 89 insertions(+), 54 deletions(-)
-
-diff --git a/src/if_ruby.c b/src/if_ruby.c
-index 906a902..d21a655 100644
---- a/src/if_ruby.c
-+++ b/src/if_ruby.c
-@@ -32,8 +32,9 @@
- # define RUBYEXTERN extern
- #endif
- 
--#if defined(DYNAMIC_RUBY) && RUBY_VERSION >= 24
--# define USE_RUBY_INTEGER
-+// suggested by Ariya Mizutani
-+#if (_MSC_VER == 1200)
-+# undef _WIN32_WINNT
- #endif
- 
- #ifdef DYNAMIC_RUBY
-@@ -42,6 +43,10 @@
- * definition. This function use these variables. But we want function to
- * use dll_* variables.
- */
-+# if RUBY_VERSION >= 24
-+# define USE_RUBY_INTEGER
-+# endif
-+
- # define rb_cFalseClass		(*dll_rb_cFalseClass)
- # define rb_cFixnum		(*dll_rb_cFixnum)
- # if defined(USE_RUBY_INTEGER)
-@@ -54,6 +59,7 @@
- # define rb_cString		(*dll_rb_cString)
- # define rb_cSymbol		(*dll_rb_cSymbol)
- # define rb_cTrueClass		(*dll_rb_cTrueClass)
-+
- # if RUBY_VERSION >= 18
- /*
- * On ver 1.8, all Ruby functions are exported with "__declspec(dllimport)"
-@@ -64,40 +70,41 @@
- # define RUBY_EXPORT
- # endif
- 
--#endif // ifdef DYNAMIC_RUBY
--
--// suggested by Ariya Mizutani
--#if (_MSC_VER == 1200)
--# undef _WIN32_WINNT
--#endif
--
--#if defined(DYNAMIC_RUBY) && RUBY_VERSION >= 19
-+# if RUBY_VERSION >= 19
- // Ruby 1.9 defines a number of static functions which use rb_num2long and
- // rb_int2big
--# define rb_num2long rb_num2long_stub
--# define rb_int2big rb_int2big_stub
--#endif
-+# define rb_num2long rb_num2long_stub
-+# define rb_int2big rb_int2big_stub
- 
--#if defined(DYNAMIC_RUBY) && RUBY_VERSION >= 19 \
--	&& VIM_SIZEOF_INT < VIM_SIZEOF_LONG
-+# if RUBY_VERSION >= 30 || VIM_SIZEOF_INT < VIM_SIZEOF_LONG
- // Ruby 1.9 defines a number of static functions which use rb_fix2int and
- // rb_num2int if VIM_SIZEOF_INT < VIM_SIZEOF_LONG (64bit)
--# define rb_fix2int rb_fix2int_stub
--# define rb_num2int rb_num2int_stub
--#endif
-+# define rb_fix2int rb_fix2int_stub
-+# define rb_num2int rb_num2int_stub
-+# endif
-+# endif
- 
--#if defined(DYNAMIC_RUBY) && RUBY_VERSION == 21
-+# if RUBY_VERSION == 21
- // Ruby 2.1 adds new GC called RGenGC and RARRAY_PTR uses
- // rb_gc_writebarrier_unprotect_promoted if USE_RGENGC
--# define rb_gc_writebarrier_unprotect_promoted rb_gc_writebarrier_unprotect_promoted_stub
--#endif
--#if defined(DYNAMIC_RUBY) && RUBY_VERSION >= 22
--# define rb_gc_writebarrier_unprotect rb_gc_writebarrier_unprotect_stub
--#endif
-+# define rb_gc_writebarrier_unprotect_promoted rb_gc_writebarrier_unprotect_promoted_stub
-+# endif
- 
--#if defined(DYNAMIC_RUBY) && RUBY_VERSION >= 26
--# define rb_ary_detransient rb_ary_detransient_stub
--#endif
-+# if RUBY_VERSION >= 22
-+# define rb_gc_writebarrier_unprotect rb_gc_writebarrier_unprotect_stub
-+# endif
-+
-+# if RUBY_VERSION >= 26
-+# define rb_ary_detransient rb_ary_detransient_stub
-+# endif
-+
-+# if RUBY_VERSION >= 30
-+# define rb_check_type rb_check_type_stub
-+# define rb_num2uint rb_num2uint_stub
-+# define ruby_malloc_size_overflow ruby_malloc_size_overflow_stub
-+# endif
-+
-+#endif // ifdef DYNAMIC_RUBY
- 
- #include <ruby.h>
- #if RUBY_VERSION >= 19
-@@ -212,7 +219,9 @@ static int ruby_convert_to_vim_value(VALUE val, typval_T *rettv);
- # define rb_assoc_new			dll_rb_assoc_new
- # define rb_cObject			(*dll_rb_cObject)
- # define rb_class_new_instance		dll_rb_class_new_instance
--# define rb_check_type			dll_rb_check_type
-+# if RUBY_VERSION < 30
-+# define rb_check_type			dll_rb_check_type
-+# endif
- # ifdef USE_TYPEDDATA
- # define rb_check_typeddata		dll_rb_check_typeddata
- # endif
-@@ -263,7 +272,9 @@ static int ruby_convert_to_vim_value(VALUE val, typval_T *rettv);
- # define rb_fix2int			dll_rb_fix2int
- # define rb_num2int			dll_rb_num2int
- # endif
--# define rb_num2uint			dll_rb_num2uint
-+# if RUBY_VERSION < 30
-+# define rb_num2uint			dll_rb_num2uint
-+# endif
- # endif
- # define rb_num2dbl			dll_rb_num2dbl
- # define rb_lastline_get			dll_rb_lastline_get
-@@ -481,7 +492,7 @@ static rb_encoding* (*dll_rb_enc_find) (const char*);
- static VALUE (*dll_rb_enc_str_new) (const char*, long, rb_encoding*);
- static VALUE (*dll_rb_sprintf) (const char*, ...);
- static VALUE (*dll_rb_require) (const char*);
--static void* (*ruby_options)(int, char**);
-+static void* (*dll_ruby_options)(int, char**);
- # endif
- 
- # if defined(USE_RGENGC) && USE_RGENGC
-@@ -492,32 +503,38 @@ static void (*dll_rb_gc_writebarrier_unprotect)(VALUE obj);
- # endif
- # endif
- 
-+# if RUBY_VERSION >= 30
-+NORETURN(static void (*dll_ruby_malloc_size_overflow)(size_t, size_t));
-+# endif
-+
- # if RUBY_VERSION >= 26
- void rb_ary_detransient_stub(VALUE x);
- # endif
- 
--# if (RUBY_VERSION >= 19) && !defined(PROTO)
--# if RUBY_VERSION >= 22
-+// Do not generate a prototype here, VALUE isn't always defined.
-+# ifndef PROTO
-+# if RUBY_VERSION >= 19
-+# if RUBY_VERSION >= 22
- long
- rb_num2long_stub(VALUE x)
--# else
-+# else
- SIGNED_VALUE
- rb_num2long_stub(VALUE x)
--# endif
-+# endif
- {
- return dll_rb_num2long(x);
- }
--# if RUBY_VERSION >= 26
-+# if RUBY_VERSION >= 26
- VALUE
- rb_int2big_stub(intptr_t x)
--# else
-+# else
- VALUE
- rb_int2big_stub(SIGNED_VALUE x)
--# endif
-+# endif
- {
- return dll_rb_int2big(x);
- }
--# if (RUBY_VERSION >= 19) && (VIM_SIZEOF_INT < VIM_SIZEOF_LONG)
-+# if VIM_SIZEOF_INT < VIM_SIZEOF_LONG
- long
- rb_fix2int_stub(VALUE x)
- {
-@@ -528,50 +545,65 @@ rb_num2int_stub(VALUE x)
- {
- return dll_rb_num2int(x);
- }
--# endif
--# if RUBY_VERSION >= 20
-+# endif
-+# if RUBY_VERSION >= 20

_service:extract_file:backport-build-problem-with-Ruby-2.7.patch Deleted

@@ -1,121 +0,0 @@
-From d5a986f460019a924627d79350552f446505cffb Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sun, 6 Dec 2020 21:11:31 +0100
-Subject: PATCH patch 8.2.2104: build problem with Ruby 2.7
-
-Problem: Build problem with Ruby 2.7.
-Solution: Adjust function declarations. (Ozaki Kiichi, closes #7430)
----
- src/auto/configure | 3 +--
- src/configure.ac | 3 +--
- src/if_ruby.c | 28 ++++++++++++++++++++--------
- 3 files changed, 22 insertions(+), 12 deletions(-)
-
-diff --git a/src/auto/configure b/src/auto/configure
-index c50f4bc..9a0c1e6 100755
---- a/src/auto/configure
-+++ b/src/auto/configure
-@@ -7590,8 +7590,7 @@ $as_echo "$rubyhdrdir" >&6; }
- 	librubyarg=`$vi_cv_path_ruby -r rbconfig -e "print $ruby_rbconfig.expand($ruby_rbconfig::CONFIG'LIBRUBYARG')"`
- 	librubya=`$vi_cv_path_ruby -r rbconfig -e "print $ruby_rbconfig.expand($ruby_rbconfig::CONFIG'LIBRUBY_A')"`
- 	rubylibdir=`$vi_cv_path_ruby -r rbconfig -e "print $ruby_rbconfig.expand($ruby_rbconfig::CONFIG'libdir')"`
--	if test -f "$rubylibdir/$librubya"; then
--	 librubyarg="$librubyarg"
-+	if test -f "$rubylibdir/$librubya" || expr "$librubyarg" : "-lruby"; then
- 	 RUBY_LIBS="$RUBY_LIBS -L$rubylibdir"
- 	elif test "$librubyarg" = "libruby.a"; then
- 	 	 librubyarg="-lruby"
-diff --git a/src/configure.ac b/src/configure.ac
-index f0e8371..e796d0e 100644
---- a/src/configure.ac
-+++ b/src/configure.ac
-@@ -1932,8 +1932,7 @@ if test "$enable_rubyinterp" = "yes" -o "$enable_rubyinterp" = "dynamic"; then
- 	librubyarg=`$vi_cv_path_ruby -r rbconfig -e "print $ruby_rbconfig.expand($ruby_rbconfig::CONFIG'LIBRUBYARG')"`
- 	librubya=`$vi_cv_path_ruby -r rbconfig -e "print $ruby_rbconfig.expand($ruby_rbconfig::CONFIG'LIBRUBY_A')"`
- 	rubylibdir=`$vi_cv_path_ruby -r rbconfig -e "print $ruby_rbconfig.expand($ruby_rbconfig::CONFIG'libdir')"`
--	if test -f "$rubylibdir/$librubya"; then
--	 librubyarg="$librubyarg"
-+	if test -f "$rubylibdir/$librubya" || expr "$librubyarg" : "-lruby"; then
- 	 RUBY_LIBS="$RUBY_LIBS -L$rubylibdir"
- 	elif test "$librubyarg" = "libruby.a"; then
- 	 dnl required on Mac OS 10.3 where libruby.a doesn't exist
-diff --git a/src/if_ruby.c b/src/if_ruby.c
-index 68d5582..d0f8acf 100644
---- a/src/if_ruby.c
-+++ b/src/if_ruby.c
-@@ -1296,13 +1296,19 @@ vim_blob(VALUE self UNUSED, VALUE str)
- }
- 
- static VALUE
--buffer_s_current(void)
-+buffer_s_current(VALUE self UNUSED)
- {
- return buffer_new(curbuf);
- }
- 
- static VALUE
--buffer_s_count(void)
-+buffer_s_current_getter(ID id UNUSED, VALUE *x UNUSED)
-+{
-+ return buffer_new(curbuf);
-+}
-+
-+ static VALUE
-+buffer_s_count(VALUE self UNUSED)
- {
- buf_T *b;
- int n = 0;
-@@ -1562,7 +1568,13 @@ get_win(VALUE obj)
- }
- 
- static VALUE
--window_s_current(void)
-+window_s_current(VALUE self UNUSED)
-+{
-+ return window_new(curwin);
-+}
-+
-+ static VALUE
-+window_s_current_getter(ID id UNUSED, VALUE *x UNUSED)
- {
- return window_new(curwin);
- }
-@@ -1572,7 +1584,7 @@ window_s_current(void)
- * SegPhault - 03/07/05
- */
- static VALUE
--line_s_current(void)
-+line_s_current(VALUE self UNUSED)
- {
- return get_buffer_line(curbuf, curwin->w_cursor.lnum);
- }
-@@ -1584,13 +1596,13 @@ set_current_line(VALUE self UNUSED, VALUE str)
- }
- 
- static VALUE
--current_line_number(void)
-+current_line_number(VALUE self UNUSED)
- {
- return INT2FIX((int)curwin->w_cursor.lnum);
- }
- 
- static VALUE
--window_s_count(void)
-+window_s_count(VALUE self UNUSED)
- {
- win_T	*w;
- int n = 0;
-@@ -1790,8 +1802,8 @@ ruby_vim_init(void)
- rb_define_method(cVimWindow, "cursor", window_cursor, 0);
- rb_define_method(cVimWindow, "cursor=", window_set_cursor, 1);
- 
-- rb_define_virtual_variable("$curbuf", buffer_s_current, 0);
-- rb_define_virtual_variable("$curwin", window_s_current, 0);
-+ rb_define_virtual_variable("$curbuf", buffer_s_current_getter, 0);
-+ rb_define_virtual_variable("$curwin", window_s_current_getter, 0);
- }
- 
- void
--- 
-2.13.7
-

_service:extract_file:backport-cannot-build-with-Perl-5.34.patch Deleted

@@ -1,61 +0,0 @@
-From 543467136f001708f4c63376ac5d18adde82db30 Mon Sep 17 00:00:00 2001
-From: ichizok <gclient.gaap@gmail.com>
-Date: Thu, 27 May 2021 18:05:14 +0200
-Subject: PATCH patch 8.2.2891: cannot build with Perl 5.34
-
-Problem: Cannot build with Perl 5.34.
-Solution: Add Perl_SvTRUE_common(). (Ozaki Kiichi, closes #8266,
- closes #8250)
----
- src/if_perl.xs | 31 ++++++++++++++++++++++++++++++-
- 1 file changed, 30 insertions(+), 1 deletion(-)
-
-diff --git a/src/if_perl.xs b/src/if_perl.xs
-index 99fc3cb..39daa8e 100644
---- a/src/if_perl.xs
-+++ b/src/if_perl.xs
-@@ -692,12 +692,41 @@ S_POPMARK(pTHX)
- /* perl-5.32 needs Perl_POPMARK */
- # if (PERL_REVISION == 5) && (PERL_VERSION >= 32)
- # define Perl_POPMARK S_POPMARK
-+# endif
-+
-+/* perl-5.34 needs Perl_SvTRUE_common; used in SvTRUE_nomg_NN */
-+# if (PERL_REVISION == 5) && (PERL_VERSION >= 34)
-+PERL_STATIC_INLINE bool
-+Perl_SvTRUE_common(pTHX_ SV * sv, const bool sv_2bool_is_fallback)
-+{
-+ if (UNLIKELY(SvIMMORTAL_INTERP(sv)))
-+ return SvIMMORTAL_TRUE(sv);
-+
-+ if (! SvOK(sv))
-+ return FALSE;
-+
-+ if (SvPOK(sv))
-+ return SvPVXtrue(sv);
-+
-+ if (SvIOK(sv))
-+ return SvIVX(sv) != 0; /* casts to bool */
-+
-+ if (SvROK(sv) && !(SvOBJECT(SvRV(sv)) && HvAMAGIC(SvSTASH(SvRV(sv)))))
-+ return TRUE;
-+
-+ if (sv_2bool_is_fallback)
-+ return sv_2bool_nomg(sv);
-+
-+ return isGV_with_GP(sv);
-+}
-+# endif
-
- /* perl-5.32 needs Perl_SvTRUE */
-+# if (PERL_REVISION == 5) && (PERL_VERSION >= 32)
- PERL_STATIC_INLINE bool
- Perl_SvTRUE(pTHX_ SV *sv) {
- if (!LIKELY(sv))
-- return FALSE;
-+ return FALSE;
- SvGETMAGIC(sv);
- return SvTRUE_nomg_NN(sv);
- }
---
-2.27.0
\ No newline at end of file

_service:extract_file:backport-cannot-build-with-Strawberry-Perl-5.32.0.patch Deleted

@@ -1,48 +0,0 @@
-From 895a7a472d2eb4413e63cdad3213cb1ef1633458 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 10 Sep 2020 21:36:11 +0200
-Subject: PATCH patch 8.2.1655: cannot build with Strawberry Perl 5.32.0
-
-Problem: Cannot build with Strawberry Perl 5.32.0.
-Solution: Use Perl_sv_2pvbyte_flags. (closes #6921)
----
- src/if_perl.xs | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/src/if_perl.xs b/src/if_perl.xs
-index 2049509..9f59d39 100644
---- a/src/if_perl.xs
-+++ b/src/if_perl.xs
-@@ -236,6 +236,9 @@ typedef int perl_key;
- # else
- # define Perl_sv_2pv dll_Perl_sv_2pv
- # endif
-+# if (PERL_REVISION == 5) && (PERL_VERSION >= 32)
-+# define Perl_sv_2pvbyte_flags dll_Perl_sv_2pvbyte_flags
-+# endif
- # define Perl_sv_2pvbyte dll_Perl_sv_2pvbyte
- # define Perl_sv_bless dll_Perl_sv_bless
- # if (PERL_REVISION == 5) && (PERL_VERSION >= 8)
-@@ -390,6 +393,9 @@ static char* (*Perl_sv_2pv_nolen)(pTHX_ SV*);
- static char* (*Perl_sv_2pv)(pTHX_ SV*, STRLEN*);
- # endif
- static char* (*Perl_sv_2pvbyte)(pTHX_ SV*, STRLEN*);
-+# if (PERL_REVISION == 5) && (PERL_VERSION >= 32)
-+static char* (*Perl_sv_2pvbyte_flags)(pTHX_ SV*, STRLEN*, I32);
-+# endif
- static SV* (*Perl_sv_bless)(pTHX_ SV*, HV*);
- # if (PERL_REVISION == 5) && (PERL_VERSION >= 8)
- static void (*Perl_sv_catpvn_flags)(pTHX_ SV* , const char*, STRLEN, I32);
-@@ -546,6 +552,9 @@ static struct {
- {"Perl_sv_2pv", (PERL_PROC*)&Perl_sv_2pv},
- # endif
- {"Perl_sv_2pvbyte", (PERL_PROC*)&Perl_sv_2pvbyte},
-+# if (PERL_REVISION == 5) && (PERL_VERSION >= 32)
-+ {"Perl_sv_2pvbyte_flags", (PERL_PROC*)&Perl_sv_2pvbyte_flags},
-+# endif
- # ifdef PERL589_OR_LATER
- {"Perl_sv_2iv_flags", (PERL_PROC*)&Perl_sv_2iv_flags},
- {"Perl_newXS_flags", (PERL_PROC*)&Perl_newXS_flags},
--- 
-2.13.7
-

_service:extract_file:backport-command-line-editing-not-sufficiently-tested.patch Deleted

@@ -1,187 +0,0 @@
-From 59cb041d0a56d8555857da7e063ec61504ee1fa7 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Wed, 18 Dec 2019 22:26:31 +0100
-Subject: PATCH patch 8.2.0023: command line editing not sufficiently tested
-Problem: Command line editing not sufficiently tested.
-Solution: Add more tests. (Dominique Pelle, closes #5374)
-
-Reference:https://github.com/vim/vim/commit/59cb041d0a56d8555857da7e063ec61504ee1fa7
----
- src/testdir/Make_all.mak | 1 +
- src/testdir/test_alot.vim | 1 +
- src/testdir/test_cmdline.vim | 56 +++++++++++++++++++++++++++++++++-----------
- src/testdir/test_ex_mode.vim | 54 ++++++++++++++++++++++++++++++++++++
- 4 files changed, 98 insertions(+), 14 deletions(-)
- create mode 100644 src/testdir/test_ex_mode.vim
-
-diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
-index 665bcc7..05e7a2c 100644
---- a/src/testdir/Make_all.mak
-+++ b/src/testdir/Make_all.mak
-@@ -102,6 +102,7 @@ NEW_TESTS = \
- 	test_ex_equal \
- 	test_ex_undo \
- 	test_ex_z \
-+	test_ex_mode \
- 	test_excmd \
- 	test_exec_while_if \
- 	test_execute_func \
-diff --git a/src/testdir/test_alot.vim b/src/testdir/test_alot.vim
-index 894ec58..25241b2 100644
---- a/src/testdir/test_alot.vim
-+++ b/src/testdir/test_alot.vim
-@@ -13,6 +13,7 @@ source test_delete.vim
- source test_ex_equal.vim
- source test_ex_undo.vim
- source test_ex_z.vim
-+source test_ex_mode.vim
- source test_execute_func.vim
- source test_expand.vim
- source test_expand_dllpath.vim
-diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
-index 5297951..837ef63 100644
---- a/src/testdir/test_cmdline.vim
-+++ b/src/testdir/test_cmdline.vim
-@@ -419,7 +419,7 @@ func Test_expand_star_star()
- call delete('a', 'rf')
- endfunc
- 
--func Test_paste_in_cmdline()
-+func Test_cmdline_paste()
- let @a = "def"
- call feedkeys(":abc \<C-R>a ghi\<C-B>\"\<CR>", 'tx')
- call assert_equal('"abc def ghi', @:)
-@@ -459,18 +459,37 @@ func Test_paste_in_cmdline()
- bwipe!
- endfunc
- 
--func Test_remove_char_in_cmdline()
-- call feedkeys(":abc def\<S-Left>\<Del>\<C-B>\"\<CR>", 'tx')
-- call assert_equal('"abc ef', @:)
-+func Test_cmdline_remove_char()
-+ let encoding_save = &encoding
-+
-+ for e in 'utf8', 'latin1'
-+ exe 'set encoding=' . e
-+
-+ call feedkeys(":abc def\<S-Left>\<Del>\<C-B>\"\<CR>", 'tx')
-+ call assert_equal('"abc ef', @:, e)
-+
-+ call feedkeys(":abc def\<S-Left>\<BS>\<C-B>\"\<CR>", 'tx')
-+ call assert_equal('"abcdef', @:)
-+
-+ call feedkeys(":abc def ghi\<S-Left>\<C-W>\<C-B>\"\<CR>", 'tx')
-+ call assert_equal('"abc ghi', @:, e)
- 
-- call feedkeys(":abc def\<S-Left>\<BS>\<C-B>\"\<CR>", 'tx')
-- call assert_equal('"abcdef', @:)
-+ call feedkeys(":abc def\<S-Left>\<C-U>\<C-B>\"\<CR>", 'tx')
-+ call assert_equal('"def', @:, e)
-+ endfor
-+
-+ let &encoding = encoding_save
-+endfunc
- 
-- call feedkeys(":abc def ghi\<S-Left>\<C-W>\<C-B>\"\<CR>", 'tx')
-- call assert_equal('"abc ghi', @:)
-+func Test_cmdline_keymap_ctrl_hat()
-+ if !has('keymap')
-+ return
-+ endif
- 
-- call feedkeys(":abc def\<S-Left>\<C-U>\<C-B>\"\<CR>", 'tx')
-- call assert_equal('"def', @:)
-+ set keymap=esperanto
-+ call feedkeys(":\"Jxauxdo \<C-^>Jxauxdo \<C-^>Jxauxdo\<CR>", 'tx')
-+ call assert_equal('"Jxauxdo Ĵaŭdo Jxauxdo', @:)
-+ set keymap=
- endfunc
- 
- func Test_illegal_address1()
-@@ -741,20 +760,20 @@ func Test_cmdline_overstrike()
- 
- " Test overstrike in the middle of the command line.
- call feedkeys(":\"01234\<home>\<right>\<right>ab\<right>\<insert>cd\<enter>", 'xt')
-- call assert_equal('"0ab1cd4', @:)
-+ call assert_equal('"0ab1cd4', @:, e)
- 
- " Test overstrike going beyond end of command line.
- call feedkeys(":\"01234\<home>\<right>\<right>ab\<right>\<insert>cdefgh\<enter>", 'xt')
-- call assert_equal('"0ab1cdefgh', @:)
-+ call assert_equal('"0ab1cdefgh', @:, e)
- 
- " Test toggling insert/overstrike a few times.
- call feedkeys(":\"01234\<home>\<right>ab\<right>\<insert>cd\<right>\<insert>ef\<enter>", 'xt')
-- call assert_equal('"ab0cd3ef4', @:)
-+ call assert_equal('"ab0cd3ef4', @:, e)
- endfor
- 
- " Test overstrike with multi-byte characters.
- call feedkeys(":\"テキストエディタ\<home>\<right>\<right>ab\<right>\<insert>cd\<enter>", 'xt')
-- call assert_equal('"テabキcdエディタ', @:)
-+ call assert_equal('"テabキcdエディタ', @:, e)
- 
- let &encoding = encoding_save
- endfunc
-diff --git a/src/testdir/test_ex_mode.vim b/src/testdir/test_ex_mode.vim
-new file mode 100644
-index 0000000..00a35a3
---- /dev/null
-+++ b/src/testdir/test_ex_mode.vim
-@@ -0,0 +1,54 @@
-+" Test editing line in Ex mode (see :help Q and :help gQ).
-+
-+" Helper function to test editing line in Q Ex mode
-+func Ex_Q(cmd)
-+ " Is there a simpler way to test editing Ex line?
-+ call feedkeys("Q"
-+ \ .. "let s:test_ex =<< END\<CR>"
-+ \ .. a:cmd .. "\<CR>"
-+ \ .. "END\<CR>"
-+ \ .. "visual\<CR>", 'tx')
-+ return s:test_ex0
-+endfunc
-+
-+" Helper function to test editing line in gQ Ex mode
-+func Ex_gQ(cmd)
-+ call feedkeys("gQ" .. a:cmd .. "\<C-b>\"\<CR>", 'tx')
-+ let ret = @:1: " Remove leading quote.
-+ call feedkeys("visual\<CR>", 'tx')
-+ return ret
-+endfunc
-+
-+" Helper function to test editing line with both Q and gQ Ex mode.
-+func Ex(cmd)
-+ return Ex_Q(a:cmd), Ex_gQ(a:cmd)
-+endfunc
-+
-+" Test editing line in Ex mode (both Q and gQ)
-+func Test_ex_mode()
-+ let encoding_save = &encoding
-+ set sw=2
-+
-+ for e in 'utf8', 'latin1'
-+ exe 'set encoding=' . e
-+
-+ call assert_equal('bar', 'bar', Ex("foo bar\<C-u>bar"), e)
-+ call assert_equal("1\<C-u>2", "1\<C-u>2", Ex("1\<C-v>\<C-u>2"), e)
-+ call assert_equal("1\<C-b>2\<C-e>3", '213', Ex("1\<C-b>2\<C-e>3"), e)
-+ call assert_equal('0123', '2013', Ex("01\<Home>2\<End>3"), e)
-+ call assert_equal('0123', '0213', Ex("01\<Left>2\<Right>3"), e)
-+ call assert_equal('01234', '0342', Ex("012\<Left>\<Left>\<Insert>3\<Insert>4"), e)
-+ call assert_equal("foo bar\<C-w>", 'foo ', Ex("foo bar\<C-w>"), e)
-+ call assert_equal('foo', 'foo', Ex("fooba\<Del>\<Del>"), e)
-+ call assert_equal("foo\tbar", 'foobar', Ex("foo\<Tab>bar"), e)
-+ call assert_equal("abbrev\t", 'abbreviate', Ex("abbrev\<Tab>"), e)
-+ call assert_equal(' 1', "1\<C-t>\<C-t>", Ex("1\<C-t>\<C-t>"), e)
-+ call assert_equal(' 1', "1\<C-t>\<C-t>", Ex("1\<C-t>\<C-t>\<C-d>"), e)
-+ call assert_equal(' foo', ' foo', Ex(" foo\<C-d>"), e)
-+ call assert_equal('foo', ' foo0', Ex(" foo0\<C-d>"), e)
-+ call assert_equal('foo', ' foo^', Ex(" foo^\<C-d>"), e)
-+ endfor
-+
-+ set sw&
-+ let &encoding = encoding_save
-+endfunc
--- 
-2.27.0

_service:extract_file:backport-compilation-error-with-Ruby-3.0.patch Deleted

@@ -1,57 +0,0 @@
-From 9d20daffc296b9eb901fb14bdd83620ea55d440a Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Mon, 1 Feb 2021 19:31:47 +0100
-Subject: PATCH patch 8.2.2448: compilation error with Ruby 3.0
-
-Problem: Compilation error with Ruby 3.0.
-Solution: Adjust #ifdefs and declaration. (Ken Takata, closes #7761)
----
- src/if_ruby.c | 10 +++++++---
- 1 file changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/src/if_ruby.c b/src/if_ruby.c
-index d21a655..6522d07 100644
---- a/src/if_ruby.c
-+++ b/src/if_ruby.c
-@@ -416,7 +416,7 @@ static VALUE (*dll_rb_hash_new) (void);
- static VALUE (*dll_rb_inspect) (VALUE);
- static VALUE (*dll_rb_int2inum) (long);
- static ID (*dll_rb_intern) (const char*);
--# if VIM_SIZEOF_INT < VIM_SIZEOF_LONG // 64 bits only
-+# if RUBY_VERSION >= 30 || VIM_SIZEOF_INT < VIM_SIZEOF_LONG
- static long (*dll_rb_fix2int) (VALUE);
- static long (*dll_rb_num2int) (VALUE);
- static unsigned long (*dll_rb_num2uint) (VALUE);
-@@ -504,7 +504,11 @@ static void (*dll_rb_gc_writebarrier_unprotect)(VALUE obj);
- # endif
- 
- # if RUBY_VERSION >= 30
-+# ifdef _MSC_VER
-+static void (*dll_ruby_malloc_size_overflow)(size_t, size_t);
-+# else
- NORETURN(static void (*dll_ruby_malloc_size_overflow)(size_t, size_t));
-+# endif
- # endif
- 
- # if RUBY_VERSION >= 26
-@@ -534,7 +538,7 @@ rb_int2big_stub(SIGNED_VALUE x)
- {
- return dll_rb_int2big(x);
- }
--# if VIM_SIZEOF_INT < VIM_SIZEOF_LONG
-+# if RUBY_VERSION >= 30 || VIM_SIZEOF_INT < VIM_SIZEOF_LONG
- long
- rb_fix2int_stub(VALUE x)
- {
-@@ -673,7 +677,7 @@ static struct
- {"rb_inspect", (RUBY_PROC*)&dll_rb_inspect},
- {"rb_int2inum", (RUBY_PROC*)&dll_rb_int2inum},
- {"rb_intern", (RUBY_PROC*)&dll_rb_intern},
--# if VIM_SIZEOF_INT < VIM_SIZEOF_LONG // 64 bits only
-+# if RUBY_VERSION >= 30 || VIM_SIZEOF_INT < VIM_SIZEOF_LONG
- {"rb_fix2int", (RUBY_PROC*)&dll_rb_fix2int},
- {"rb_num2int", (RUBY_PROC*)&dll_rb_num2int},
- {"rb_num2uint", (RUBY_PROC*)&dll_rb_num2uint},
--- 
-2.13.7
-

_service:extract_file:backport-configure-cannot-detect-Python-3.10.patch Deleted

@@ -1,38 +0,0 @@
-From 23c0192166760b0d73bd39252ca72e3cfe596f6e Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Fri, 21 May 2021 11:43:58 +0200
-Subject: PATCH patch 8.2.2876: configure cannot detect Python 3.10
-
-Problem: Configure cannot detect Python 3.10.
-Solution: Use sys.version_info. (closes #8233)
----
- src/auto/configure | 2 +-
- src/configure.ac | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/auto/configure b/src/auto/configure
-index 0b423a65775..5702a217188 100755
---- a/src/auto/configure
-+++ b/src/auto/configure
-@@ -6673,7 +6673,7 @@ if ${vi_cv_var_python3_version+:} false; then :
- $as_echo_n "(cached) " >&6
- else
- vi_cv_var_python3_version=`
-- ${vi_cv_path_python3} -c 'import sys; print(sys.version:3)'`
-+ ${vi_cv_path_python3} -c 'import sys; print("{}.{}".format(sys.version_info.major, sys.version_info.minor))'`
- 
- fi
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $vi_cv_var_python3_version" >&5
-diff --git a/src/configure.ac b/src/configure.ac
-index cc8d61f7f8b..2db04496ff1 100644
---- a/src/configure.ac
-+++ b/src/configure.ac
-@@ -1436,7 +1436,7 @@ if test "$enable_python3interp" = "yes" -o "$enable_python3interp" = "dynamic";
- dnl -- get its version number
- AC_CACHE_CHECK(Python version,vi_cv_var_python3_version,
- vi_cv_var_python3_version=`
-- ${vi_cv_path_python3} -c 'import sys; print(sys.version:3)'`
-+ ${vi_cv_path_python3} -c 'import sys; print("{}.{}".format(sys.version_info.major, sys.version_info.minor))'`
- )
- 
- dnl -- it must be at least version 3

_service:extract_file:backport-crash-when-pasting-too-many-times.patch Deleted

@@ -1,67 +0,0 @@
-From eeed1c7ae090c17f4df51cf97b2a9e4d8b4f4dc7 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sun, 10 Oct 2021 12:35:17 +0100
-Subject: PATCH patch 8.2.3492: crash when pasting too many times
-
-Problem: Crash when pasting too many times.
-Solution: Limit the size to what fits in an int. (closes #8962)
-
----
- src/globals.h | 1 +
- src/register.c | 11 +++++++++--
- src/testdir/test_put.vim | 8 ++++++++
- 3 files changed, 18 insertions(+), 2 deletions(-)
-
-diff --git a/src/globals.h b/src/globals.h
-index fee8c7f..7be3bfd 100644
---- a/src/globals.h
-+++ b/src/globals.h
-@@ -1659,6 +1659,7 @@ EXTERN char e_menuothermode	INIT(= N_("E328: Menu only exists in another mode"
- #endif
- EXTERN char e_invalwindow	INIT(= N_("E957: Invalid window number"));
- EXTERN char e_listarg		INIT(= N_("E686: Argument of %s must be a List"));
-+EXTERN char e_resulting_text_too_long		INIT(= N_("E1240: Resulting text too long"));
- 
- #ifdef FEAT_GUI_MAC
- EXTERN short disallow_gui	INIT(= FALSE);
-diff --git a/src/register.c b/src/register.c
-index 24e4b99..bab27fe 100644
---- a/src/register.c
-+++ b/src/register.c
-@@ -1908,8 +1908,15 @@ do_put(
- 	 }
- 
- 	 do {
--		totlen = count * yanklen;
--		if (totlen > 0)
-+		long multlen = count * yanklen;
-+
-+		totlen = multlen;
-+		if (totlen != multlen)
-+		{
-+		 emsg(_(e_resulting_text_too_long));
-+		 break;
-+		}
-+		else if (totlen > 0)
- 		{
- 		 oldp = ml_get(lnum);
- 		 if (VIsual_active && col > (int)STRLEN(oldp))
-diff --git a/src/testdir/test_put.vim b/src/testdir/test_put.vim
-index f5037dc..42bb7e6 100644
---- a/src/testdir/test_put.vim
-+++ b/src/testdir/test_put.vim
-@@ -122,3 +122,11 @@ func Test_put_above_first_line()
- call assert_equal('text', getline(1))
- bwipe!
- endfunc
-+
-+func Test_very_larg_count()
-+ new
-+ let @" = 'x'
-+ call assert_fails('norm 44444444444444p', 'E1240:')
-+ bwipe!
-+endfunc
-+
--- 
-2.27.0
-

_service:extract_file:backport-find-test-fails.patch Deleted

_service:extract_file:backport-fix-arglist-test-fails.patch Deleted

@@ -1,50 +0,0 @@
-From 679140c56bbabf12a199d94f584b1b9dfc9809fd Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Fri, 24 Dec 2021 18:58:46 +0000
-Subject: PATCH patch 8.2.3885: arglist test fails
-Conflict:Abridged some of the notes
-Reference:https://github.com/vim/vim/commit/679140c56bbabf12a199d94f584b1b9dfc9809fd
-
-Problem: Arglist test fails.
-Solution: Adjust for locking the arglist for ":all".
-
----
- src/testdir/test_arglist.vim | 13 ++++++-------
- 1 file changed, 6 insertions(+), 7 deletions(-)
-
-diff --git a/src/testdir/test_arglist.vim b/src/testdir/test_arglist.vim
-index 7ebe8a2..e5a5e89 100644
---- a/src/testdir/test_arglist.vim
-+++ b/src/testdir/test_arglist.vim
-@@ -470,15 +470,14 @@ func Test_arglist_autocmd()
- new
- " redefine arglist; go to Xxx1
- next! Xxx1 Xxx2 Xxx3
-- " open window for all args
-- all
-+ " open window for all args; Reading Xxx2 will try to change the arglist and
-+ " that will fail
-+ call assert_fails("all", "E1156:")
- call assert_equal('test file Xxx1', getline(1))
- wincmd w
-- wincmd w
-- call assert_equal('test file Xxx1', getline(1))
-- " should now be in Xxx2
-- rewind
- call assert_equal('test file Xxx2', getline(1))
-+ wincmd w
-+ call assert_equal('test file Xxx3', getline(1))
- 
- autocmd! BufReadPost Xxx2
- enew! | only
-@@ -515,6 +514,6 @@ endfunc
- func Test_clear_arglist_in_all()
- n 0 00 000 0000 00000 000000
- au! * 0 n 0
-- all
-+ call assert_fails("all", "E1156")
- au! *
- endfunc
--- 
-2.27.0
-

_service:extract_file:backport-fix-giving-the-error-0-more-files-to-edit.patch Deleted

@@ -1,94 +0,0 @@
-From 7b22117c4ecf383b6f35acef041773a83ec28220 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Mon, 17 Aug 2020 19:34:10 +0200
-Subject: PATCH patch 8.2.1472: ":argdel" does not work like ":.argdel" as
- documented
-Conflict:NA
-Reference:https://github.com/vim/vim/commit/7b22117c4ecf383b6f35acef041773a83ec28220
-
-Problem: ":argdel" does not work like ":.argdel" as documented. (Alexey
- Demin)
-Solution: Make ":argdel" work like ":.argdel". (closes #6727)
- Also fix giving the error "0 more files to edit".
-
----
- src/arglist.c | 18 +++++++++++++-----
- src/ex_docmd.c | 2 +-
- src/testdir/test_arglist.vim | 10 ++++++++--
- 3 files changed, 22 insertions(+), 8 deletions(-)
-
-diff --git a/src/arglist.c b/src/arglist.c
-index b1a6a0b..cab74f8 100644
---- a/src/arglist.c
-+++ b/src/arglist.c
-@@ -776,10 +776,20 @@ ex_argdelete(exarg_T *eap)
- int		i;
- int		n;
- 
-- if (eap->addr_count > 0)
-+ if (eap->addr_count > 0 || *eap->arg == NUL)
- {
--	// ":1,4argdel": Delete all arguments in the range.
--	if (eap->line2 > ARGCOUNT)
-+	// ":argdel" works like ":argdel"
-+	if (eap->addr_count == 0)
-+	{
-+	 if (curwin->w_arg_idx >= ARGCOUNT)
-+	 {
-+		emsg(_("E610: No argument to delete"));
-+		return;
-+	 }
-+	 eap->line1 = eap->line2 = curwin->w_arg_idx + 1;
-+	}
-+	else if (eap->line2 > ARGCOUNT)
-+	 // ":1,4argdel": Delete all arguments in the range.
- 	 eap->line2 = ARGCOUNT;
- 	n = eap->line2 - eap->line1 + 1;
- 	if (*eap->arg != NUL)
-@@ -808,8 +818,6 @@ ex_argdelete(exarg_T *eap)
- 		curwin->w_arg_idx = ARGCOUNT - 1;
- 	}
- }
-- else if (*eap->arg == NUL)
--	emsg(_(e_argreq));
- else
- 	do_arglist(eap->arg, AL_DEL, 0, FALSE);
- #ifdef FEAT_TITLE
-diff --git a/src/ex_docmd.c b/src/ex_docmd.c
-index cb6b64a..dfcbf37 100644
---- a/src/ex_docmd.c
-+++ b/src/ex_docmd.c
-@@ -4719,7 +4719,7 @@ check_more(
- int	 n = ARGCOUNT - curwin->w_arg_idx - 1;
- 
- if (!forceit && only_one_window()
--	 && ARGCOUNT > 1 && !arg_had_last && n >= 0 && quitmore == 0)
-+	 && ARGCOUNT > 1 && !arg_had_last && n > 0 && quitmore == 0)
- {
- 	if (message)
- 	{
-diff --git a/src/testdir/test_arglist.vim b/src/testdir/test_arglist.vim
-index c486b18..3e1e175 100644
---- a/src/testdir/test_arglist.vim
-+++ b/src/testdir/test_arglist.vim
-@@ -416,9 +416,15 @@ func Test_argdelete()
- last
- argdelete %
- call assert_equal('b', argv())
-- call assert_fails('argdelete', 'E471:')
-+ call assert_fails('argdelete', 'E610:')
- call assert_fails('1,100argdelete', 'E16:')
-- %argd
-+
-+ call Reset_arglist()
-+ args a b c d
-+ next
-+ argdel
-+ call Assert_argc('a', 'c', 'd')
-+ %argdel
- endfunc
- 
- func Test_argdelete_completion()
--- 
-2.27.0
-

_service:extract_file:backport-html-text-objects-are-not-fully-tested.patch Deleted

@@ -1,164 +0,0 @@
-From af631f61bc42d0dddafe1bc0c06872cf3aaeb239 Mon Sep 17 00:00:00 2001
-From: Dominique Pelle <dominique.pelle@gmail.com>
-Date: Fri, 3 Sep 2021 16:50:16 +0200
-Subject: PATCH patch 8.2.3398: html text objects are not fully tested
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Problem: Html text objects are not fully tested.
-Solution: Add tests for dbcs encoding and different number of backslashes.
-(Dominique Pellé, closes #8831)
----
- src/testdir/test_textobjects.vim | 135 ++++++++++++++++++++-------------------
- 1 file changed, 70 insertions(+), 65 deletions(-)
-
-diff --git a/src/testdir/test_textobjects.vim b/src/testdir/test_textobjects.vim
-index 042c534..49fc9c8 100644
---- a/src/testdir/test_textobjects.vim
-+++ b/src/testdir/test_textobjects.vim
-@@ -88,71 +88,76 @@ endfunc
- 
- " Tests for string and html text objects
- func Test_string_html_objects()
-- enew!
--
-- let t = '"wo\"rd\\" foo'
-- put =t
-- normal! da"
-- call assert_equal('foo', getline('.'))
--
-- let t = "'foo' 'bar' 'piep'"
-- put =t
-- normal! 0va'a'rx
-- call assert_equal("xxxxxxxxxxxx'piep'", getline('.'))
--
-- let t = "bla bla `quote` blah"
-- put =t
-- normal! 02f`da`
-- call assert_equal("bla bla blah", getline('.'))
--
-- let t = 'out " in "noXno"'
-- put =t
-- normal! 0fXdi"
-- call assert_equal('out " in ""', getline('.'))
--
-- let t = "\"'\" 'blah' rep 'buh'"
-- put =t
-- normal! 03f'vi'ry
-- call assert_equal("\"'\" 'blah'yyyyy'buh'", getline('.'))
--
-- set quoteescape=+*-
-- let t = "bla `s*`d-`+++`l**` b`la"
-- put =t
-- normal! di`
-- call assert_equal("bla `` b`la", getline('.'))
--
-- let t = 'voo "nah" sdf " asdf" sdf " sdf" sd'
-- put =t
-- normal! $F"va"oha"i"rz
-- call assert_equal('voo "zzzzzzzzzzzzzzzzzzzzzzzzzzzzsd', getline('.'))
--
-- let t = "-asdfXasdfasdf-"
-- put =t
-- normal! fXdit
-- call assert_equal('-asdfasdf-', getline('.'))
--
-- let t = "-asdXasdfasdf-"
-- put =t
-- normal! 0fXdit
-- call assert_equal('--', getline('.'))
--
-- let t = "-asdfXasdfasdf-"
-- put =t
-- normal! fXdat
-- call assert_equal('-asdfasdf-', getline('.'))
--
-- let t = "-asdXasdfasdf-"
-- put =t
-- normal! 0fXdat
-- call assert_equal('--', getline('.'))
--
-- let t = "-\ninnertext object\n"
-- put =t
-- normal! dit
-- call assert_equal('-', getline('.'))
--
-- set quoteescape&
-- enew!
-+ for e in 'utf-8', 'latin1', 'cp932'
-+ enew!
-+ exe 'set enc=' .. e
-+
-+ let t = '"wo\"rd\\" foo'
-+ put =t
-+ normal! da"
-+ call assert_equal('foo', getline('.'), e)
-+
-+ let t = "'foo' 'bar' 'piep'"
-+ put =t
-+ normal! 0va'a'rx
-+ call assert_equal("xxxxxxxxxxxx'piep'", getline('.'), e)
-+
-+ let t = "bla bla `quote` blah"
-+ put =t
-+ normal! 02f`da`
-+ call assert_equal("bla bla blah", getline('.'), e)
-+
-+ let t = 'out " in "noXno"'
-+ put =t
-+ normal! 0fXdi"
-+ call assert_equal('out " in ""', getline('.'), e)
-+
-+ let t = "\"'\" 'blah' rep 'buh'"
-+ put =t
-+ normal! 03f'vi'ry
-+ call assert_equal("\"'\" 'blah'yyyyy'buh'", getline('.'), e)
-+
-+ set quoteescape=+*-
-+ let t = "bla `s*`d-`+++`l**` b`la"
-+ put =t
-+ normal! di`
-+ call assert_equal("bla `` b`la", getline('.'), e)
-+
-+ let t = 'voo "nah" sdf " asdf" sdf " sdf" sd'
-+ put =t
-+ normal! $F"va"oha"i"rz
-+ call assert_equal('voo "zzzzzzzzzzzzzzzzzzzzzzzzzzzzsd', getline('.'), e)
-+
-+ let t = "-asdfXasdfasdf-"
-+ put =t
-+ normal! fXdit
-+ call assert_equal('-asdfasdf-', getline('.'), e)
-+
-+ let t = "-asdXasdfasdf-"
-+ put =t
-+ normal! 0fXdit
-+ call assert_equal('--', getline('.'), e)
-+
-+ let t = "-asdfXasdfasdf-"
-+ put =t
-+ normal! fXdat
-+ call assert_equal('-asdfasdf-', getline('.'), e)
-+
-+ let t = "-asdXasdfasdf-"
-+ put =t
-+ normal! 0fXdat
-+ call assert_equal('--', getline('.'), e)
-+
-+ let t = "-\ninnertext object\n"
-+ put =t
-+ normal! dit
-+ call assert_equal('-', getline('.'), e)
-+
-+ set quoteescape&
-+ endfor
-+
-+ set enc=utf-8
-+ bwipe!
- endfunc
- 
- func Test_empty_html_tag()
--- 
-1.8.3.1
-

_service:extract_file:backport-insufficient-code-coverage-for-ex_docmd.c_functions.patch Deleted

@@ -1,109 +0,0 @@
-From 9f6277bdde97b7767ded43a0b5a2023eb601b3b7 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 11 Feb 2020 22:04:02 +0100
-Subject: PATCH patch 8.2.0243: insufficient code coverage for ex_docmd.c
- functions
-
-Problem: Insufficient code coverage for ex_docmd.c functions.
-Solution: Add more tests. (Yegappan Lakshmanan, closes #5618)
----
- src/testdir/Make_all.mak | 2 ++
- src/testdir/test_buffer.vim | 66 +++++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 68 insertions(+)
- create mode 100644 src/testdir/test_buffer.vim
-
-diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
-index 05e7a2c..e608b92 100644
---- a/src/testdir/Make_all.mak
-+++ b/src/testdir/Make_all.mak
-@@ -65,6 +65,7 @@ NEW_TESTS = \
- 	test_blob \
- 	test_blockedit \
- 	test_breakindent \
-+	test_buffer \
- 	test_bufline \
- 	test_bufwintabinfo \
- 	test_cd \
-@@ -307,6 +308,7 @@ NEW_TESTS_RES = \
- 	test_blob.res \
- 	test_blockedit.res \
- 	test_breakindent.res \
-+ test_buffer.res \
- 	test_bufwintabinfo.res \
- 	test_cdo.res \
- 	test_changelist.res \
-diff --git a/src/testdir/test_buffer.vim b/src/testdir/test_buffer.vim
-new file mode 100644
-index 0000000..dc35bb4
---- /dev/null
-+++ b/src/testdir/test_buffer.vim
-@@ -0,0 +1,66 @@
-+" Tests for Vim buffer
-+
-+" Test for the :bunload command with an offset
-+func Test_bunload_with_offset()
-+ %bwipe!
-+ call writefile('B1', 'b1')
-+ call writefile('B2', 'b2')
-+ call writefile('B3', 'b3')
-+ call writefile('B4', 'b4')
-+
-+ " Load four buffers. Unload the second and third buffers and then
-+ " execute .+3bunload to unload the last buffer.
-+ edit b1
-+ new b2
-+ new b3
-+ new b4
-+
-+ bunload b2
-+ bunload b3
-+ exe bufwinnr('b1') . 'wincmd w'
-+ .+3bunload
-+ call assert_equal(0, getbufinfo('b4')0.loaded)
-+ call assert_equal('b1',
-+ \ fnamemodify(getbufinfo({'bufloaded' : 1})0.name, ':t'))
-+
-+ " Load four buffers. Unload the third and fourth buffers. Execute .+3bunload
-+ " and check whether the second buffer is unloaded.
-+ ball
-+ bunload b3
-+ bunload b4
-+ exe bufwinnr('b1') . 'wincmd w'
-+ .+3bunload
-+ call assert_equal(0, getbufinfo('b2')0.loaded)
-+ call assert_equal('b1',
-+ \ fnamemodify(getbufinfo({'bufloaded' : 1})0.name, ':t'))
-+
-+ " Load four buffers. Unload the second and third buffers and from the last
-+ " buffer execute .-3bunload to unload the first buffer.
-+ ball
-+ bunload b2
-+ bunload b3
-+ exe bufwinnr('b4') . 'wincmd w'
-+ .-3bunload
-+ call assert_equal(0, getbufinfo('b1')0.loaded)
-+ call assert_equal('b4',
-+ \ fnamemodify(getbufinfo({'bufloaded' : 1})0.name, ':t'))
-+
-+ " Load four buffers. Unload the first and second buffers. Execute .-3bunload
-+ " from the last buffer and check whether the third buffer is unloaded.
-+ ball
-+ bunload b1
-+ bunload b2
-+ exe bufwinnr('b4') . 'wincmd w'
-+ .-3bunload
-+ call assert_equal(0, getbufinfo('b3')0.loaded)
-+ call assert_equal('b4',
-+ \ fnamemodify(getbufinfo({'bufloaded' : 1})0.name, ':t'))
-+
-+ %bwipe!
-+ call delete('b1')
-+ call delete('b2')
-+ call delete('b3')
-+ call delete('b4')
-+endfunc
-+
-+" vim: shiftwidth=2 sts=2 expandtab
--- 
-1.8.3.1
-

_service:extract_file:backport-invalid-argument-errmsg.patch Deleted

@@ -1,27 +0,0 @@
-From 436b5adc9770a2568209dd5ab1f98bd1afc91898 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Fri, 31 Dec 2021 22:49:24 +0000
-Subject: PATCH patch 8.2.3961: error messages are spread out
-
-Problem: Error messages are spread out.
-Solution: Move more errors to errors.h.
-
----
- src/globals.h | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/globals.h b/src/globals.h
-index 75092b7..45d9111 100644
---- a/src/globals.h
-+++ b/src/globals.h
-@@ -1453,6 +1453,7 @@ EXTERN char e_abort		INIT(= N_("E470: Command aborted"));
- EXTERN char e_argreq	INIT(= N_("E471: Argument required"));
- EXTERN char e_cannot_change_arglist_recursively INIT(= N_("E1156: Cannot change the argument list recursively"));
- EXTERN char e_backslash	INIT(= N_("E10: \\ should be followed by /, ? or &"));
-+EXTERN char e_invalid_argument	INIT(= N_("E474: Invalid argument"));
- #ifdef FEAT_CMDWIN
- EXTERN char e_cmdwin	INIT(= N_("E11: Invalid in command-line window; <CR> executes, CTRL-C quits"));
- #endif
--- 
-2.27.0
-

_service:extract_file:backport-linker-errors-when-building-with-dynamic-Python-3.9.patch Deleted

@@ -1,136 +0,0 @@
-From ee1b93169d21896e5401a54a5189c9465abb7bc9 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 16 Jul 2020 22:15:53 +0200
-Subject: PATCH patch 8.2.1225: linker errors when building with dynamic
- Python 3.9
-
-Problem: Linker errors when building with dynamic Python 3.9.
-Solution: Add #defined items. (closes #6461)
----
- src/if_python3.c | 40 +++++++++++++++++++++++++++++++++++++---
- 1 file changed, 37 insertions(+), 3 deletions(-)
-
-diff --git a/src/if_python3.c b/src/if_python3.c
-index 68da288..45dc308 100644
---- a/src/if_python3.c
-+++ b/src/if_python3.c
-@@ -203,6 +203,9 @@ typedef PySliceObject PySliceObject_T;
- # define PySys_GetObject py3_PySys_GetObject
- # define PySys_SetArgv py3_PySys_SetArgv
- # define PyType_Ready py3_PyType_Ready
-+# if PY_VERSION_HEX >= 0x030900b0
-+# define PyType_GetFlags py3_PyType_GetFlags
-+# endif
- #undef Py_BuildValue
- # define Py_BuildValue py3_Py_BuildValue
- # define Py_SetPythonHome py3_Py_SetPythonHome
-@@ -233,6 +236,9 @@ typedef PySliceObject PySliceObject_T;
- # define PyBytes_FromString py3_PyBytes_FromString
- # undef PyBytes_FromStringAndSize
- # define PyBytes_FromStringAndSize py3_PyBytes_FromStringAndSize
-+# if defined(Py_DEBUG) || PY_VERSION_HEX >= 0x030900b0
-+# define _Py_Dealloc py3__Py_Dealloc
-+# endif
- # define PyFloat_FromDouble py3_PyFloat_FromDouble
- # define PyFloat_AsDouble py3_PyFloat_AsDouble
- # define PyObject_GenericGetAttr py3_PyObject_GenericGetAttr
-@@ -247,7 +253,6 @@ typedef PySliceObject PySliceObject_T;
- # ifdef Py_DEBUG
- # define _Py_NegativeRefcount py3__Py_NegativeRefcount
- # define _Py_RefTotal (*py3__Py_RefTotal)
--# define _Py_Dealloc py3__Py_Dealloc
- # define PyModule_Create2TraceRefs py3_PyModule_Create2TraceRefs
- # else
- # define PyModule_Create2 py3_PyModule_Create2
-@@ -287,6 +292,10 @@ typedef PySliceObject PySliceObject_T;
- # define PyObject_NEW(type, typeobj) \
- ( (type *) PyObject_Init( \
- 	(PyObject *) _PyObject_DebugMalloc( _PyObject_SIZE(typeobj) ), (typeobj)) )
-+# elif PY_VERSION_HEX >= 0x030900b0
-+# undef PyObject_NEW
-+# define PyObject_NEW(type, typeobj) \
-+	((type *)py3__PyObject_New(typeobj))
- # endif
- 
- /*
-@@ -352,6 +361,9 @@ static PyObject* (*py3_PyObject_Repr)(PyObject *);
- static PyObject* (*py3_PyObject_GetItem)(PyObject *, PyObject *);
- static int (*py3_PyObject_IsTrue)(PyObject *);
- static PyObject* (*py3_Py_BuildValue)(char *, ...);
-+# if PY_VERSION_HEX >= 0x030900b0
-+static int (*py3_PyType_GetFlags)(PyTypeObject *o);
-+# endif
- static int (*py3_PyType_Ready)(PyTypeObject *type);
- static int (*py3_PyDict_SetItemString)(PyObject *dp, char *key, PyObject *item);
- static PyObject* (*py3_PyUnicode_FromString)(const char *u);
-@@ -396,6 +408,12 @@ static char* (*py3_PyBytes_AsString)(PyObject *bytes);
- static int (*py3_PyBytes_AsStringAndSize)(PyObject *bytes, char **buffer, Py_ssize_t *length);
- static PyObject* (*py3_PyBytes_FromString)(char *str);
- static PyObject* (*py3_PyBytes_FromStringAndSize)(char *str, Py_ssize_t length);
-+# if defined(Py_DEBUG) || PY_VERSION_HEX >= 0x030900b0
-+static void (*py3__Py_Dealloc)(PyObject *obj);
-+# endif
-+# if PY_VERSION_HEX >= 0x030900b0
-+static PyObject* (*py3__PyObject_New)(PyTypeObject *);
-+# endif
- static PyObject* (*py3_PyFloat_FromDouble)(double num);
- static double (*py3_PyFloat_AsDouble)(PyObject *);
- static PyObject* (*py3_PyObject_GenericGetAttr)(PyObject *obj, PyObject *name);
-@@ -414,7 +432,6 @@ static void* (*py3_PyCapsule_GetPointer)(PyObject *, char *);
- # ifdef Py_DEBUG
- static void (*py3__Py_NegativeRefcount)(const char *fname, int lineno, PyObject *op);
- static Py_ssize_t* py3__Py_RefTotal;
--static void (*py3__Py_Dealloc)(PyObject *obj);
- static PyObject* (*py3_PyModule_Create2TraceRefs)(struct PyModuleDef* module, int module_api_version);
- # else
- static PyObject* (*py3_PyModule_Create2)(struct PyModuleDef* module, int module_api_version);
-@@ -525,6 +542,9 @@ static struct
- {"PyObject_IsTrue", (PYTHON_PROC*)&py3_PyObject_IsTrue},
- {"PyLong_FromLong", (PYTHON_PROC*)&py3_PyLong_FromLong},
- {"PyDict_New", (PYTHON_PROC*)&py3_PyDict_New},
-+# if PY_VERSION_HEX >= 0x030900b0
-+ {"PyType_GetFlags", (PYTHON_PROC*)&py3_PyType_GetFlags},
-+# endif
- {"PyType_Ready", (PYTHON_PROC*)&py3_PyType_Ready},
- {"PyDict_SetItemString", (PYTHON_PROC*)&py3_PyDict_SetItemString},
- {"PyLong_AsLong", (PYTHON_PROC*)&py3_PyLong_AsLong},
-@@ -562,6 +582,12 @@ static struct
- {"PyBytes_AsStringAndSize", (PYTHON_PROC*)&py3_PyBytes_AsStringAndSize},
- {"PyBytes_FromString", (PYTHON_PROC*)&py3_PyBytes_FromString},
- {"PyBytes_FromStringAndSize", (PYTHON_PROC*)&py3_PyBytes_FromStringAndSize},
-+# if defined(Py_DEBUG) || PY_VERSION_HEX >= 0x030900b0
-+ {"_Py_Dealloc", (PYTHON_PROC*)&py3__Py_Dealloc},
-+# endif
-+# if PY_VERSION_HEX >= 0x030900b0
-+ {"_PyObject_New", (PYTHON_PROC*)&py3__PyObject_New},
-+# endif
- {"PyFloat_FromDouble", (PYTHON_PROC*)&py3_PyFloat_FromDouble},
- {"PyFloat_AsDouble", (PYTHON_PROC*)&py3_PyFloat_AsDouble},
- {"PyObject_GenericGetAttr", (PYTHON_PROC*)&py3_PyObject_GenericGetAttr},
-@@ -578,7 +604,6 @@ static struct
- # ifdef Py_DEBUG
- {"_Py_NegativeRefcount", (PYTHON_PROC*)&py3__Py_NegativeRefcount},
- {"_Py_RefTotal", (PYTHON_PROC*)&py3__Py_RefTotal},
-- {"_Py_Dealloc", (PYTHON_PROC*)&py3__Py_Dealloc},
- {"PyModule_Create2TraceRefs", (PYTHON_PROC*)&py3_PyModule_Create2TraceRefs},
- # else
- {"PyModule_Create2", (PYTHON_PROC*)&py3_PyModule_Create2},
-@@ -634,6 +659,15 @@ py3__Py_XDECREF(PyObject *op)
- # define Py_XDECREF(op) py3__Py_XDECREF(_PyObject_CAST(op))
- # endif
- 
-+# if PY_VERSION_HEX >= 0x030900b0
-+ static inline int
-+py3_PyType_HasFeature(PyTypeObject *type, unsigned long feature)
-+{
-+ return ((PyType_GetFlags(type) & feature) != 0);
-+}
-+# define PyType_HasFeature(t,f) py3_PyType_HasFeature(t,f)
-+# endif
-+
- /*
- * Free python.dll
- */
--- 
-1.8.3.1
-

_service:extract_file:backport-linker-errors-with-dynamic-Python-3.10.patch Deleted

@@ -1,65 +0,0 @@
-From 90478f35a8c78e2e10a4b4a8f135998dc04c91fa Mon Sep 17 00:00:00 2001
-From: Zdenek Dohnal <zdohnal@redhat.com>
-Date: Mon, 14 Jun 2021 15:08:30 +0200
-Subject: PATCH patch 8.2.2995: linker errors with dynamic Python 3.10
-
-Problem: Linker errors with dynamic Python 3.10.
-Solution: Add a couple of library entries. (Zdenek Dohnal, closes #8381,
-closes #8356)
----
- src/if_python3.c | 18 ++++++++++++++++++
- 1 file changed, 18 insertions(+)
-
-diff --git a/src/if_python3.c b/src/if_python3.c
-index 7c9e140..72c9e9b 100644
---- a/src/if_python3.c
-+++ b/src/if_python3.c
-@@ -181,6 +181,9 @@ typedef PySliceObject PySliceObject_T;
- # ifndef PyMapping_Keys
- # define PyMapping_Keys py3_PyMapping_Keys
- # endif
-+# if PY_VERSION_HEX >= 0x030a00b2
-+# define PyIter_Check py3_PyIter_Check
-+# endif
- # define PyIter_Next py3_PyIter_Next
- # define PyObject_GetIter py3_PyObject_GetIter
- # define PyObject_Repr py3_PyObject_Repr
-@@ -355,6 +358,9 @@ static PyObject* (*py3_PyDict_GetItemString)(PyObject *, const char *);
- static int (*py3_PyDict_Next)(PyObject *, Py_ssize_t *, PyObject **, PyObject **);
- static PyObject* (*py3_PyLong_FromLong)(long);
- static PyObject* (*py3_PyDict_New)(void);
-+# if PY_VERSION_HEX >= 0x030a00b2
-+static int (*py3_PyIter_Check)(PyObject *o);
-+# endif
- static PyObject* (*py3_PyIter_Next)(PyObject *);
- static PyObject* (*py3_PyObject_GetIter)(PyObject *);
- static PyObject* (*py3_PyObject_Repr)(PyObject *);
-@@ -535,6 +541,9 @@ static struct
- {"PyDict_Next", (PYTHON_PROC*)&py3_PyDict_Next},
- {"PyMapping_Check", (PYTHON_PROC*)&py3_PyMapping_Check},
- {"PyMapping_Keys", (PYTHON_PROC*)&py3_PyMapping_Keys},
-+# if PY_VERSION_HEX >= 0x030a00b2
-+ {"PyIter_Check", (PYTHON_PROC*)&py3_PyIter_Check},
-+# endif
- {"PyIter_Next", (PYTHON_PROC*)&py3_PyIter_Next},
- {"PyObject_GetIter", (PYTHON_PROC*)&py3_PyObject_GetIter},
- {"PyObject_Repr", (PYTHON_PROC*)&py3_PyObject_Repr},
-@@ -668,6 +677,15 @@ py3_PyType_HasFeature(PyTypeObject *type, unsigned long feature)
- # define PyType_HasFeature(t,f) py3_PyType_HasFeature(t,f)
- # endif
- 
-+# if PY_VERSION_HEX >= 0x030a00b2
-+ static inline int
-+py3__PyObject_TypeCheck(PyObject *ob, PyTypeObject *type)
-+{
-+ return Py_IS_TYPE(ob, type) || PyType_IsSubtype(Py_TYPE(ob), type);
-+}
-+# define _PyObject_TypeCheck(o,t) py3__PyObject_TypeCheck(o,t)
-+# endif
-+
- /*
- * Free python.dll
- */
--- 
-1.8.3.1
-

_service:extract_file:backport-macros-for-Ruby-are-too-complicated.patch Deleted

@@ -1,642 +0,0 @@
-From 41a4141ecb36cd871c6e87f6fbc12fa81653b6be Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 7 Jan 2020 21:32:19 +0100
-Subject: PATCH patch 8.2.0100: macros for Ruby are too complicated
-
-Problem: Macros for Ruby are too complicated.
-Solution: Do not use DYNAMIC_RUBY_VER, use RUBY_VERSION. (Ken Takata,
- closes #5452)
----
- src/Make_cyg_ming.mak | 3 -
- src/Make_mvc.mak | 5 +-
- src/auto/configure | 2 +-
- src/configure.ac | 2 +-
- src/if_ruby.c | 164 +++++++++++++++++++++---------------------
- 5 files changed, 86 insertions(+), 90 deletions(-)
-
-diff --git a/src/Make_cyg_ming.mak b/src/Make_cyg_ming.mak
-index 3c878cbfb..f9c795bfe 100644
---- a/src/Make_cyg_ming.mak
-+++ b/src/Make_cyg_ming.mak
-@@ -569,11 +569,8 @@ ifdef RUBY
- CFLAGS += -DFEAT_RUBY $(RUBYINC)
- ifeq (yes, $(DYNAMIC_RUBY))
- CFLAGS += -DDYNAMIC_RUBY -DDYNAMIC_RUBY_DLL=\"$(RUBY_INSTALL_NAME).dll\"
--CFLAGS += -DDYNAMIC_RUBY_VER=$(RUBY_VER)
- endif
-- ifeq (no, $(DYNAMIC_RUBY))
- CFLAGS += -DRUBY_VERSION=$(RUBY_VER)
-- endif
- ifneq ($(findstring w64-mingw32,$(CC)),)
- # A workaround for MinGW-w64
- CFLAGS += -DHAVE_STRUCT_TIMESPEC -DHAVE_STRUCT_TIMEZONE
-diff --git a/src/Make_mvc.mak b/src/Make_mvc.mak
-index 8694f7496..eb7129614 100644
---- a/src/Make_mvc.mak
-+++ b/src/Make_mvc.mak
-@@ -1193,10 +1193,11 @@ RUBY_LIB = $(RUBY)\lib\$(RUBY_INSTALL_NAME).lib
- # Do we want to load Ruby dynamically?
- ! if "$(DYNAMIC_RUBY)" == "yes"
- ! message Ruby DLL will be loaded dynamically
--CFLAGS = $(CFLAGS) -DDYNAMIC_RUBY -DDYNAMIC_RUBY_VER=$(RUBY_VER) \
--		-DDYNAMIC_RUBY_DLL=\"$(RUBY_INSTALL_NAME).dll\" 
-+CFLAGS = $(CFLAGS) -DDYNAMIC_RUBY \
-+		-DDYNAMIC_RUBY_DLL=\"$(RUBY_INSTALL_NAME).dll\"
- ! undef RUBY_LIB
- ! endif
-+CFLAGS = $(CFLAGS) -DRUBY_VERSION=$(RUBY_VER)
- !endif # RUBY
- 
- #
-diff --git a/src/auto/configure b/src/auto/configure
-index 993049573..1b5094e97 100755
---- a/src/auto/configure
-+++ b/src/auto/configure
-@@ -7622,7 +7622,7 @@ $as_echo "$rubyhdrdir" >&6; }
- 	 fi
- 	 $as_echo "#define DYNAMIC_RUBY 1" >>confdefs.h
- 
--	 RUBY_CFLAGS="-DDYNAMIC_RUBY_DLL=\\\"$libruby_soname\\\" -DDYNAMIC_RUBY_VER=$rubyversion $RUBY_CFLAGS"
-+	 RUBY_CFLAGS="-DDYNAMIC_RUBY_DLL=\\\"$libruby_soname\\\" $RUBY_CFLAGS"
- 	 RUBY_LIBS=
- 	fi
- else
-diff --git a/src/configure.ac b/src/configure.ac
-index d440a465c..a098da82e 100644
---- a/src/configure.ac
-+++ b/src/configure.ac
-@@ -1966,7 +1966,7 @@ if test "$enable_rubyinterp" = "yes" -o "$enable_rubyinterp" = "dynamic"; then
- 	 libruby_soname=`$vi_cv_path_ruby -r rbconfig -e "puts $ruby_rbconfig::CONFIG'LIBRUBY_SO'"`
- 	 fi
- 	 AC_DEFINE(DYNAMIC_RUBY)
--	 RUBY_CFLAGS="-DDYNAMIC_RUBY_DLL=\\\"$libruby_soname\\\" -DDYNAMIC_RUBY_VER=$rubyversion $RUBY_CFLAGS"
-+	 RUBY_CFLAGS="-DDYNAMIC_RUBY_DLL=\\\"$libruby_soname\\\" $RUBY_CFLAGS"
- 	 RUBY_LIBS=
- 	fi
- else
-diff --git a/src/if_ruby.c b/src/if_ruby.c
-index 00783c8d7..68d55821f 100644
---- a/src/if_ruby.c
-+++ b/src/if_ruby.c
-@@ -20,7 +20,7 @@
- #include <string.h>
- 
- #ifdef _WIN32
--# if !defined(DYNAMIC_RUBY_VER) || (DYNAMIC_RUBY_VER < 18)
-+# if !defined(DYNAMIC_RUBY) || (RUBY_VERSION < 18)
- # define NT
- # endif
- # ifndef DYNAMIC_RUBY
-@@ -32,7 +32,7 @@
- # define RUBYEXTERN extern
- #endif
- 
--#if defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER >= 24
-+#if defined(DYNAMIC_RUBY) && RUBY_VERSION >= 24
- # define USE_RUBY_INTEGER
- #endif
- 
-@@ -47,14 +47,14 @@
- # if defined(USE_RUBY_INTEGER)
- # define rb_cInteger		(*dll_rb_cInteger)
- # endif
--# if defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER >= 20
-+# if RUBY_VERSION >= 20
- # define rb_cFloat		(*dll_rb_cFloat)
- # endif
- # define rb_cNilClass		(*dll_rb_cNilClass)
- # define rb_cString		(*dll_rb_cString)
- # define rb_cSymbol		(*dll_rb_cSymbol)
- # define rb_cTrueClass		(*dll_rb_cTrueClass)
--# if defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER >= 18
-+# if RUBY_VERSION >= 18
- /*
- * On ver 1.8, all Ruby functions are exported with "__declspec(dllimport)"
- * in ruby.h. But it causes trouble for these variables, because it is
-@@ -71,29 +71,14 @@
- # undef _WIN32_WINNT
- #endif
- 
--#if (defined(RUBY_VERSION) && RUBY_VERSION >= 19) \
-- || (defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER >= 19)
--# define RUBY19_OR_LATER 1
--#endif
--
--#if (defined(RUBY_VERSION) && RUBY_VERSION >= 20) \
-- || (defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER >= 20)
--# define RUBY20_OR_LATER 1
--#endif
--
--#if (defined(RUBY_VERSION) && RUBY_VERSION >= 21) \
-- || (defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER >= 21)
--# define RUBY21_OR_LATER 1
--#endif
--
--#if defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER >= 19
-+#if defined(DYNAMIC_RUBY) && RUBY_VERSION >= 19
- // Ruby 1.9 defines a number of static functions which use rb_num2long and
- // rb_int2big
- # define rb_num2long rb_num2long_stub
- # define rb_int2big rb_int2big_stub
- #endif
- 
--#if defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER >= 19 \
-+#if defined(DYNAMIC_RUBY) && RUBY_VERSION >= 19 \
- 	&& VIM_SIZEOF_INT < VIM_SIZEOF_LONG
- // Ruby 1.9 defines a number of static functions which use rb_fix2int and
- // rb_num2int if VIM_SIZEOF_INT < VIM_SIZEOF_LONG (64bit)
-@@ -101,24 +86,24 @@
- # define rb_num2int rb_num2int_stub
- #endif
- 
--#if defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER == 21
-+#if defined(DYNAMIC_RUBY) && RUBY_VERSION == 21
- // Ruby 2.1 adds new GC called RGenGC and RARRAY_PTR uses
- // rb_gc_writebarrier_unprotect_promoted if USE_RGENGC
- # define rb_gc_writebarrier_unprotect_promoted rb_gc_writebarrier_unprotect_promoted_stub
- #endif
--#if defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER >= 22
-+#if defined(DYNAMIC_RUBY) && RUBY_VERSION >= 22
- # define rb_gc_writebarrier_unprotect rb_gc_writebarrier_unprotect_stub
- #endif
- 
--#if defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER >= 26
-+#if defined(DYNAMIC_RUBY) && RUBY_VERSION >= 26
- # define rb_ary_detransient rb_ary_detransient_stub
- #endif
- 
- #include <ruby.h>
--#ifdef RUBY19_OR_LATER
-+#if RUBY_VERSION >= 19
- # include <ruby/encoding.h>
- #endif
--#ifndef RUBY19_OR_LATER
-+#if RUBY_VERSION <= 18
- # include <st.h> // for ST_STOP and ST_CONTINUE
- #endif
- 
-@@ -139,7 +124,7 @@
- * The old Data_XXX macro family was deprecated on Ruby 2.2.
- * Use TypedData_XXX if available.
- */
--#if defined(TypedData_Wrap_Struct) && defined(RUBY20_OR_LATER)
-+#if defined(TypedData_Wrap_Struct) && (RUBY_VERSION >= 20)
- # define USE_TYPEDDATA	1
- #endif
- 
-@@ -210,7 +195,7 @@ static void ruby_io_init(void);
- static void ruby_vim_init(void);
- static int ruby_convert_to_vim_value(VALUE val, typval_T *rettv);
- 
--#if defined(RUBY19_OR_LATER) || defined(RUBY_INIT_STACK)
-+#if (RUBY_VERSION >= 19) || defined(RUBY_INIT_STACK)
- # if defined(__ia64) && !defined(ruby_init_stack)
- # define ruby_init_stack(addr) ruby_init_stack((addr), rb_ia64_bsp())
- # endif
-@@ -233,7 +218,7 @@ static int ruby_convert_to_vim_value(VALUE val, typval_T *rettv);
- # endif
- # define rb_class_path			dll_rb_class_path
- # ifdef USE_TYPEDDATA

_service:extract_file:backport-memory-leak-for-retab-with-invalid-argument.patch Deleted

@@ -1,66 +0,0 @@
-From 2ddb89f8a94425cda1e5491efc80c1ccccb6e08e Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sat, 4 Sep 2021 21:20:41 +0200
-Subject: PATCH patch 8.2.3403: memory leak for :retab with invalid argument
-
-Problem: Memory leak for :retab with invalid argument.
-Solution: Free the memory. Make error messages consistent.
----
- src/indent.c | 13 +++++++++++--
- src/version.c | 2 ++
- 2 files changed, 13 insertions(+), 2 deletions(-)
-
-diff --git a/src/indent.c b/src/indent.c
-index 7e196c2..7d04373 100644
---- a/src/indent.c
-+++ b/src/indent.c
-@@ -70,9 +70,12 @@ tabstop_set(char_u *var, int **array)
- {
- 	int n = atoi((char *)cp);
- 
-+	// Catch negative values, overflow and ridiculous big values.
- 	if (n < 0 || n > 9999)
- 	{
- 	 semsg(_(e_invarg2), cp);
-+	 vim_free(*array);
-+	 *array = NULL;
- 	 return FAIL;
- 	}
- 	(*array)t++ = n;
-@@ -1580,12 +1583,18 @@ ex_retab(exarg_T *eap)
- else
- 	new_ts_str = vim_strnsave(new_ts_str, eap->arg - new_ts_str);
- #else
-- new_ts = getdigits(&(eap->arg));
-- if (new_ts < 0)
-+ ptr = eap->arg;
-+ new_ts = getdigits(&ptr);
-+ if (new_ts < 0 && *eap->arg == '-')
- {
- 	emsg(_(e_positive));
- 	return;
- }
-+ if (new_ts < 0 || new_ts > 9999)
-+ {
-+	semsg(_(e_invarg2), eap->arg);
-+	return;
-+ }
- if (new_ts == 0)
- 	new_ts = curbuf->b_p_ts;
- #endif
-diff --git a/src/version.c b/src/version.c
-index 8912f62..f8e4561 100644
---- a/src/version.c
-+++ b/src/version.c
-@@ -743,6 +743,8 @@ static char *(features) =
- static int included_patches =
- { /* Add new patch number below this line */
- /**/
-+ 3403,
-+/**/
- 3402,
- /**/
- 0
--- 
-1.8.3.1
-

_service:extract_file:backport-missing-error-message.patch Deleted

@@ -1,29 +0,0 @@
-From 61015162ba834541c42da5db6f3fa0ebe1d40e87 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 28 Jan 2021 17:56:09 +0100
-Subject: PATCH patch 8.2.2423: missing error message
-Conflict:add missing error message
-Reference:https://github.com/vim/vim/commit/61015162ba834541c42da5db6f3fa0ebe1d40e87
-
-Problem: Missing error message.
-Solution: Add the error message.
-
----
- src/globals.h | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/globals.h b/src/globals.h
-index 009834c..872e895 100644
---- a/src/globals.h
-+++ b/src/globals.h
-@@ -1451,6 +1451,7 @@ EXTERN int netbeansSuppressNoLines INIT(= 0); // skip "No lines in buffer"
- */
- EXTERN char e_abort		INIT(= N_("E470: Command aborted"));
- EXTERN char e_argreq	INIT(= N_("E471: Argument required"));
-+EXTERN char e_cannot_change_arglist_recursively INIT(= N_("E1156: Cannot change the argument list recursively"));
- EXTERN char e_backslash	INIT(= N_("E10: \\ should be followed by /, ? or &"));
- #ifdef FEAT_CMDWIN
- EXTERN char e_cmdwin	INIT(= N_("E11: Invalid in command-line window; <CR> executes, CTRL-C quits"));
--- 
-2.27.0
-

_service:extract_file:backport-no-early-check-if-find-and-sfind-have-an-argument.patch Deleted

@@ -1,70 +0,0 @@
-From 2d10cd478047df8ba144d4b0fcc46480993af57f Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 19 Mar 2020 14:37:30 +0100
-Subject: PATCH patch 8.2.0407: no early check if :find and :sfind have an
- argument
-
-Problem: No early check if :find and :sfind have an argument.
-Solution: Add EX_NEEDARG.
-
-Reference:https://github.com/vim/vim/commit/2d10cd478047df8ba144d4b0fcc46480993af57f
----
- src/ex_cmds.h | 4 ++--
- src/testdir/test_find_complete.vim | 8 ++++----
- 2 files changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/src/ex_cmds.h b/src/ex_cmds.h
-index 983378c..28ea6ee 100644
---- a/src/ex_cmds.h
-+++ b/src/ex_cmds.h
-@@ -572,7 +572,7 @@ EXCMD(CMD_filter,	"filter",	ex_wrongmodifier,
- 	EX_BANG|EX_NEEDARG|EX_EXTRA|EX_NOTRLCOM,
- 	ADDR_NONE),
- EXCMD(CMD_find,		"find",		ex_find,
--	EX_RANGE|EX_BANG|EX_FILE1|EX_CMDARG|EX_ARGOPT|EX_TRLBAR,
-+	EX_RANGE|EX_BANG|EX_FILE1|EX_CMDARG|EX_ARGOPT|EX_TRLBAR|EX_NEEDARG,
- 	ADDR_OTHER),
- EXCMD(CMD_finally,	"finally",	ex_finally,
- 	EX_TRLBAR|EX_SBOXOK|EX_CMDWIN,
-@@ -1319,7 +1319,7 @@ EXCMD(CMD_setlocal,	"setlocal",	ex_set,
- 	EX_TRLBAR|EX_EXTRA|EX_CMDWIN|EX_SBOXOK,
- 	ADDR_NONE),
- EXCMD(CMD_sfind,	"sfind",	ex_splitview,
--	EX_BANG|EX_FILE1|EX_RANGE|EX_CMDARG|EX_ARGOPT|EX_TRLBAR,
-+	EX_BANG|EX_FILE1|EX_RANGE|EX_CMDARG|EX_ARGOPT|EX_TRLBAR|EX_NEEDARG,
- 	ADDR_OTHER),
- EXCMD(CMD_sfirst,	"sfirst",	ex_rewind,
- 	EX_EXTRA|EX_BANG|EX_CMDARG|EX_ARGOPT|EX_TRLBAR,
-diff --git a/src/testdir/test_find_complete.vim b/src/testdir/test_find_complete.vim
-index 679bf3c..32ca967 100644
---- a/src/testdir/test_find_complete.vim
-+++ b/src/testdir/test_find_complete.vim
-@@ -15,22 +15,22 @@ func Test_find_complete()
- 
- new
- set path=
-- call assert_fails('call feedkeys(":find\t\n", "xt")', 'E345:')
-+ call assert_fails('call feedkeys(":find \t\n", "xt")', 'E471:')
- close
- 
- new
- set path=.
-- call assert_fails('call feedkeys(":find\t\n", "xt")', 'E32:')
-+ call assert_fails('call feedkeys(":find \t\n", "xt")', 'E471:')
- close
- 
- new
- set path=.,,
-- call assert_fails('call feedkeys(":find\t\n", "xt")', 'E32:')
-+ call assert_fails('call feedkeys(":find \t\n", "xt")', 'E471:')
- close
- 
- new
- set path=./**
-- call assert_fails('call feedkeys(":find\t\n", "xt")', 'E32:')
-+ call assert_fails('call feedkeys(":find \t\n", "xt")', 'E471:')
- close
- 
- " We shouldn't find any file till this point
--- 
-2.23.0
\ No newline at end of file

_service:extract_file:backport-spell-test-fails-because-of-new-illegal-byte-check.patch Deleted

@@ -1,34 +0,0 @@
-From fe978c2b6bb9d897d962595a4a51dd7a71dc8e89 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sun, 8 May 2022 22:43:51 +0100
-Subject: PATCH patch 8.2.4921: spell test fails because of new illegal byte
- check
-
-Problem: Spell test fails because of new illegal byte check.
-Solution: Remove the test.
----
- src/testdir/test_spell.vim | 8 --------
- 1 file changed, 8 deletions(-)
-
-diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
-index 49118a9..437ad5c 100644
---- a/src/testdir/test_spell.vim
-+++ b/src/testdir/test_spell.vim
-@@ -552,14 +552,6 @@ func Test_spell_screendump()
- call delete('XtestSpell')
- endfunc
- 
--func Test_spell_single_word()
-- new
-- silent! norm 0R00
-- spell! ßÂ
-- silent 0norm 0r$ Dvz=
-- bwipe!
--endfunc
--
- let g:test_data_aff1 = 
- \"SET ISO8859-1",
- \"TRY esianrtolcdugmphbyfvkwjkqxz-\xEB\xE9\xE8\xEA\xEF\xEE\xE4\xE0\xE2\xF6\xFC\xFB'ESIANRTOLCDUGMPHBYFVKWJKQXZ",
--- 
-1.8.3.1
-

_service:extract_file:backport-vim-fix-garbled-characters-display-when-file-name-ma.patch Deleted

@@ -1,37 +0,0 @@
-From 150fab01a9e9eb61061bf145998b608c5c9c470e Mon Sep 17 00:00:00 2001
-From: lvying6 <lvying6@huawei.com>
-Date: Tue, 14 Jul 2020 16:43:33 +0800
-Subject: PATCH vim: fix garbled characters display when file name matches
- warning or error in tar file
-
-Reference: https://github.com/vim/vim/issues/6425
-
-The problem is, the tar.vim plugin checks if the last line matches
-warning or error or a few other keywords and if it does, it aborts.
-
-Signed-off-by: lvying6 <lvying6@huawei.com>
----
- runtime/autoload/tar.vim | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/runtime/autoload/tar.vim b/runtime/autoload/tar.vim
-index dc670db..168a2f1 100644
---- a/runtime/autoload/tar.vim
-+++ b/runtime/autoload/tar.vim
-@@ -184,7 +184,12 @@ fun! tar#Browse(tarfile)
- " call Dret("tar#Browse : a:tarfile<".a:tarfile.">")
- return
- endif
-- if line("$") == curlast || ( line("$") == (curlast + 1) && getline("$") =~ '\c\%(warning\|error\|inappropriate\|unrecognized\)')
-+ " If there was an error message, the last line probably matches some keywords but
-+ " should also contain whitespace for readability. Make sure not to match a
-+ " filename that contains the keyword (error/warning/unrecognized/inappropriate, etc)
-+ if line("$") == curlast || ( line("$") == (curlast + 1) &&
-+ \ getline("$") =~# '\c\<\%(warning\|error\|inappropriate\|unrecognized\)\>' &&
-+ \ getline("$") =~ '\s' )
- redraw!
- echohl WarningMsg | echo "***warning*** (tar#Browse) ".a:tarfile." doesn't appear to be a tar file" | echohl None
- keepj sil! %d
--- 
-1.8.3.1
-

_service:extract_file:bugfix-rm-modify-info-version.patch Deleted

_service:extract_file:vim-7.0-fixkeys.patch Deleted

@@ -1,26 +0,0 @@
-diff -up vim81/src/term.c.fixkeys vim81/src/term.c
---- vim81/src/term.c.fixkeys	2019-12-12 09:00:20.685567074 +0100
-+++ vim81/src/term.c	2019-12-12 09:21:36.708769626 +0100
-@@ -957,14 +957,14 @@ static struct builtin_term builtin_termc
-     {K_XRIGHT,		IF_EB("\0331;*C", ESC_STR "1;*C")},
-     {K_XLEFT,		IF_EB("\0331;*D", ESC_STR "1;*D")},
-     // An extra set of function keys for vt100 mode
--    {K_XF1,		IF_EB("\033O*P", ESC_STR "O*P")},
--    {K_XF2,		IF_EB("\033O*Q", ESC_STR "O*Q")},
--    {K_XF3,		IF_EB("\033O*R", ESC_STR "O*R")},
--    {K_XF4,		IF_EB("\033O*S", ESC_STR "O*S")},
--    {K_F1,		IF_EB("\03311;*~", ESC_STR "11;*~")},
--    {K_F2,		IF_EB("\03312;*~", ESC_STR "12;*~")},
--    {K_F3,		IF_EB("\03313;*~", ESC_STR "13;*~")},
--    {K_F4,		IF_EB("\03314;*~", ESC_STR "14;*~")},
-+    {K_XF1,             IF_EB("\03311~", ESC_STR "11~")},
-+    {K_XF2,             IF_EB("\03312~", ESC_STR "12~")},
-+    {K_XF3,             IF_EB("\03313~", ESC_STR "13~")},
-+    {K_XF4,             IF_EB("\03314~", ESC_STR "14~")},
-+    {K_F1,              IF_EB("\033OP", ESC_STR "OP")},
-+    {K_F2,              IF_EB("\033OQ", ESC_STR "OQ")},
-+    {K_F3,              IF_EB("\033OR", ESC_STR "OR")},
-+    {K_F4,              IF_EB("\033OS", ESC_STR "OS")},
-     {K_F5,		IF_EB("\03315;*~", ESC_STR "15;*~")},
-     {K_F6,		IF_EB("\03317;*~", ESC_STR "17;*~")},
-     {K_F7,		IF_EB("\03318;*~", ESC_STR "18;*~")},

_service:extract_file:vim-7.0-rclocation.patch Deleted

_service:extract_file:vim-7.4-checkhl.patch Deleted

@@ -1,12 +0,0 @@
-diff -up vim74/runtime/syntax/spec.vim.kh1 vim74/runtime/syntax/spec.vim
---- vim74/runtime/syntax/spec.vim.kh1	2016-08-04 15:23:25.275955301 +0200
-+++ vim74/runtime/syntax/spec.vim	2016-08-04 15:24:56.699417602 +0200
-@@ -114,7 +114,7 @@ syn region specDescriptionArea matchgrou
- syn region specPackageArea matchgroup=specSection start='^%package' end='^%'me=e-1 contains=specPackageOpts,specPreAmble,specComment
- 
- "%% Scripts Section %%
--syn region specScriptArea matchgroup=specSection start='^%$prep\|build\|install\|clean\|pre\|postun\|preun\|post\|posttrans$\>' skip='^%{\|^%$define\|patch\d*\|configure\|GNUconfigure\|setup\|autosetup\|autopatch\|find_lang\|make_build\|makeinstall\|make_install$\>' end='^%'me=e-1 contains=specSpecialVariables,specVariables,@specCommands,specVariables,shDo,shFor,shCaseEsac,specNoNumberHilite,specCommandOpts,shComment,shIf,specSpecialChar,specMacroIdentifier,specSectionMacroArea,specSectionMacroBracketArea,shOperator,shQuote1,shQuote2
-+syn region specScriptArea matchgroup=specSection start='^%$prep\|build\|install\|check\|clean\|pre\|postun\|preun\|post\|posttrans$\>' skip='^%{\|^%$define\|patch\d*\|configure\|GNUconfigure\|setup\|find_lang\|makeinstall\|make_install$\>' end='^%'me=e-1 contains=specSpecialVariables,specVariables,@specCommands,specVariables,shDo,shFor,shCaseEsac,specNoNumberHilite,specCommandOpts,shComment,shIf,specSpecialChar,specMacroIdentifier,specSectionMacroArea,specSectionMacroBracketArea,shOperator,shQuote1,shQuote2
- 
- "%% Changelog Section %%
- syn region specChangelogArea matchgroup=specSection start='^%changelog' end='^%'me=e-1 contains=specEmail,specURL,specWeekday,specMonth,specNumber,specComment,specLicense

_service:extract_file:vim-7.4-fstabsyntax.patch Deleted

@@ -1,21 +0,0 @@
-diff -up vim81/runtime/syntax/fstab.vim.fstabsyntax vim81/runtime/syntax/fstab.vim
---- vim81/runtime/syntax/fstab.vim.fstabsyntax	2019-06-11 09:55:23.000000000 +0200
-+++ vim81/runtime/syntax/fstab.vim	2019-06-11 10:14:22.223616868 +0200
-@@ -56,7 +56,7 @@ syn keyword fsMountPointKeyword containe
- " Type
- syn cluster fsTypeCluster contains=fsTypeKeyword,fsTypeUnknown
- syn match fsTypeUnknown /\s\+\zs\w\+/ contained
--syn keyword fsTypeKeyword contained adfs ados affs anon_inodefs atfs audiofs auto autofs bdev befs bfs btrfs binfmt_misc cd9660 cfs cgroup cifs coda configfs cpuset cramfs devfs devpts devtmpfs e2compr efs ext2 ext2fs ext3 ext4 fdesc ffs filecore fuse fuseblk fusectl hfs hpfs hugetlbfs iso9660 jffs jffs2 jfs kernfs lfs linprocfs mfs minix mqueue msdos ncpfs nfs nfsd nilfs2 none ntfs null nwfs overlay ovlfs pipefs portal proc procfs pstore ptyfs qnx4 reiserfs ramfs romfs securityfs shm smbfs squashfs sockfs sshfs std subfs swap sysfs sysv tcfs tmpfs udf ufs umap umsdos union usbfs userfs vfat vs3fs vxfs wrapfs wvfs xenfs xfs zisofs
-+syn keyword fsTypeKeyword contained adfs ados affs anon_inodefs atfs audiofs auto autofs bdev befs bfs btrfs binfmt_misc cd9660 cfs cgroup cifs coda configfs cpuset cramfs devfs devpts devtmpfs e2compr efs ext2 ext2fs ext3 ext4 fdesc ffs filecore fuse fuseblk fusectl hfs hpfs hugetlbfs iso9660 jffs jffs2 jfs kernfs lfs linprocfs mfs minix mqueue msdos ncpfs nfs nfsd nilfs2 none ntfs null nwfs overlay ovlfs pipefs portal proc procfs pstore ptyfs qnx4 reiserfs ramfs romfs rpc_pipefs securityfs shm smbfs squashfs sockfs sshfs std subfs swap sysfs sysv tcfs tmpfs udf ufs umap umsdos union usbfs userfs vfat vs3fs vxfs wrapfs wvfs xenfs xfs zisofs
- 
- " Options
- " -------
-@@ -68,7 +68,7 @@ syn match fsOptionsString /a-zA-Z0-9_-
- syn keyword fsOptionsYesNo yes no
- syn cluster fsOptionsCheckCluster contains=fsOptionsExt2Check,fsOptionsFatCheck
- syn keyword fsOptionsSize 512 1024 2048
--syn keyword fsOptionsGeneral async atime auto bind current defaults dev devgid devmode devmtime devuid dirsync exec force fstab kudzu loop mand move noatime noauto noclusterr noclusterw nodev nodevmtime nodiratime noexec nomand norelatime nosuid nosymfollow nouser owner rbind rdonly relatime remount ro rq rw suid suiddir supermount sw sync union update user users wxallowed xx nofail
-+syn keyword fsOptionsGeneral async atime auto bind current defaults dev devgid devmode devmtime devuid dirsync exec force fstab kudzu loop managed mand move noatime noauto noclusterr noclusterw nodev nodevmtime nodiratime noexec nomand norelatime nosuid nosymfollow nouser owner pamconsole rbind rdonly relatime remount ro rq rw suid suiddir supermount sw sync union update user users wxallowed xx nofail
- syn match fsOptionsGeneral /_netdev/
- 
- " Options: adfs

_service:extract_file:vim-7.4-globalsyntax.patch Deleted

@@ -1,12 +0,0 @@
-diff -up vim74/runtime/syntax/spec.vim.orig vim74/runtime/syntax/spec.vim
---- vim74/runtime/syntax/spec.vim.orig	2016-01-12 13:51:55.727569873 +0100
-+++ vim74/runtime/syntax/spec.vim	2016-01-12 13:53:08.124991178 +0100
-@@ -114,7 +114,7 @@ syn region specDescriptionArea matchgrou
- syn region specPackageArea matchgroup=specSection start='^%package' end='^%'me=e-1 contains=specPackageOpts,specPreAmble,specComment
- 
- "%% Scripts Section %%
--syn region specScriptArea matchgroup=specSection start='^%$prep\|build\|install\|check\|clean\|pre\|postun\|preun\|post\|posttrans$\>' skip='^%{\|^%$define\|patch\d*\|configure\|GNUconfigure\|setup\|find_lang\|makeinstall\|make_install$\>' end='^%'me=e-1 contains=specSpecialVariables,specVariables,@specCommands,specVariables,shDo,shFor,shCaseEsac,specNoNumberHilite,specCommandOpts,shComment,shIf,specSpecialChar,specMacroIdentifier,specSectionMacroArea,specSectionMacroBracketArea,shOperator,shQuote1,shQuote2
-+syn region specScriptArea matchgroup=specSection start='^%$prep\|build\|install\|check\|clean\|pre\|postun\|preun\|post\|posttrans$\>' skip='^%{\|^%$define\|global\|patch\d*\|configure\|GNUconfigure\|setup\|find_lang\|makeinstall\|make_install$\>' end='^%'me=e-1 contains=specSpecialVariables,specVariables,@specCommands,specVariables,shDo,shFor,shCaseEsac,specNoNumberHilite,specCommandOpts,shComment,shIf,specSpecialChar,specMacroIdentifier,specSectionMacroArea,specSectionMacroBracketArea,shOperator,shQuote1,shQuote2
- 
- "%% Changelog Section %%
- syn region specChangelogArea matchgroup=specSection start='^%changelog' end='^%'me=e-1 contains=specEmail,specURL,specWeekday,specMonth,specNumber,specComment,specLicense

_service:extract_file:vim-7.4-nowarnings.patch Deleted

_service:extract_file:vim-7.4-releasestring-1318991.patch Deleted

_service:extract_file:vim-7.4-specsyntax.patch Deleted

@@ -1,33 +0,0 @@
-diff -up vim74/runtime/syntax/spec.vim.highlite vim74/runtime/syntax/spec.vim
---- vim74/runtime/syntax/spec.vim.highlite	2016-07-04 10:17:45.000000000 +0200
-+++ vim74/runtime/syntax/spec.vim	2016-08-04 15:20:26.116049343 +0200
-@@ -38,7 +38,7 @@ syn match specNoNumberHilite 'X11\|X11R6
- syn match specManpageFile 'a-zA-Z\.1'
- 
- "Day, Month and most used license acronyms
--syn keyword specLicense contained GPL LGPL BSD MIT GNU
-+syn keyword specLicense contained GPL LGPL BSD MIT GNU distributable
- syn keyword specWeekday contained Mon Tue Wed Thu Fri Sat Sun
- syn keyword specMonth contained Jan Feb Mar Apr Jun Jul Aug Sep Oct Nov Dec
- syn keyword specMonth contained January February March April May June July August September October November December
-@@ -61,9 +61,9 @@ syn cluster specListedFiles contains=spe
- 
- "specComands
- syn match specConfigure contained '\./configure'
--syn match specTarCommand contained '\<tar\s\+cxvpzIf\{,5}\s*'
-+syn match specTarCommand contained '\<tar\s\+cxvpzIjf\{,5}\s*'
- syn keyword specCommandSpecial contained root
--syn keyword specCommand		contained make xmkmf mkdir chmod ln find sed rm strip moc echo grep ls rm mv mkdir install cp pwd cat tail then else elif cd gzip rmdir ln eval export touch
-+syn keyword specCommand		contained make xmkmf mkdir chmod ln find sed rm strip moc echo grep ls rm mv mkdir install cp pwd cat tail then else elif cd gzip rmdir ln eval export touch bzip2 bunzip2 gunzip
- syn cluster specCommands contains=specCommand,specTarCommand,specConfigure,specCommandSpecial
- 
- "frequently used rpm env vars
-@@ -105,7 +105,7 @@ syn case ignore
- "%% PreAmble Section %%
- "Copyright and Serial were deprecated by License and Epoch
- syn region specPreAmbleDeprecated oneline matchgroup=specError start='^$Copyright\|Serial$' end='$' contains=specEmail,specURL,specURLMacro,specLicense,specColon,specVariables,specSpecialChar,specMacroIdentifier
--syn region specPreAmble oneline matchgroup=specCommand start='^$Prereq\|Summary\|Name\|Version\|Packager\|Requires\|Recommends\|Suggests\|Supplements\|Enhances\|Icon\|URL\|Source\d*\|Patch\d*\|Prefix\|Packager\|Group\|License\|Release\|BuildRoot\|Distribution\|Vendor\|Provides\|ExclusiveArch\|ExcludeArch\|ExclusiveOS\|Obsoletes\|BuildArch\|BuildArchitectures\|BuildRequires\|BuildConflicts\|BuildPreReq\|Conflicts\|AutoRequires\|AutoReq\|AutoReqProv\|AutoProv\|Epoch$' end='$' contains=specEmail,specURL,specURLMacro,specLicense,specColon,specVariables,specSpecialChar,specMacroIdentifier
-+syn region specPreAmble oneline matchgroup=specCommand start='^$Prereq\|Summary\|Name\|Version\|Packager\|Requires\|Recommends\|Suggests\|Supplements\|Enhances\|Icon\|URL\|Source\d*\|Patch\d*\|Prefix\|Packager\|Group\|License\|Release\|BuildRoot\|Distribution\|Vendor\|Provides\|ExclusiveArch\|ExcludeArch\|ExcludeOS\|ExclusiveOS\|Obsoletes\|BuildArch\|BuildArchitectures\|BuildRequires\|BuildConflicts\|BuildPreReq\|Conflicts\|AutoRequires\|AutoReq\|AutoReqProv\|AutoProv\|Epoch$' end='$' contains=specEmail,specURL,specURLMacro,specLicense,specColon,specVariables,specSpecialChar,specMacroIdentifier
- 
- "%% Description Section %%
- syn region specDescriptionArea matchgroup=specSection start='^%description' end='^%'me=e-1 contains=specDescriptionOpts,specEmail,specURL,specNumber,specMacroIdentifier,specComment

_service:extract_file:vim-7.4-syncolor.patch Deleted

@@ -1,26 +0,0 @@
-diff --git a/src/highlight.c b/src/highlight.c
-index 9322f96..f7147a0 100644
---- a/src/highlight.c
-+++ b/src/highlight.c
-@@ -211,8 +211,8 @@ static char *(highlight_init_light) = {
-     CENT("Visual term=reverse",
- 	 "Visual term=reverse guibg=LightGrey"),
- #ifdef FEAT_DIFF
--    CENT("DiffAdd term=bold ctermbg=LightBlue",
--	 "DiffAdd term=bold ctermbg=LightBlue guibg=LightBlue"),
-+    CENT("DiffAdd term=bold ctermbg=LightRed",
-+	  "DiffAdd term=bold ctermbg=LightRed guibg=LightBlue"),
-     CENT("DiffChange term=bold ctermbg=LightMagenta",
- 	 "DiffChange term=bold ctermbg=LightMagenta guibg=LightMagenta"),
-     CENT("DiffDelete term=bold ctermfg=Blue ctermbg=LightCyan",
-@@ -304,8 +304,8 @@ static char *(highlight_init_dark) = {
-     CENT("Visual term=reverse",
- 	 "Visual term=reverse guibg=DarkGrey"),
- #ifdef FEAT_DIFF
--    CENT("DiffAdd term=bold ctermbg=DarkBlue",
--	 "DiffAdd term=bold ctermbg=DarkBlue guibg=DarkBlue"),
-+    CENT("DiffAdd term=bold ctermbg=DarkRed",
-+	  "DiffAdd term=bold ctermbg=DarkRed guibg=DarkBlue"),
-     CENT("DiffChange term=bold ctermbg=DarkMagenta",
- 	 "DiffChange term=bold ctermbg=DarkMagenta guibg=DarkMagenta"),
-     CENT("DiffDelete term=bold ctermfg=Blue ctermbg=DarkCyan",

_service:extract_file:vim-7.4-syntax.patch Deleted

_service:extract_file:vim-8.0-copy-paste.patch Deleted

_service:extract_file:vim-python3-tests.patch Deleted

@@ -1,87 +0,0 @@
-diff -up vim80/runtime/tools/demoserver.py.python3-tests vim80/runtime/tools/demoserver.py
---- vim80/runtime/tools/demoserver.py.python3-tests	2018-05-11 08:24:41.774618804 +0200
-+++ vim80/runtime/tools/demoserver.py	2018-05-11 09:24:48.363309856 +0200
-@@ -1,4 +1,4 @@
--#!/usr/bin/python
-+#!/usr/bin/python3
- #
- # Server that will accept connections from a Vim channel.
- # Run this server and then in Vim you can open the channel:
-diff -up vim80/src/auto/configure.python3-tests vim80/src/auto/configure
---- vim80/src/auto/configure.python3-tests	2018-05-11 08:25:03.632420873 +0200
-+++ vim80/src/auto/configure	2018-05-11 09:25:26.062000471 +0200
-@@ -6396,7 +6396,7 @@ eof
- 	 if test "x$MACOS_X" = "xyes" && test -n "${python_PYTHONFRAMEWORK}" && ${vi_cv_path_python} -c \
- 		"import sys; sys.exit(${vi_cv_var_python_version} < 2.3)"; then
- 	 vi_cv_path_python_plibs="-framework Python"
--	 if test "x${vi_cv_path_python}" != "x/usr/bin/python" && test -n "${python_PYTHONFRAMEWORKPREFIX}"; then
-+	 if test "x${vi_cv_path_python}" != "x/usr/bin/python2" && test -n "${python_PYTHONFRAMEWORKPREFIX}"; then
- 		 vi_cv_path_python_plibs="-F${python_PYTHONFRAMEWORKPREFIX} -framework Python"
- 	 fi
- 	 else
-diff -up vim80/src/configure.ac.python3-tests vim80/src/configure.ac
---- vim80/src/configure.ac.python3-tests	2018-05-11 08:25:26.070218957 +0200
-+++ vim80/src/configure.ac	2018-05-11 09:26:01.603708243 +0200
-@@ -1248,7 +1248,7 @@ eof
- 	 if test "x$MACOS_X" = "xyes" && test -n "${python_PYTHONFRAMEWORK}" && ${vi_cv_path_python} -c \
- 		"import sys; sys.exit(${vi_cv_var_python_version} < 2.3)"; then
- 	 vi_cv_path_python_plibs="-framework Python"
--	 if test "x${vi_cv_path_python}" != "x/usr/bin/python" && test -n "${python_PYTHONFRAMEWORKPREFIX}"; then
-+	 if test "x${vi_cv_path_python}" != "x/usr/bin/python2" && test -n "${python_PYTHONFRAMEWORKPREFIX}"; then
- 		 vi_cv_path_python_plibs="-F${python_PYTHONFRAMEWORKPREFIX} -framework Python"
- 	 fi
- 	 else
-diff -up vim80/src/testdir/test_channel_pipe.py.python3-tests vim80/src/testdir/test_channel_pipe.py
---- vim80/src/testdir/test_channel_pipe.py.python3-tests	2018-05-11 09:23:05.738146018 +0200
-+++ vim80/src/testdir/test_channel_pipe.py	2018-05-11 09:26:37.354413350 +0200
-@@ -1,4 +1,4 @@
--#!/usr/bin/python
-+#!/usr/bin/python3
- #
- # Server that will communicate over stdin/stderr
- #
-diff -up vim80/src/testdir/test_channel.py.python3-tests vim80/src/testdir/test_channel.py
---- vim80/src/testdir/test_channel.py.python3-tests	2018-05-11 09:22:48.522284266 +0200
-+++ vim80/src/testdir/test_channel.py	2018-05-11 09:26:17.762574955 +0200
-@@ -1,4 +1,4 @@
--#!/usr/bin/python
-+#!/usr/bin/python3
- #
- # Server that will accept connections from a Vim channel.
- # Used by test_channel.vim.
-diff -up vim80/src/testdir/test_channel_write.py.python3-tests vim80/src/testdir/test_channel_write.py
---- vim80/src/testdir/test_channel_write.py.python3-tests	2018-05-11 09:23:21.254021422 +0200
-+++ vim80/src/testdir/test_channel_write.py	2018-05-11 09:26:54.952268193 +0200
-@@ -1,4 +1,4 @@
--#!/usr/bin/python
-+#!/usr/bin/python3
- #
- # Program that writes a number to stdout repeatedly
- #
-diff -up vim80/src/testdir/test_makeencoding.py.python3-tests vim80/src/testdir/test_makeencoding.py
---- vim80/src/testdir/test_makeencoding.py.python3-tests	2018-05-11 09:23:38.990878990 +0200
-+++ vim80/src/testdir/test_makeencoding.py	2018-05-11 09:27:14.402107759 +0200
-@@ -1,4 +1,4 @@
--#!/usr/bin/python
-+#!/usr/bin/python3
- # -*- coding: utf-8 -*-
- 
- # Test program for :make, :grep and :cgetfile.
-diff -up vim80/src/testdir/test_netbeans.py.python3-tests vim80/src/testdir/test_netbeans.py
---- vim80/src/testdir/test_netbeans.py.python3-tests	2018-05-11 09:23:54.398752732 +0200
-+++ vim80/src/testdir/test_netbeans.py	2018-05-11 09:27:30.489975057 +0200
-@@ -1,4 +1,4 @@
--#!/usr/bin/python
-+#!/usr/bin/python3
- #
- # Server that will communicate with Vim through the netbeans interface.
- # Used by test_netbeans.vim.
-diff -up vim80/src/testdir/test_short_sleep.py.python3-tests vim80/src/testdir/test_short_sleep.py
---- vim80/src/testdir/test_short_sleep.py.python3-tests	2018-05-11 09:24:09.134631798 +0200
-+++ vim80/src/testdir/test_short_sleep.py	2018-05-11 09:27:48.432827053 +0200
-@@ -1,4 +1,4 @@
--#!/usr/bin/python
-+#!/usr/bin/python3
- #
- # Program that sleeps for 100 msec
- #

_service:tar_scm:backport-9.0.0581-adding-a-character-for-incsearch-fails-at-end-of-line.patch Added

_service:tar_scm:backport-CVE-2022-2257.patch Added

@@ -0,0 +1,53 @@
+From 083692d598139228e101b8c521aaef7bcf256e9a Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Wed, 29 Jun 2022 21:16:58 +0100
+Subject: PATCH patch 9.0.0009: going past the end of a menu item with only
+ modifier
+
+Problem: Going past the end of a menu item with only modifier.
+Solution: Check for NUL.
+---
+ src/message.c | 4 ++--
+ src/testdir/test_menu.vim | 13 +++++++++++++
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/src/message.c b/src/message.c
+index 02380e9..becb280 100644
+--- a/src/message.c
++++ b/src/message.c
+@@ -1820,8 +1820,8 @@ str2special(
+ 	 *sp = str + 1;
+ }
+ else
+-	// single-byte character or illegal byte
+-	*sp = str + 1;
++	// single-byte character, NUL or illegal byte
++	*sp = str + (*str == NUL ? 0 : 1);
+ 
+ // Make special keys and C0 control characters in <> form, also <M-Space>.
+ // Use <Space> only for lhs of a mapping.
+diff --git a/src/testdir/test_menu.vim b/src/testdir/test_menu.vim
+index c867162..df717cc 100644
+--- a/src/testdir/test_menu.vim
++++ b/src/testdir/test_menu.vim
+@@ -528,4 +528,17 @@ func Test_tmenu()
+ tunmenu Test
+ endfunc
+ 
++func Test_only_modifier()
++ exe "tmenu a.b \x80\xfc0"
++ let exp =<< trim TEXT
++ --- Menus ---
++ 500 a
++ 500 b
++ t - <T-2-^@>
++ TEXT
++ call assert_equal(exp, split(execute('tmenu'), "\n"))
++
++ tunmenu a.b
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+1.8.3.1
+

_service:tar_scm:backport-CVE-2022-2264.patch Added

@@ -0,0 +1,51 @@
+From d25f003342aca9889067f2e839963dfeccf1fe05 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Thu, 30 Jun 2022 12:30:19 +0100
+Subject: PATCH patch 9.0.0011: reading beyond the end of the line with put
+ command
+
+Problem: Reading beyond the end of the line with put command.
+Solution: Adjust the end mark position.
+---
+ src/register.c | 2 ++
+ src/testdir/test_put.vim | 12 ++++++++++++
+ 2 files changed, 14 insertions(+)
+
+diff --git a/src/register.c b/src/register.c
+index 93860ba..30e2001 100644
+--- a/src/register.c
++++ b/src/register.c
+@@ -1918,6 +1918,8 @@ do_put(
+ 		 vim_memset(ptr, ' ', (size_t)spaces);
+ 		 ptr += spaces;
+ 		}
++		else
++		 totlen -= spaces; // didn't use these spaces
+ 	 }
+ 
+ 	 // may insert some spaces after the new text
+diff --git a/src/testdir/test_put.vim b/src/testdir/test_put.vim
+index aa5aa2b..66438bd 100644
+--- a/src/testdir/test_put.vim
++++ b/src/testdir/test_put.vim
+@@ -219,5 +219,17 @@ func Test_put_empty_register()
+ bwipe!
+ endfunc
+ 
++" this was putting the end mark after the end of the line
++func Test_put_visual_mode()
++ edit! SomeNewBuffer
++ set selection=exclusive
++ exe "norm o\t"
++ m0
++ sil! norm &#x11;
p&#x11;
p
++
++ bwipe!
++ set selection&
++endfunc
++
+ 
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+1.8.3.1
+

_service:tar_scm:backport-CVE-2022-2284.patch Added

@@ -0,0 +1,51 @@
+From 3d51ce18ab1be4f9f6061568a4e7fabf00b21794 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Fri, 1 Jul 2022 15:26:15 +0100
+Subject: PATCH patch 9.0.0017: accessing memory beyond the end of the
+ line
+
+Problem: Accessing memory beyond the end of the line.
+Solution: Stop Visual mode when closing a window.
+---
+ src/testdir/test_visual.vim | 12 ++++++++++++
+ src/window.c | 2 ++
+ 2 files changed, 14 insertions(+)
+
+diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
+index c323062..e965266 100644
+--- a/src/testdir/test_visual.vim
++++ b/src/testdir/test_visual.vim
+@@ -1469,5 +1469,17 @@ func Test_visual_paste_clipboard()
+ bwipe!
+ endfunc
+ 
++func Test_visual_area_adjusted_when_hiding()
++ " The Visual area ended after the end of the line after :hide
++ call setline(1, 'xxx')
++ vsplit Xfile
++ call setline(1, 'xxxxxxxx')
++ norm! &#x16;$o
++ hid
++ norm! zW
++ bwipe!
++ bwipe!
++endfunc
++
+ 
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/window.c b/src/window.c
+index 992593b..c91ebbc 100644
+--- a/src/window.c
++++ b/src/window.c
+@@ -2594,6 +2594,8 @@ win_close(win_T *win, int free_buf)
+ 	 */
+ 	if (wp->w_buffer != curbuf)
+ 	{
++	 reset_VIsual_and_resel();	// stop Visual mode
++
+ 	 other_buffer = TRUE;
+ 	 win->w_closing = TRUE;
+ 	 apply_autocmds(EVENT_BUFLEAVE, NULL, NULL, FALSE, curbuf);
+-- 
+1.8.3.1
+

_service:tar_scm:backport-CVE-2022-2285.patch Added

@@ -0,0 +1,46 @@
+From 27efc62f5d86afcb2ecb7565587fe8dea4b036fe Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Fri, 1 Jul 2022 16:35:45 +0100
+Subject: PATCH patch 9.0.0018: going over the end of the typahead
+
+Problem: Going over the end of the typahead.
+Solution: Put a NUL after the typeahead.
+---
+ src/term.c | 1 +
+ src/testdir/test_mapping.vim | 10 ++++++++++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/src/term.c b/src/term.c
+index 754ef82..7d7b84b 100644
+--- a/src/term.c
++++ b/src/term.c
+@@ -5393,6 +5393,7 @@ check_termcode(
+ 	if (*tp == ESC && !p_ek && (State & MODE_INSERT))
+ 	 continue;
+ 
++	tplen = NUL;
+ 	key_name0 = NUL;	// no key name found yet
+ 	key_name1 = NUL;	// no key name found yet
+ 	modifiers = 0;		// no modifiers yet
+diff --git a/src/testdir/test_mapping.vim b/src/testdir/test_mapping.vim
+index ace6453..2927ba7 100644
+--- a/src/testdir/test_mapping.vim
++++ b/src/testdir/test_mapping.vim
+@@ -1715,4 +1715,14 @@ func Test_map_after_timed_out_nop()
+ call delete('Xtest_map_after_timed_out_nop')
+ endfunc
+ 
++func Test_using_past_typeahead()
++ nnoremap :00 0
++ exe "norm :set \x80\xfb0=0\<CR>"
++ exe "sil norm :0\x0f\<C-U>\<CR>"
++
++ exe "norm :set \x80\xfb0=\<CR>"
++ nunmap :00
++endfunc
++
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+1.8.3.1
+

_service:tar_scm:backport-CVE-2022-2286.patch Added

@@ -0,0 +1,61 @@
+From f12129f1714f7d2301935bb21d896609bdac221c Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Fri, 1 Jul 2022 19:58:30 +0100
+Subject: PATCH patch 9.0.0020: with some completion reading past end of
+ string
+
+Problem: With some completion reading past end of string.
+Solution: Check the length of the string.
+---
+ src/insexpand.c | 14 ++++++++++++--
+ src/testdir/test_ins_complete.vim | 8 ++++++++
+ 2 files changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/src/insexpand.c b/src/insexpand.c
+index 4a5feac..734550f 100644
+--- a/src/insexpand.c
++++ b/src/insexpand.c
+@@ -2209,11 +2209,21 @@ ins_compl_stop(int c, int prev_mode, int retval)
+ // but only do this, if the Popup is still visible
+ if (c == Ctrl_E)
+ {
++	char_u *p = NULL;
++
+ 	ins_compl_delete();
+ 	if (compl_leader != NULL)
+-	 ins_bytes(compl_leader + get_compl_len());
++	 p = compl_leader;
+ 	else if (compl_first_match != NULL)
+-	 ins_bytes(compl_orig_text + get_compl_len());
++	 p = compl_orig_text;
++	if (p != NULL)
++	{
++	 int	 compl_len = get_compl_len();
++	 int	 len = (int)STRLEN(p);
++
++	 if (len > compl_len)
++		ins_bytes_len(p + compl_len, len - compl_len);
++	}
+ 	retval = TRUE;
+ }
+ 
+diff --git a/src/testdir/test_ins_complete.vim b/src/testdir/test_ins_complete.vim
+index 365c646..20c2b4f 100644
+--- a/src/testdir/test_ins_complete.vim
++++ b/src/testdir/test_ins_complete.vim
+@@ -2184,4 +2184,12 @@ func Test_complete_smartindent()
+ delfunction! FooBarComplete
+ endfunc
+ 
++func Test_complete_overrun()
++ " this was going past the end of the copied text
++ new
++ sil norm si&#x14;0&#x3;s&#xf;0&#x18;&#xc;&#x5;
++ bwipe!
++endfunc
++
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+1.8.3.1
+

_service:tar_scm:backport-CVE-2022-2287.patch Added

@@ -0,0 +1,90 @@
+From 5e59ea54c0c37c2f84770f068d95280069828774 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Fri, 1 Jul 2022 22:26:20 +0100
+Subject: PATCH patch 9.0.0021: invalid memory access when adding word to
+ spell word list
+
+Problem: Invalid memory access when adding word with a control character to
+ the internal spell word list.
+Solution: Disallow adding a word with control characters or a trailing
+ slash.
+---
+ src/spellfile.c | 21 +++++++++++++++++++--
+ src/testdir/test_spell.vim | 15 +++++++++++++++
+ 2 files changed, 34 insertions(+), 2 deletions(-)
+
+diff --git a/src/spellfile.c b/src/spellfile.c
+index f0d6d96..4a0de52 100644
+--- a/src/spellfile.c
++++ b/src/spellfile.c
+@@ -4367,6 +4367,23 @@ wordtree_alloc(spellinfo_T *spin)
+ }
+ 
+ /*
++ * Return TRUE if "word" contains valid word characters.
++ * Control characters and trailing '/' are invalid. Space is OK.
++ */
++ static int
++valid_spell_word(char_u *word)
++{
++ char_u *p;
++
++ if (enc_utf8 && !utf_valid_string(word, NULL))
++	return FALSE;
++ for (p = word; *p != NUL; p += mb_ptr2len(p))
++	if (*p < ' ' || (p0 == '/' && p1 == NUL))
++	 return FALSE;
++ return TRUE;
++}
++
++/*
+ * Store a word in the tree(s).
+ * Always store it in the case-folded tree. For a keep-case word this is
+ * useful when the word can also be used with all caps (no WF_FIXCAP flag) and
+@@ -4391,7 +4408,7 @@ store_word(
+ char_u	*p;
+ 
+ // Avoid adding illegal bytes to the word tree.
+- if (enc_utf8 && !utf_valid_string(word, NULL))
++ if (!valid_spell_word(word))
+ 	return FAIL;
+ 
+ (void)spell_casefold(curwin, word, len, foldword, MAXWLEN);
+@@ -6194,7 +6211,7 @@ spell_add_word(
+ int		i;
+ char_u	*spf;
+ 
+- if (enc_utf8 && !utf_valid_string(word, NULL))
++ if (!valid_spell_word(word))
+ {
+ 	emsg(_(e_illegal_character_in_word));
+ 	return;
+diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
+index 0fd5ed9..0187a17 100644
+--- a/src/testdir/test_spell.vim
++++ b/src/testdir/test_spell.vim
+@@ -854,6 +854,21 @@ func Test_spellsuggest_too_deep()
+ bwipe!
+ endfunc
+ 
++func Test_spell_good_word_invalid()
++ " This was adding a word with a 0x02 byte, which causes havoc.
++ enew
++ norm o0
++ sil! norm rzzWs00&#x2;/
++ 2
++ sil! norm VzGprzzW
++ sil! norm z=
++
++ bwipe!
++ " clear the internal word list
++ set enc=latin1
++ set enc=utf-8
++endfunc
++
+ func LoadAffAndDic(aff_contents, dic_contents)
+ set enc=latin1
+ set spellfile=
+-- 
+1.8.3.1
+

_service:tar_scm:backport-CVE-2022-2288.patch Added

@@ -0,0 +1,54 @@
+From c6fdb15d423df22e1776844811d082322475e48a Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Sat, 2 Jul 2022 13:43:21 +0100
+Subject: PATCH patch 9.0.0025: accessing beyond allocated memory with the
+ cmdline window
+
+Problem: Accessing beyond allocated memory when using the cmdline window in
+ Ex mode.
+Solution: Use "*" instead of "'<,'>" for Visual mode.
+---
+ src/ex_docmd.c | 6 ++++--
+ src/testdir/test_cmdline.vim | 8 ++++++++
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/src/ex_docmd.c b/src/ex_docmd.c
+index 271e7e2..697337c 100644
+--- a/src/ex_docmd.c
++++ b/src/ex_docmd.c
+@@ -3118,9 +3118,11 @@ parse_command_modifiers(
+ 		size_t len = STRLEN(cmd_start);
+ 
+ 		// Special case: empty command uses "+":
+-		// "'<,'>mods" -> "mods'<,'>+
++		// "'<,'>mods" -> "mods *+
++		// Use "*" instead of "'<,'>" to avoid the command getting
++		// longer, in case is was allocated.
+ 		mch_memmove(orig_cmd, cmd_start, len);
+-		STRCPY(orig_cmd + len, "'<,'>+");
++		STRCPY(orig_cmd + len, " *+");
+ 	 }
+ 	 else
+ 	 {
+diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
+index 3685336..f0498a1 100644
+--- a/src/testdir/test_cmdline.vim
++++ b/src/testdir/test_cmdline.vim
+@@ -2103,6 +2103,14 @@ func Test_cmdwin_insert_mode_close()
+ call assert_equal(1, winnr('$'))
+ endfunc
+ 
++func Test_cmdwin_ex_mode_with_modifier()
++ " this was accessing memory after allocated text in Ex mode
++ new
++ call setline(1, 'some', 'text', 'lines')
++ silent! call feedkeys("gQnormal vq:atopleft\<C-V>\<CR>\<CR>", 'xt')
++ bwipe!
++endfunc
++
+ " test that ";" works to find a match at the start of the first line
+ func Test_zero_line_search()
+ new
+-- 
+1.8.3.1
+

_service:tar_scm:backport-CVE-2022-2289.patch Added

@@ -0,0 +1,65 @@
+From c5274dd12224421f2430b30c53b881b9403d649e Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Sat, 2 Jul 2022 15:10:00 +0100
+Subject: PATCH patch 9.0.0026: accessing freed memory with diff put
+
+Problem: Accessing freed memory with diff put.
+Solution: Bail out when diff pointer is no longer valid.
+---
+ src/diff.c | 24 ++++++++++++++++++++++--
+ 1 files changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/src/diff.c b/src/diff.c
+index 91e5ae2..e4bafe2 100644
+--- a/src/diff.c
++++ b/src/diff.c
+@@ -2643,6 +2643,20 @@ nv_diffgetput(int put, long count)
+ }
+ 
+ /*
++ * Return TRUE if "diff" appears in the list of diff blocks of the current tab.
++ */
++ static int
++valid_diff(diff_T *diff)
++{
++ diff_T	*dp;
++
++ for (dp = curtab->tp_first_diff; dp != NULL; dp = dp->df_next)
++	if (dp == diff)
++	 return TRUE;
++ return FALSE;
++}
++
++/*
+ * ":diffget"
+ * ":diffput"
+ */
+@@ -2899,9 +2913,9 @@ ex_diffgetput(exarg_T *eap)
+ 		}
+ 	 }
+ 
+-	 // Adjust marks. This will change the following entries!
+ 	 if (added != 0)
+ 	 {
++		// Adjust marks. This will change the following entries!
+ 		mark_adjust(lnum, lnum + count - 1, (long)MAXLNUM, (long)added);
+ 		if (curwin->w_cursor.lnum >= lnum)
+ 		{
+@@ -2923,7 +2937,13 @@ ex_diffgetput(exarg_T *eap)
+ #endif
+ 		vim_free(dfree);
+ 	 }
+-	 else
++
++	 // mark_adjust() may have made "dp" invalid. We don't know where
++	 // to continue then, bail out.
++	 if (added != 0 && !valid_diff(dp))
++		break;
++
++	 if (dfree == NULL)
+ 		// mark_adjust() may have changed the count in a wrong way
+ 		dp->df_countidx_to = new_count;
+ 
+-- 
+1.8.3.1
+

_service:tar_scm:backport-CVE-2022-2304.patch Added

@@ -0,0 +1,55 @@
+From 54e5fed6d27b747ff152cdb6edfb72ff60e70939 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Mon, 4 Jul 2022 13:37:07 +0100
+Subject: PATCH patch 9.0.0035: spell dump may go beyond end of an array
+
+Problem: Spell dump may go beyond end of an array.
+Solution: Limit the word length.
+---
+ src/spell.c | 5 +++--
+ src/testdir/test_spell.vim | 12 ++++++++++++
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/src/spell.c b/src/spell.c
+index d866a2d..24abce4 100644
+--- a/src/spell.c
++++ b/src/spell.c
+@@ -3996,9 +3996,10 @@ spell_dump_compl(
+ 		 n = arridxdepth + curidepth;
+ 		 ++curidepth;
+ 		 c = bytsn;
+-		 if (c == 0)
++		 if (c == 0 || depth >= MAXWLEN - 1)
+ 		 {
+-			// End of word, deal with the word.
++			// End of word or reached maximum length, deal with the
++			// word.
+ 			// Don't use keep-case words in the fold-case tree,
+ 			// they will appear in the keep-case tree.
+ 			// Only use the word when the region matches.
+diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
+index d3f56d8..a291eb5 100644
+--- a/src/testdir/test_spell.vim
++++ b/src/testdir/test_spell.vim
+@@ -285,6 +285,18 @@ func Test_spellreall()
+ bwipe!
+ endfunc
+ 
++func Test_spell_dump_word_length()
++ " this was running over MAXWLEN
++ new
++ noremap 0 0a0zW0000000
++ sil! norm &#x16;0z=0&#x18;&#xb;
++ sil norm 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
++ sil! norm &#x16;0z=0&#x18;&#xb;
++
++ bwipe!
++ nunmap 0
++endfunc
++
+ " Test spellsuggest({word} , {max} , {capital})
+ func Test_spellsuggest()
+ " Verify suggestions are given even when spell checking is not enabled.
+-- 
+1.8.3.1
+

_service:tar_scm:backport-CVE-2022-2343.patch Added

@@ -0,0 +1,235 @@
+FROM CAEA66442D86E7BBBA3BF3DC202C3C0D549B9853 MON SEP 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Thu, 7 Jul 2022 19:42:04 +0100
+Subject: PATCH patch 9.0.0045: reading past end of completion with a
+ long line
+
+Problem: Reading past end of completion with a long line and 'infercase'
+set.
+Solution: Allocate the string if needed.
+---
+ src/insexpand.c | 94 ++++++++++++++++++++++---------
+ src/testdir/test_ins_complete.vim | 16 ++++++
+ 2 files changed, 82 insertions(+), 28 deletions(-)
+
+diff --git a/src/insexpand.c b/src/insexpand.c
+index 734550f..0ecb656 100644
+--- a/src/insexpand.c
++++ b/src/insexpand.c
+@@ -524,29 +524,32 @@ ins_compl_accept_char(int c)
+ 
+ /*
+ * Get the completed text by inferring the case of the originally typed text.
++ * If the result is in allocated memory "tofree" is set to it.
+ */
+ static char_u *
+ ins_compl_infercase_gettext(
+ 	char_u	*str,
+-	int	actual_len,
+-	int	actual_compl_length,
+-	int	min_len)
++	int	char_len,
++	int	compl_char_len,
++	int	min_len,
++	char_u **tofree)
+ {
+ int		*wca;			// Wide character array.
+ char_u	*p;
+ int		i, c;
+ int		has_lower = FALSE;
+ int		was_letter = FALSE;
++ garray_T	gap;
+ 
+ IObuff0 = NUL;
+ 
+ // Allocate wide character array for the completion and fill it.
+- wca = ALLOC_MULT(int, actual_len);
++ wca = ALLOC_MULT(int, char_len);
+ if (wca == NULL)
+ 	return IObuff;
+ 
+ p = str;
+- for (i = 0; i < actual_len; ++i)
++ for (i = 0; i < char_len; ++i)
+ 	if (has_mbyte)
+ 	 wcai = mb_ptr2char_adv(&p);
+ 	else
+@@ -566,7 +569,7 @@ ins_compl_infercase_gettext(
+ 	 if (MB_ISUPPER(wcai))
+ 	 {
+ 		// Rule 1 is satisfied.
+-		for (i = actual_compl_length; i < actual_len; ++i)
++		for (i = compl_char_len; i < char_len; ++i)
+ 		 wcai = MB_TOLOWER(wcai);
+ 		break;
+ 	 }
+@@ -587,7 +590,7 @@ ins_compl_infercase_gettext(
+ 	 if (was_letter && MB_ISUPPER(c) && MB_ISLOWER(wcai))
+ 	 {
+ 		// Rule 2 is satisfied.
+-		for (i = actual_compl_length; i < actual_len; ++i)
++		for (i = compl_char_len; i < char_len; ++i)
+ 		 wcai = MB_TOUPPER(wcai);
+ 		break;
+ 	 }
+@@ -610,20 +613,52 @@ ins_compl_infercase_gettext(
+ }
+ 
+ // Generate encoding specific output from wide character array.
+- // Multi-byte characters can occupy up to five bytes more than
+- // ASCII characters, and we also need one byte for NUL, so stay
+- // six bytes away from the edge of IObuff.
+ p = IObuff;
+ i = 0;
+- while (i < actual_len && (p - IObuff + 6) < IOSIZE)
+-	if (has_mbyte)
++ ga_init2(&gap, 1, 500);
++ while (i < char_len)
++ {
++	if (gap.ga_data != NULL)
++	{
++	 if (ga_grow(&gap, 10) == FAIL)
++	 {
++		ga_clear(&gap);
++		return (char_u *)"failed";
++	 }
++	 p = (char_u *)gap.ga_data + gap.ga_len;
++	 if (has_mbyte)
++		gap.ga_len += (*mb_char2bytes)(wcai++, p);
++	 else
++	 {
++		*p = wcai++;
++		++gap.ga_len;
++	 }
++	}
++	else if ((p - IObuff) + 6 >= IOSIZE)
++	{
++	 // Multi-byte characters can occupy up to five bytes more than
++	 // ASCII characters, and we also need one byte for NUL, so when
++	 // getting to six bytes from the edge of IObuff switch to using a
++	 // growarray. Add the character in the next round.
++	 if (ga_grow(&gap, IOSIZE) == FAIL)
++		return (char_u *)"failed";
++	 STRCPY(gap.ga_data, IObuff);
++	 gap.ga_len = STRLEN(IObuff);
++	}
++	else if (has_mbyte)
+ 	 p += (*mb_char2bytes)(wcai++, p);
+ 	else
+ 	 *(p++) = wcai++;
+- *p = NUL;
+-
++ }
+ vim_free(wca);
+ 
++ if (gap.ga_data != NULL)
++ {
++	*tofree = gap.ga_data;
++	return gap.ga_data;
++ }
++
++ *p = NUL;
+ return IObuff;
+ }
+ 
+@@ -644,10 +679,12 @@ ins_compl_add_infercase(
+ {
+ char_u	*str = str_arg;
+ char_u	*p;
+- int		actual_len;		// Take multi-byte characters
+- int		actual_compl_length;	// into account.
++ int		char_len;		// count multi-byte characters
++ int		compl_char_len;
+ int		min_len;
+ int		flags = 0;
++ int		res;
++ char_u	*tofree = NULL;
+ 
+ if (p_ic && curbuf->b_p_inf && len > 0)
+ {
+@@ -657,44 +694,45 @@ ins_compl_add_infercase(
+ 	if (has_mbyte)
+ 	{
+ 	 p = str;
+-	 actual_len = 0;
++	 char_len = 0;
+ 	 while (*p != NUL)
+ 	 {
+ 		MB_PTR_ADV(p);
+-		++actual_len;
++		++char_len;
+ 	 }
+ 	}
+ 	else
+-	 actual_len = len;
++	 char_len = len;
+ 
+ 	// Find actual length of original text.
+ 	if (has_mbyte)
+ 	{
+ 	 p = compl_orig_text;
+-	 actual_compl_length = 0;
++	 compl_char_len = 0;
+ 	 while (*p != NUL)
+ 	 {
+ 		MB_PTR_ADV(p);
+-		++actual_compl_length;
++		++compl_char_len;
+ 	 }
+ 	}
+ 	else
+-	 actual_compl_length = compl_length;
++	 compl_char_len = compl_length;
+ 
+-	// "actual_len" may be smaller than "actual_compl_length" when using
++	// "char_len" may be smaller than "compl_char_len" when using
+ 	// thesaurus, only use the minimum when comparing.
+-	min_len = actual_len < actual_compl_length
+-					 ? actual_len : actual_compl_length;
++	min_len = char_len < compl_char_len ? char_len : compl_char_len;
+ 
+-	str = ins_compl_infercase_gettext(str, actual_len, actual_compl_length,
+-								min_len);
++	str = ins_compl_infercase_gettext(str, char_len,
++					 compl_char_len, min_len, &tofree);
+ }
+ if (cont_s_ipos)
+ 	flags |= CP_CONT_S_IPOS;
+ if (icase)
+ 	flags |= CP_ICASE;

_service:tar_scm:backport-CVE-2022-2344.patch Added

@@ -0,0 +1,50 @@
+From baefde14550231f6468ac2ed2ed495bc381c0c92 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Thu, 7 Jul 2022 19:59:49 +0100
+Subject: PATCH patch 9.0.0046: reading past end of completion with
+ duplicate match
+
+Problem: Reading past end of completion with duplicate match.
+Solution: Check string length
+---
+ src/insexpand.c | 3 ++-
+ src/testdir/test_ins_complete.vim | 10 ++++++++++
+ 2 files changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/src/insexpand.c b/src/insexpand.c
+index 0ecb656..9c598a8 100644
+--- a/src/insexpand.c
++++ b/src/insexpand.c
+@@ -786,7 +786,8 @@ ins_compl_add(
+ 	{
+ 	 if (!match_at_original_text(match)
+ 		 && STRNCMP(match->cp_str, str, len) == 0
+-		 && match->cp_strlen == NUL)
++		 && ((int)STRLEN(match->cp_str) <= len
++						 || match->cp_strlen == NUL))
+ 		return NOTDONE;
+ 	 match = match->cp_next;
+ 	} while (match != NULL && !is_first_match(match));
+diff --git a/src/testdir/test_ins_complete.vim b/src/testdir/test_ins_complete.vim
+index 5e5b1bb..2be6d06 100644
+--- a/src/testdir/test_ins_complete.vim
++++ b/src/testdir/test_ins_complete.vim
+@@ -2112,5 +2112,15 @@ func Test_infercase_very_long_line()
+ set noic noinfercase
+ endfunc
+ 
++func Test_ins_complete_add()
++ " this was reading past the end of allocated memory
++ new
++ norm o&#x7f;
++ norm 7o
++ sil! norm o&#x10;&#x18;&#x10;&#x18;&#x10;
++
++ bwipe!
++endfunc
++
+ 
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+1.8.3.1
+

_service:tar_scm:backport-CVE-2022-2345.patch Added

@@ -0,0 +1,79 @@
+From 32acf1f1a72ebb9d8942b9c9d80023bf1bb668ea Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Thu, 7 Jul 2022 22:20:31 +0100
+Subject: PATCH patch 9.0.0047: using freed memory with recursive
+ substitute
+
+Problem: Using freed memory with recursive substitute.
+Solution: Always make a copy for reg_prev_sub.
+---
+ src/ex_cmds.c | 11 ++++++++++-
+ src/regexp.c | 8 ++++----
+ src/testdir/test_regexp_latin.vim | 11 +++++++++++
+ 3 files changed, 25 insertions(+), 5 deletions(-)
+
+diff --git a/src/ex_cmds.c b/src/ex_cmds.c
+index eb3016f..5253863 100644
+--- a/src/ex_cmds.c
++++ b/src/ex_cmds.c
+@@ -3994,7 +3994,16 @@ ex_substitute(exarg_T *eap)
+ 	sub_copy = sub;
+ }
+ else
+-	sub = regtilde(sub, magic_isset());
++ {
++	char_u *newsub = regtilde(sub, magic_isset());
++
++	if (newsub != sub)
++	{
++	 // newsub was allocated, free it later.
++	 sub_copy = newsub;
++	 sub = newsub;
++	}
++ }
+ 
+ /*
+ * Check for a match on each line.
+diff --git a/src/regexp.c b/src/regexp.c
+index 2cbe64e..f35a5e8 100644
+--- a/src/regexp.c
++++ b/src/regexp.c
+@@ -1766,11 +1766,11 @@ regtilde(char_u *source, int magic)
+ 	}
+ }
+ 
++ // Store a copy of newsub in reg_prev_sub. It is always allocated,
++ // because recursive calls may make the returned string invalid.
+ vim_free(reg_prev_sub);
+- if (newsub != source)	// newsub was allocated, just keep it
+-	reg_prev_sub = newsub;
+- else			// no ~ found, need to save newsub
+-	reg_prev_sub = vim_strsave(newsub);
++ reg_prev_sub = vim_strsave(newsub);
++
+ return newsub;
+ }
+ 
+diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim
+index 1fe4699..dce6709 100644
+--- a/src/testdir/test_regexp_latin.vim
++++ b/src/testdir/test_regexp_latin.vim
+@@ -1114,4 +1114,15 @@ func Test_using_two_engines_pattern()
+ bwipe!
+ endfunc
+ 
++func Test_recursive_substitute_expr()
++ new
++ func Repl()
++ s
++ endfunc
++ silent! s/\%')/~\=Repl()
++
++ bwipe!
++ delfunc Repl
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+1.8.3.1
+

_service:tar_scm:backport-CVE-2022-2522.patch Added

@@ -0,0 +1,46 @@
+From b9e717367c395490149495cf375911b5d9de889e Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Sat, 23 Jul 2022 06:53:08 +0100
+Subject: PATCH patch 9.0.0060: accessing uninitialized memory when
+ completing long line
+
+Problem: Accessing uninitialized memory when completing long line.
+Solution: Terminate string with NUL.
+---
+ src/insexpand.c | 1 +
+ src/testdir/test_ins_complete.vim | 7 +++++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/src/insexpand.c b/src/insexpand.c
+index b49a631..c505158 100644
+--- a/src/insexpand.c
++++ b/src/insexpand.c
+@@ -642,6 +642,7 @@ ins_compl_infercase_gettext(
+ 	 // growarray. Add the character in the next round.
+ 	 if (ga_grow(&gap, IOSIZE) == FAIL)
+ 		return (char_u *)"failed";
++	 *p = NUL;
+ 	 STRCPY(gap.ga_data, IObuff);
+ 	 gap.ga_len = (int)STRLEN(IObuff);
+ 	}
+diff --git a/src/testdir/test_ins_complete.vim b/src/testdir/test_ins_complete.vim
+index 2be6d06..7bebc5d 100644
+--- a/src/testdir/test_ins_complete.vim
++++ b/src/testdir/test_ins_complete.vim
+@@ -2108,6 +2108,13 @@ func Test_infercase_very_long_line()
+ exe "normal 2Go\<C-X>\<C-L>\<Esc>"
+ call assert_equal(longLine, getline(3))
+ 
++ " check that the too long text is NUL terminated
++ %del
++ norm o
++ norm 1987ax
++ exec "norm ox\<C-X>\<C-L>"
++ call assert_equal(repeat('x', 1987), getline(3))
++
+ bwipe!
+ set noic noinfercase
+ endfunc
+-- 
+1.8.3.1
+

_service:tar_scm:backport-CVE-2022-2571.patch Added

@@ -0,0 +1,47 @@
+From a6f9e300161f4cb54713da22f65b261595e8e614 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Thu, 28 Jul 2022 21:51:37 +0100
+Subject: PATCH patch 9.0.0102: reading past end of line with insert mode
+ completion
+
+Problem: Reading past end of line with insert mode completion.
+Solution: Check text length.
+---
+ src/insexpand.c | 2 +-
+ src/testdir/test_ins_complete.vim | 8 ++++++++
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/src/insexpand.c b/src/insexpand.c
+index 7339ce9..fc3eff0 100644
+--- a/src/insexpand.c
++++ b/src/insexpand.c
+@@ -3501,7 +3501,7 @@ ins_comp_get_next_word_or_line(
+ {
+ 	char_u	*tmp_ptr = ptr;
+ 
+-	if (compl_status_adding())
++	if (compl_status_adding() && compl_length <= (int)STRLEN(tmp_ptr))
+ 	{
+ 	 tmp_ptr += compl_length;
+ 	 // Skip if already inside a word.
+diff --git a/src/testdir/test_ins_complete.vim b/src/testdir/test_ins_complete.vim
+index 35c5785..2b0a294 100644
+--- a/src/testdir/test_ins_complete.vim
++++ b/src/testdir/test_ins_complete.vim
+@@ -2142,5 +2142,13 @@ func Test_ins_complete_add()
+ bwipe!
+ endfunc
+ 
++func Test_ins_complete_end_of_line()
++ " this was reading past the end of the line
++ new 
++ norm 8oý 
++ sil! norm o&#x10;&#x18;&#x10;&#x18;&#x10;
++
++ bwipe!
++endfunc
+ 
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+1.8.3.1
+

_service:tar_scm:backport-CVE-2022-2580.patch Added

_service:tar_scm:backport-CVE-2022-2581.patch Added

@@ -0,0 +1,65 @@
+From f50940531dd57135fe60aa393ac9d3281f352d88 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Fri, 29 Jul 2022 16:22:25 +0100
+Subject: PATCH 002/123 patch 9.0.0105: illegal memory access when pattern
+ starts with illegal byte
+
+Problem: Illegal memory access when pattern starts with illegal byte.
+Solution: Do not match a character with an illegal byte.
+---
+ src/regexp.c | 6 +++++-
+ src/testdir/test_regexp_utf8.vim | 15 +++++++++++++++
+ 2 files changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/src/regexp.c b/src/regexp.c
+index 1a5cfd0..bec0464 100644
+--- a/src/regexp.c
++++ b/src/regexp.c
+@@ -1641,7 +1641,11 @@ cstrchr(char_u *s, int c)
+ 	{
+ 	 if (enc_utf8 && c > 0x80)
+ 	 {
+-		if (utf_fold(utf_ptr2char(p)) == cc)
++		int uc = utf_ptr2char(p);
++
++		// Do not match an illegal byte. E.g. 0xff matches 0xc3 0xbf,
++		// not 0xff.
++		if ((uc < 0x80 || uc != *p) && utf_fold(uc) == cc)
+ 		 return p;
+ 	 }
+ 	 else if (*p == c || *p == cc)
+diff --git a/src/testdir/test_regexp_utf8.vim b/src/testdir/test_regexp_utf8.vim
+index d88e263..e7672dd 100644
+--- a/src/testdir/test_regexp_utf8.vim
++++ b/src/testdir/test_regexp_utf8.vim
+@@ -1,5 +1,7 @@
+ " Tests for regexp in utf8 encoding
+ 
++source shared.vim
++
+ func s:equivalence_test()
+ let str = "AÀÁÂÃÄÅĀĂĄǍǞǠǺȂȦȺḀẠẢẤẦẨẪẬẮẰẲẴẶ BƁɃḂḄḆ CÇĆĈĊČƇȻḈꞒ DĎĐƊḊḌḎḐḒ EÈÉÊËĒĔĖĘĚȄȆȨɆḔḖḘḚḜẸẺẼẾỀỂỄỆ FƑḞꞘ GĜĞĠĢƓǤǦǴḠꞠ HĤĦȞḢḤḦḨḪⱧ IÌÍÎÏĨĪĬĮİƗǏȈȊḬḮỈỊ JĴɈ KĶƘǨḰḲḴⱩꝀ LĹĻĽĿŁȽḶḸḺḼⱠ MḾṀṂ NÑŃŅŇǸṄṆṈṊꞤ OÒÓÔÕÖØŌŎŐƟƠǑǪǬǾȌȎȪȬȮȰṌṎṐṒỌỎỐỒỔỖỘỚỜỞỠỢ PƤṔṖⱣ QɊ RŔŖŘȐȒɌṘṚṜṞⱤꞦ SŚŜŞŠȘṠṢṤṦṨⱾꞨ TŢŤŦƬƮȚȾṪṬṮṰ UÙÚÛÜŨŪŬŮŰƯǕǙǛǓǗȔȖɄṲṴṶṸṺỤỦỨỪỬỮỰ VƲṼṾ WŴẀẂẄẆẈ XẊẌ YÝŶŸƳȲɎẎỲỴỶỸ ZŹŻŽƵẐẒẔⱫ aàáâãäåāăąǎǟǡǻȃȧᶏḁẚạảấầẩẫậắằẳẵặⱥ bƀɓᵬᶀḃḅḇ cçćĉċčƈȼḉꞓꞔ dďđɗᵭᶁᶑḋḍḏḑḓ eèéêëēĕėęěȅȇȩɇᶒḕḗḙḛḝẹẻẽếềểễệ fƒᵮᶂḟꞙ gĝğġģǥǧǵɠᶃḡꞡ hĥħȟḣḥḧḩḫẖⱨꞕ iìíîïĩīĭįǐȉȋɨᶖḭḯỉị jĵǰɉ kķƙǩᶄḱḳḵⱪꝁ lĺļľŀłƚḷḹḻḽⱡ mᵯḿṁṃ nñńņňŉǹᵰᶇṅṇṉṋꞥ oòóôõöøōŏőơǒǫǭǿȍȏȫȭȯȱɵṍṏṑṓọỏốồổỗộớờởỡợ pƥᵱᵽᶈṕṗ qɋʠ rŕŗřȑȓɍɽᵲᵳᶉṛṝṟꞧ sśŝşšșȿᵴᶊṡṣṥṧṩꞩ tţťŧƫƭțʈᵵṫṭṯṱẗⱦ uùúûüũūŭůűųǚǖưǔǘǜȕȗʉᵾᶙṳṵṷṹṻụủứừửữự vʋᶌṽṿ wŵẁẃẅẇẉẘ xẋẍ yýÿŷƴȳɏẏẙỳỵỷỹ zźżžƶᵶᶎẑẓẕⱬ"
+ let groups = split(str)
+@@ -560,6 +562,19 @@ func Test_match_invalid_byte()
+ call delete('Xinvalid')
+ endfunc
+ 
++func Test_match_illegal_byte()
++ let lines =<< trim END
++ silent! buffer ÿ\c
++ next ÿ
++ 0scriptnames
++ source
++ END
++ call writefile(lines, 'Xregexp')
++ call system(GetVimCommand() .. ' -X -Z -e -s -S Xregexp -c qa!')
++
++ call delete('Xregexp')
++endfunc
++
+ func Test_match_too_complicated()
+ set regexpengine=1
+ exe "noswapfile vsplit \xeb\xdb\x99"
+-- 
+1.8.3.1
+

_service:tar_scm:backport-CVE-2022-2598.patch Added

@@ -0,0 +1,67 @@
+From 4e677b9c40ccbc5f090971b31dc2fe07bf05541d Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Thu, 28 Jul 2022 18:44:27 +0100
+Subject: PATCH patch 9.0.0101: invalid memory access in diff mode with "dp"
+ and undo
+
+Problem: Invalid memory access in diff mode with "dp" and undo.
+Solution: Make sure the line number does not go below one.
+---
+ src/diff.c | 9 ++++++---
+ src/testdir/test_diffmode.vim | 14 ++++++++++++++
+ 2 files changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/src/diff.c b/src/diff.c
+index e4bafe2..fb43eee 100644
+--- a/src/diff.c
++++ b/src/diff.c
+@@ -464,7 +464,10 @@ diff_mark_adjust_tp(
+ 		 for (i = 0; i < DB_COUNT; ++i)
+ 			if (tp->tp_diffbufi != NULL && i != idx)
+ 			{
+-			 dp->df_lnumi -= off;
++			 if (dp->df_lnumi > off)
++				dp->df_lnumi -= off;
++			 else
++				dp->df_lnumi = 1;
+ 			 dp->df_counti += n;
+ 			}
+ 		}
+@@ -2863,8 +2866,8 @@ ex_diffgetput(exarg_T *eap)
+ 	 {
+ 		// remember deleting the last line of the buffer
+ 		buf_empty = curbuf->b_ml.ml_line_count == 1;
+-		ml_delete(lnum);
+-		--added;
++		if (ml_delete(lnum) == OK)
++		 --added;
+ 	 }
+ 	 for (i = 0; i < dp->df_countidx_from - start_skip - end_skip; ++i)
+ 	 {
+diff --git a/src/testdir/test_diffmode.vim b/src/testdir/test_diffmode.vim
+index dcacd55..41f7fe3 100644
+--- a/src/testdir/test_diffmode.vim
++++ b/src/testdir/test_diffmode.vim
+@@ -1628,5 +1628,19 @@ func Test_diff_manipulations()
+ %bwipe!
+ endfunc
+ 
++" This was causing the line number in the diff block to go below one.
++" FIXME: somehow this causes a valgrind error when run directly but not when
++" run as a test.
++func Test_diff_put_and_undo()
++ set diff
++ next 0
++ split 00
++ sil! norm o0&#x1b;gguudpo0&#x1b;ggJuudp
++
++ bwipe!
++ bwipe!
++ set nodiff
++endfunc
++
+ 
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+1.8.3.1
+

_service:tar_scm:backport-CVE-2022-2816.patch Added

@@ -0,0 +1,58 @@
+From dbdd16b62560413abcc3c8e893cc3010ccf31666 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Sun, 14 Aug 2022 21:46:07 +0100
+Subject: PATCH patch 9.0.0212: invalid memory access when compiling :unlet
+
+Problem: Invalid memory access when compiling :unlet.
+Solution: Don't read past the end of the line.
+---
+ src/testdir/test_vim9_cmd.vim | 11 +++++++++--
+ src/vim9cmds.c | 6 ++++++
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/src/testdir/test_vim9_cmd.vim b/src/testdir/test_vim9_cmd.vim
+index 16f534e..a40f261 100644
+--- a/src/testdir/test_vim9_cmd.vim
++++ b/src/testdir/test_vim9_cmd.vim
+@@ -1704,12 +1704,19 @@ def Test_lockvar()
+ 
+ lines =<< trim END
+ def _()
+- s:0(, s:0)
+ lockv
+ enddef
+ defcomp
+ END
+- v9.CheckScriptFailure(lines, 'E179', 2)
++ v9.CheckScriptFailure(lines, 'E179', 1)
++
++ lines =<< trim END
++ def T()
++ unlet
++ enddef
++ defcomp
++ END
++ v9.CheckScriptFailure(lines, 'E179', 1)
+ enddef
+ 
+ def Test_substitute_expr()
+diff --git a/src/vim9cmds.c b/src/vim9cmds.c
+index 35a3821..93032d6 100644
+--- a/src/vim9cmds.c
++++ b/src/vim9cmds.c
+@@ -92,6 +92,12 @@ free_locals(cctx_T *cctx)
+ int
+ check_vim9_unlet(char_u *name)
+ {
++ if (*name == NUL)
++ {
++	semsg(_(e_argument_required_for_str), "unlet");
++	return FAIL;
++ }
++
+ if (name1 != ':' || vim_strchr((char_u *)"gwtb", *name) == NULL)
+ {
+ 	// "unlet s:var" is allowed in legacy script.
+-- 
+2.36.1
+

_service:tar_scm:backport-CVE-2022-2817.patch Added

@@ -0,0 +1,75 @@
+From 249e1b903a9c0460d618f6dcc59aeb8c03b24b20 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Sun, 14 Aug 2022 22:23:02 +0100
+Subject: PATCH patch 9.0.0213: using freed memory with error in assert
+ argument
+
+Problem: Using freed memory with error in assert argument.
+Solution: Make a copy of the error.
+---
+ src/testdir/test_assert.vim | 4 ++++
+ src/testing.c | 18 ++++++++++++------
+ 2 files changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/src/testdir/test_assert.vim b/src/testdir/test_assert.vim
+index 27b2d73..7c9d090 100644
+--- a/src/testdir/test_assert.vim
++++ b/src/testdir/test_assert.vim
+@@ -291,6 +291,10 @@ func Test_assert_fail_fails()
+ let exp = v:exception
+ endtry
+ call assert_match("E1174: String required for argument 5", exp)
++
++ call assert_equal(1, assert_fails('c0', '', '\1'))
++ call assert_match("Expected '\\\\\\\\1' but got 'E939: Positive count required: c0': c0", v:errors0)
++ call remove(v:errors, 0)
+ endfunc
+ 
+ func Test_assert_fails_in_try_block()
+diff --git a/src/testing.c b/src/testing.c
+index c49df4b..43b8d20 100644
+--- a/src/testing.c
++++ b/src/testing.c
+@@ -597,6 +597,7 @@ f_assert_fails(typval_T *argvars, typval_T *rettv)
+ int		save_trylevel = trylevel;
+ int		called_emsg_before = called_emsg;
+ char	*wrong_arg_msg = NULL;
++ char_u	*tofree = NULL;
+ 
+ if (check_for_string_or_number_arg(argvars, 0) == FAIL
+ 	 || check_for_opt_string_or_list_arg(argvars, 1) == FAIL
+@@ -660,13 +661,17 @@ f_assert_fails(typval_T *argvars, typval_T *rettv)
+ 	 }
+ 	 else if (list->lv_len == 2)
+ 	 {
+-		tv = &list->lv_u.mat.lv_last->li_tv;
+-		actual = get_vim_var_str(VV_ERRMSG);
+-		expected = tv_get_string_buf_chk(tv, buf);
+-		if (!pattern_match(expected, actual, FALSE))
++		// make a copy, an error in pattern_match() may free it
++		tofree = actual = vim_strsave(get_vim_var_str(VV_ERRMSG));
++		if (actual != NULL)
+ 		{
+-		 error_found = TRUE;
+-		 expected_str = expected;
++		 tv = &list->lv_u.mat.lv_last->li_tv;
++		 expected = tv_get_string_buf_chk(tv, buf);
++		 if (!pattern_match(expected, actual, FALSE))
++		 {
++			error_found = TRUE;
++			expected_str = expected;
++		 }
+ 		}
+ 	 }
+ 	}
+@@ -749,6 +754,7 @@ theend:
+ msg_scrolled = 0;
+ lines_left = Rows;
+ VIM_CLEAR(emsg_assert_fails_msg);
++ vim_free(tofree);
+ set_vim_var_string(VV_ERRMSG, NULL, 0);
+ if (wrong_arg_msg != NULL)
+ 	emsg(_(wrong_arg_msg));
+-- 
+2.36.1
+

_service:tar_scm:backport-CVE-2022-2819.patch Added

@@ -0,0 +1,66 @@
+From d1d8f6bacb489036d0fd479c9dd3c0102c988889 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Sun, 14 Aug 2022 21:28:32 +0100
+Subject: PATCH patch 9.0.0211: invalid memory access when compiling :lockvar
+
+Problem: Invalid memory access when compiling :lockvar.
+Solution: Don't read past the end of the line.
+---
+ src/testdir/test_vim9_cmd.vim | 9 +++++++++
+ src/vim9cmds.c | 9 +++++++--
+ 2 files changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/src/testdir/test_vim9_cmd.vim b/src/testdir/test_vim9_cmd.vim
+index 7db8e50..16f534e 100644
+--- a/src/testdir/test_vim9_cmd.vim
++++ b/src/testdir/test_vim9_cmd.vim
+@@ -1701,6 +1701,15 @@ def Test_lockvar()
+ UnLockIt()
+ END
+ v9.CheckScriptFailure(lines, 'E46', 1)
++
++ lines =<< trim END
++ def _()
++ s:0(, s:0)
++ lockv
++ enddef
++ defcomp
++ END
++ v9.CheckScriptFailure(lines, 'E179', 2)
+ enddef
+ 
+ def Test_substitute_expr()
+diff --git a/src/vim9cmds.c b/src/vim9cmds.c
+index ad32c32..35a3821 100644
+--- a/src/vim9cmds.c
++++ b/src/vim9cmds.c
+@@ -188,10 +188,17 @@ compile_lock_unlock(
+ size_t	len;
+ char_u	*buf;
+ isntype_T	isn = ISN_EXEC;
++ char	*cmd = eap->cmdidx == CMD_lockvar ? "lockvar" : "unlockvar";
+ 
+ if (cctx->ctx_skip == SKIP_YES)
+ 	return OK;
+ 
++ if (*p == NUL)
++ {
++	semsg(_(e_argument_required_for_str), cmd);
++	return FAIL;
++ }
++
+ // Cannot use :lockvar and :unlockvar on local variables.
+ if (p1 != ':')
+ {
+@@ -223,8 +230,6 @@ compile_lock_unlock(
+ 	ret = FAIL;
+ else
+ {
+-	char *cmd = eap->cmdidx == CMD_lockvar ? "lockvar" : "unlockvar";
+-
+ 	if (deep < 0)
+ 	 vim_snprintf((char *)buf, len, "%s! %s", cmd, p);
+ 	else
+-- 
+2.36.1
+

_service:tar_scm:backport-CVE-2022-2845.patch Added

@@ -0,0 +1,61 @@
+From e98c88c44c308edaea5994b8ad4363e65030968c Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Tue, 16 Aug 2022 14:51:53 +0100
+Subject: PATCH patch 9.0.0218: reading before the start of the line
+
+Problem: Reading before the start of the line.
+Solution: When displaying "$" check the column is not negative.
+---
+ src/edit.c | 3 ++-
+ src/proto/edit.pro | 2 +-
+ src/testdir/test_cmdline.vim | 8 ++++++++
+ 3 files changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/src/edit.c b/src/edit.c
+index a8e695c..96f47bd 100644
+--- a/src/edit.c
++++ b/src/edit.c
+@@ -1741,8 +1741,9 @@ edit_unputchar(void)
+ * Only works when cursor is in the line that changes.
+ */
+ void
+-display_dollar(colnr_T col)
++display_dollar(colnr_T col_arg)
+ {
++ colnr_T col = col_arg < 0 ? 0 : col_arg;
+ colnr_T save_col;
+ 
+ if (!redrawing())
+diff --git a/src/proto/edit.pro b/src/proto/edit.pro
+index a233e40..f35ec1e 100644
+--- a/src/proto/edit.pro
++++ b/src/proto/edit.pro
+@@ -5,7 +5,7 @@ void ins_redraw(int ready);
+ void edit_putchar(int c, int highlight);
+ void set_insstart(linenr_T lnum, int col);
+ void edit_unputchar(void);
+-void display_dollar(colnr_T col);
++void display_dollar(colnr_T col_arg);
+ void undisplay_dollar(void);
+ void truncate_spaces(char_u *line);
+ void backspace_until_column(int col);
+diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
+index f0498a1..08e2de7 100644
+--- a/src/testdir/test_cmdline.vim
++++ b/src/testdir/test_cmdline.vim
+@@ -3439,4 +3439,12 @@ func Test_long_error_message()
+ silent! norm Q00000000000000     000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000                                                                                                                                                                                                                        
+ endfunc
+ 
++func Test_cmdwin_virtual_edit()
++ enew!
++ set ve=all cpo+=$
++ silent normal q/s
++
++ set ve= cpo-=$
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+2.36.1
+

_service:tar_scm:backport-CVE-2022-2849.patch Added

@@ -0,0 +1,103 @@
+From f6d39c31d2177549a986d170e192d8351bd571e2 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Tue, 16 Aug 2022 17:50:38 +0100
+Subject: PATCH patch 9.0.0220: invalid memory access with for loop over NULL
+ string
+
+Problem: Invalid memory access with for loop over NULL string.
+Solution: Make sure mb_ptr2len() consistently returns zero for NUL.
+---
+ src/globals.h | 3 ++-
+ src/mbyte.c | 21 +++++++++++++--------
+ src/testdir/test_eval_stuff.vim | 12 ++++++++++++
+ 3 files changed, 27 insertions(+), 9 deletions(-)
+
+diff --git a/src/globals.h b/src/globals.h
+index 888f6e9..9b40be4 100644
+--- a/src/globals.h
++++ b/src/globals.h
+@@ -1033,7 +1033,8 @@ EXTERN vimconv_T output_conv;			// type of output conversion
+ * (DBCS).
+ * The value is set in mb_init();
+ */
+-// length of char in bytes, including following composing chars
++// Length of char in bytes, including any following composing chars.
++// NUL has length zero.
+ EXTERN int (*mb_ptr2len)(char_u *p) INIT(= latin_ptr2len);
+ 
+ // idem, with limit on string length
+diff --git a/src/mbyte.c b/src/mbyte.c
+index 3656880..782a7ad 100644
+--- a/src/mbyte.c
++++ b/src/mbyte.c
+@@ -1077,24 +1077,28 @@ dbcs_char2bytes(int c, char_u *buf)
+ }
+ 
+ /*
+- * mb_ptr2len() function pointer.
+- * Get byte length of character at "*p" but stop at a NUL.
+- * For UTF-8 this includes following composing characters.
+- * Returns 0 when *p is NUL.
++ * Get byte length of character at "*p". Returns zero when "*p" is NUL.
++ * Used for mb_ptr2len() when 'encoding' latin.
+ */
+ int
+ latin_ptr2len(char_u *p)
+ {
+- return MB_BYTE2LEN(*p);
++ return *p == NUL ? 0 : 1;
+ }
+ 
++/*
++ * Get byte length of character at "*p". Returns zero when "*p" is NUL.
++ * Used for mb_ptr2len() when 'encoding' DBCS.
++ */
+ static int
+-dbcs_ptr2len(
+- char_u	*p)
++dbcs_ptr2len(char_u *p)
+ {
+ int		len;
+ 
+- // Check if second byte is not missing.
++ if (*p == NUL)
++	return 0;
++
++ // if the second byte is missing the length is 1
+ len = MB_BYTE2LEN(*p);
+ if (len == 2 && p1 == NUL)
+ 	len = 1;
+@@ -2105,6 +2109,7 @@ utf_ptr2len_len(char_u *p, int size)
+ /*
+ * Return the number of bytes the UTF-8 encoding of the character at "p" takes.
+ * This includes following composing characters.
++ * Returns zero for NUL.
+ */
+ int
+ utfc_ptr2len(char_u *p)
+diff --git a/src/testdir/test_eval_stuff.vim b/src/testdir/test_eval_stuff.vim
+index c63082e..313d791 100644
+--- a/src/testdir/test_eval_stuff.vim
++++ b/src/testdir/test_eval_stuff.vim
+@@ -75,6 +75,18 @@ func Test_for_invalid()
+ redraw
+ endfunc
+ 
++func Test_for_over_null_string()
++ let save_enc = &enc
++ set enc=iso8859
++ let cnt = 0
++ for c in test_null_string()
++ let cnt += 1
++ endfor
++ call assert_equal(0, cnt)
++
++ let &enc = save_enc
++endfunc
++
+ func Test_readfile_binary()
+ new
+ call setline(1, 'one', 'two', 'three')
+-- 
+2.36.1
+

_service:tar_scm:backport-CVE-2022-2862.patch Added

@@ -0,0 +1,72 @@
+From 1889f499a4f248cd84e0e0bf6d0d820016774494 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Tue, 16 Aug 2022 19:34:44 +0100
+Subject: PATCH patch 9.0.0221: accessing freed memory if compiling nested
+ function fails
+
+Problem: Accessing freed memory if compiling nested function fails.
+Solution: Mess up the variable name so that it won't be found.
+---
+ src/testdir/test_vim9_func.vim | 12 ++++++++++++
+ src/vim9compile.c | 7 +++++--
+ 2 files changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/src/testdir/test_vim9_func.vim b/src/testdir/test_vim9_func.vim
+index 33a6615..426fde4 100644
+--- a/src/testdir/test_vim9_func.vim
++++ b/src/testdir/test_vim9_func.vim
+@@ -907,6 +907,18 @@ def Test_nested_function()
+ v9.CheckScriptFailure(lines, 'E1173: Text found after enddef: burp', 3)
+ enddef
+ 
++def Test_nested_function_fails()
++ var lines =<< trim END
++ def T()
++ def Func(g: string):string
++ enddef
++ Func()
++ enddef
++ silent! defcompile
++ END
++ v9.CheckScriptFailure(lines, 'E1069:')
++enddef
++
+ def Test_not_nested_function()
+ echo printf('%d',
+ function('len')('xxx'))
+diff --git a/src/vim9compile.c b/src/vim9compile.c
+index b7f590e..fb39997 100644
+--- a/src/vim9compile.c
++++ b/src/vim9compile.c
+@@ -822,6 +822,7 @@ compile_nested_function(exarg_T *eap, cctx_T *cctx, garray_T *lines_to_free)
+ int		r = FAIL;
+ compiletype_T compile_type;
+ isn_T	*funcref_isn = NULL;
++ lvar_T	*lvar = NULL;
+ 
+ if (eap->forceit)
+ {
+@@ -928,9 +929,8 @@ compile_nested_function(exarg_T *eap, cctx_T *cctx, garray_T *lines_to_free)
+ else
+ {
+ 	// Define a local variable for the function reference.
+-	lvar_T	*lvar = reserve_local(cctx, func_name, name_end - name_start,
++	lvar = reserve_local(cctx, func_name, name_end - name_start,
+ 						 TRUE, ufunc->uf_func_type);
+-
+ 	if (lvar == NULL)
+ 	 goto theend;
+ 	if (generate_FUNCREF(cctx, ufunc, &funcref_isn) == FAIL)
+@@ -949,6 +949,9 @@ compile_nested_function(exarg_T *eap, cctx_T *cctx, garray_T *lines_to_free)
+ 	 && compile_def_function(ufunc, TRUE, compile_type, cctx) == FAIL)
+ {
+ 	func_ptr_unref(ufunc);
++	if (lvar != NULL)
++	 // Now the local variable can't be used.
++	 *lvar->lv_name = '/'; // impossible value
+ 	goto theend;
+ }
+ 
+-- 
+2.36.1
+

_service:tar_scm:backport-CVE-2022-2874.patch Added

@@ -0,0 +1,73 @@
+From 4875d6ab068f09df88d24d81de40dcd8d56e243d Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Wed, 17 Aug 2022 15:55:51 +0100
+Subject: PATCH patch 9.0.0224: Using NULL pointer when skipping compiled
+ code
+
+Problem: Using NULL pointer when skipping compiled code.
+Solution: Check for skipping.
+---
+ src/testdir/test_vim9_script.vim | 13 +++++++++++++
+ src/vim9compile.c | 14 ++++++++++----
+ 2 files changed, 23 insertions(+), 4 deletions(-)
+
+diff --git a/src/testdir/test_vim9_script.vim b/src/testdir/test_vim9_script.vim
+index fc0ef15..75b3e9c 100644
+--- a/src/testdir/test_vim9_script.vim
++++ b/src/testdir/test_vim9_script.vim
+@@ -2097,6 +2097,19 @@ def Test_for_skipped_block()
+ v9.CheckDefAndScriptSuccess(lines)
+ enddef
+ 
++def Test_skipped_redir()
++ var lines =<< trim END
++ def T()
++ if 0
++ redir =>l0
++ redir END
++ endif
++ enddef
++ defcompile
++ END
++ v9.CheckScriptSuccess(lines)
++enddef
++
+ def Test_for_loop()
+ var lines =<< trim END
+ var result = ''
+diff --git a/src/vim9compile.c b/src/vim9compile.c
+index fb39997..a8fa5dc 100644
+--- a/src/vim9compile.c
++++ b/src/vim9compile.c
+@@ -1157,11 +1157,14 @@ generate_loadvar(
+ 	 generate_LOADV(cctx, name + 2);
+ 	 break;
+ 	case dest_local:
+-	 if (lvar->lv_from_outer > 0)
+-		generate_LOADOUTER(cctx, lvar->lv_idx, lvar->lv_from_outer,
++	 if (cctx->ctx_skip != SKIP_YES)
++	 {
++		if (lvar->lv_from_outer > 0)
++		 generate_LOADOUTER(cctx, lvar->lv_idx, lvar->lv_from_outer,
+ 									 type);
+-	 else
+-		generate_LOAD(cctx, ISN_LOAD, lvar->lv_idx, NULL, type);
++		else
++		 generate_LOAD(cctx, ISN_LOAD, lvar->lv_idx, NULL, type);
++	 }
+ 	 break;
+ 	case dest_expr:
+ 	 // list or dict value should already be on the stack.
+@@ -1944,6 +1947,9 @@ compile_assign_unlet(
+ 	}
+ }
+ 
++ if (cctx->ctx_skip == SKIP_YES)
++	return OK;
++
+ // Load the dict or list. On the stack we then have:
+ // - value (for assignment, not for :unlet)
+ // - index
+-- 
+2.36.1
+

_service:tar_scm:backport-CVE-2022-2889.patch Added

@@ -0,0 +1,245 @@
+From 91c7cbfe31bbef57d5fcf7d76989fc159f73ef15 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Thu, 18 Aug 2022 13:28:31 +0100
+Subject: PATCH patch 9.0.0225: using freed memory with multiple line breaks
+ in expression
+
+Problem: Using freed memory with multiple line breaks in expression.
+Solution: Free eval_tofree later.
+---
+ src/eval.c | 102 ++++++++++++++++++-------------
+ src/proto/eval.pro | 4 +-
+ src/testdir/test_vim9_script.vim | 13 ++++
+ src/userfunc.c | 15 -----
+ 4 files changed, 75 insertions(+), 59 deletions(-)
+
+diff --git a/src/eval.c b/src/eval.c
+index 42b883e..60daca5 100644
+--- a/src/eval.c
++++ b/src/eval.c
+@@ -353,6 +353,63 @@ eval_to_string_skip(
+ return retval;
+ }
+ 
++/*
++ * Initialize "evalarg" for use.
++ */
++ void
++init_evalarg(evalarg_T *evalarg)
++{
++ CLEAR_POINTER(evalarg);
++ ga_init2(&evalarg->eval_tofree_ga, sizeof(char_u *), 20);
++}
++
++/*
++ * If "evalarg->eval_tofree" is not NULL free it later.
++ * Caller is expected to overwrite "evalarg->eval_tofree" next.
++ */
++ static void
++free_eval_tofree_later(evalarg_T *evalarg)
++{
++ if (evalarg->eval_tofree != NULL)
++ {
++	if (ga_grow(&evalarg->eval_tofree_ga, 1) == OK)
++	 ((char_u **)evalarg->eval_tofree_ga.ga_data)
++		evalarg->eval_tofree_ga.ga_len++
++		= evalarg->eval_tofree;
++	else
++	 vim_free(evalarg->eval_tofree);
++ }
++}
++
++/*
++ * After using "evalarg" filled from "eap": free the memory.
++ */
++ void
++clear_evalarg(evalarg_T *evalarg, exarg_T *eap)
++{
++ if (evalarg != NULL)
++ {
++	if (evalarg->eval_tofree != NULL)
++	{
++	 if (eap != NULL)
++	 {
++		// We may need to keep the original command line, e.g. for
++		// ":let" it has the variable names. But we may also need the
++		// new one, "nextcmd" points into it. Keep both.
++		vim_free(eap->cmdline_tofree);
++		eap->cmdline_tofree = *eap->cmdlinep;
++		*eap->cmdlinep = evalarg->eval_tofree;
++	 }
++	 else
++		vim_free(evalarg->eval_tofree);
++	 evalarg->eval_tofree = NULL;
++	}
++
++	ga_clear_strings(&evalarg->eval_tofree_ga);
++	VIM_CLEAR(evalarg->eval_tofree_lambda);
++ }
++}
++
+ /*
+ * Skip over an expression at "*pp".
+ * Return FAIL for an error, OK otherwise.
+@@ -435,8 +492,8 @@ skip_expr_concatenate(
+ 		// Do not free the first line, the caller can still use it.
+ 		*((char_u **)gap->ga_data) = NULL;
+ 		// Do not free the last line, "arg" points into it, free it
+-		// later.
+-		vim_free(evalarg->eval_tofree);
++		// later. Also free "eval_tofree" later if needed.
++		free_eval_tofree_later(evalarg);
+ 		evalarg->eval_tofree =
+ 				 ((char_u **)gap->ga_data)gap->ga_len - 1;
+ 		((char_u **)gap->ga_data)gap->ga_len - 1 = NULL;
+@@ -2274,7 +2331,7 @@ eval_next_line(char_u *arg, evalarg_T *evalarg)
+ }
+ else if (evalarg->eval_cookie != NULL)
+ {
+-	vim_free(evalarg->eval_tofree);
++	free_eval_tofree_later(evalarg);
+ 	evalarg->eval_tofree = line;
+ }
+ 
+@@ -2301,45 +2358,6 @@ skipwhite_and_linebreak(char_u *arg, evalarg_T *evalarg)
+ return p;
+ }
+ 
+-/*
+- * Initialize "evalarg" for use.
+- */
+- void
+-init_evalarg(evalarg_T *evalarg)
+-{
+- CLEAR_POINTER(evalarg);
+- ga_init2(&evalarg->eval_tofree_ga, sizeof(char_u *), 20);
+-}
+-
+-/*
+- * After using "evalarg" filled from "eap": free the memory.
+- */
+- void
+-clear_evalarg(evalarg_T *evalarg, exarg_T *eap)
+-{
+- if (evalarg != NULL)
+- {
+-	if (evalarg->eval_tofree != NULL)
+-	{
+-	 if (eap != NULL)
+-	 {
+-		// We may need to keep the original command line, e.g. for
+-		// ":let" it has the variable names. But we may also need the
+-		// new one, "nextcmd" points into it. Keep both.
+-		vim_free(eap->cmdline_tofree);
+-		eap->cmdline_tofree = *eap->cmdlinep;
+-		*eap->cmdlinep = evalarg->eval_tofree;
+-	 }
+-	 else
+-		vim_free(evalarg->eval_tofree);
+-	 evalarg->eval_tofree = NULL;
+-	}
+-
+-	ga_clear_strings(&evalarg->eval_tofree_ga);
+-	VIM_CLEAR(evalarg->eval_tofree_lambda);
+- }
+-}
+-
+ /*
+ * The "evaluate" argument: When FALSE, the argument is only parsed but not
+ * executed. The function may return OK, but the rettv will be of type
+diff --git a/src/proto/eval.pro b/src/proto/eval.pro
+index e6cd892..27a13c9 100644
+--- a/src/proto/eval.pro
++++ b/src/proto/eval.pro
+@@ -9,6 +9,8 @@ int eval_expr_valid_arg(typval_T *tv);
+ int eval_expr_typval(typval_T *expr, typval_T *argv, int argc, typval_T *rettv);
+ int eval_expr_to_bool(typval_T *expr, int *error);
+ char_u *eval_to_string_skip(char_u *arg, exarg_T *eap, int skip);
++void init_evalarg(evalarg_T *evalarg);
++void clear_evalarg(evalarg_T *evalarg, exarg_T *eap);
+ int skip_expr(char_u **pp, evalarg_T *evalarg);
+ int skip_expr_concatenate(char_u **arg, char_u **start, char_u **end, evalarg_T *evalarg);
+ char_u *typval2string(typval_T *tv, int convert);
+@@ -34,8 +36,6 @@ int pattern_match(char_u *pat, char_u *text, int ic);
+ char_u *eval_next_non_blank(char_u *arg, evalarg_T *evalarg, int *getnext);
+ char_u *eval_next_line(char_u *arg, evalarg_T *evalarg);
+ char_u *skipwhite_and_linebreak(char_u *arg, evalarg_T *evalarg);
+-void init_evalarg(evalarg_T *evalarg);
+-void clear_evalarg(evalarg_T *evalarg, exarg_T *eap);
+ int eval0(char_u *arg, typval_T *rettv, exarg_T *eap, evalarg_T *evalarg);
+ int eval0_retarg(char_u *arg, typval_T *rettv, exarg_T *eap, evalarg_T *evalarg, char_u **retarg);
+ int eval1(char_u **arg, typval_T *rettv, evalarg_T *evalarg);
+diff --git a/src/testdir/test_vim9_script.vim b/src/testdir/test_vim9_script.vim
+index 75b3e9c..c09c0d2 100644
+--- a/src/testdir/test_vim9_script.vim
++++ b/src/testdir/test_vim9_script.vim
+@@ -1560,6 +1560,19 @@ def Test_func_redefine_fails()
+ v9.CheckScriptFailure(lines, 'E1073:')
+ enddef
+ 
++def Test_lambda_split()
++ # this was using freed memory, because of the split expression
++ var lines =<< trim END
++ vim9script
++ try
++ 0
++ 0->(0
++ ->a.0(
++ ->u
++ END
++ v9.CheckScriptFailure(lines, 'E1050:')
++enddef
++
+ def Test_fixed_size_list()
+ # will be allocated as one piece of memory, check that changes work
+ var l = 1, 2, 3, 4
+diff --git a/src/userfunc.c b/src/userfunc.c
+index 9b960b7..3777e03 100644
+--- a/src/userfunc.c
++++ b/src/userfunc.c

_service:tar_scm:backport-CVE-2022-2923.patch Added

@@ -0,0 +1,56 @@
+From 6669de1b235843968e88844ca6d3c8dec4b01a9e Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Sun, 21 Aug 2022 20:33:47 +0100
+Subject: PATCH patch 9.0.0240: crash when using ":mkspell" with an
+empty
+ .dic file
+
+Problem: Crash when using ":mkspell" with an empty .dic file.
+Solution: Check for an empty word tree.
+---
+ src/spellfile.c | 4 +++-
+ src/testdir/test_spellfile.vim | 12 ++++++++++++
+ 2 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/src/spellfile.c b/src/spellfile.c
+index 4a0de52..a4407fa 100644
+--- a/src/spellfile.c
++++ b/src/spellfile.c
+@@ -5585,10 +5585,12 @@ sug_filltree(spellinfo_T *spin, slang_T *slang)
+ 
+ /*
+ * Go through the whole case-folded tree, soundfold each word and put it
+- * in the trie.
++ * in the trie. Bail out if the tree is empty.
+ */
+ byts = slang->sl_fbyts;
+ idxs = slang->sl_fidxs;
++ if (byts == NULL || idxs == NULL)
++	return FAIL;
+ 
+ arridx0 = 0;
+ curi0 = 1;
+diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim
+index 38d1ec0..e81aa65 100644
+--- a/src/testdir/test_spellfile.vim
++++ b/src/testdir/test_spellfile.vim
+@@ -1160,4 +1160,16 @@ func Test_mkspellmem_opt()
+ call assert_fails('set mkspellmem=1000,50,0', 'E474:')
+ endfunc
+ 
++" this was using a NULL pointer
++func Test_mkspell_empty_dic()
++ call writefile('1', 'XtestEmpty.dic')
++ call writefile('SOFOFROM abcd', 'SOFOTO ABCD', 'SAL CIA X', 'XtestEmpty.aff')
++ mkspell! XtestEmpty.spl XtestEmpty
++
++ call delete('XtestEmpty.dic')
++ call delete('XtestEmpty.aff')
++ call delete('XtestEmpty.spl')
++endfunc
++
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+2.36.1
+

_service:tar_scm:backport-CVE-2022-2946.patch Added

@@ -0,0 +1,71 @@
+From adce965162dd89bf29ee0e5baf53652e7515762c Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Mon, 22 Aug 2022 16:35:45 +0100
+Subject: PATCH patch 9.0.0246: using freed memory when 'tagfunc' deletes the
+ buffer
+
+Problem: Using freed memory when 'tagfunc' deletes the buffer.
+Solution: Make a copy of the tag name.
+---
+ src/tag.c | 9 ++++++++-
+ src/testdir/test_tagfunc.vim | 12 ++++++++++++
+ 2 files changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/src/tag.c b/src/tag.c
+index 8a351cc..02f0818 100644
+--- a/src/tag.c
++++ b/src/tag.c
+@@ -281,6 +281,7 @@ do_tag(
+ char_u	*buf_ffname = curbuf->b_ffname;	 // name to use for
+ 						 // priority computation
+ int		use_tfu = 1;
++ char_u	*tofree = NULL;
+ 
+ // remember the matches for the last used tag
+ static int		num_matches = 0;
+@@ -630,7 +631,12 @@ do_tag(
+ 	 * When desired match not found yet, try to find it (and others).
+ 	 */
+ 	if (use_tagstack)
+-	 name = tagstacktagstackidx.tagname;
++	{
++	 // make a copy, the tagstack may change in 'tagfunc'
++	 name = vim_strsave(tagstacktagstackidx.tagname);
++	 vim_free(tofree);
++	 tofree = name;
++	}
+ #if defined(FEAT_QUICKFIX)
+ 	else if (g_do_tagpreview != 0)
+ 	 name = ptag_entry.tagname;
+@@ -922,6 +928,7 @@ end_do_tag:
+ g_do_tagpreview = 0;	// don't do tag preview next time
+ # endif
+ 
++ vim_free(tofree);
+ #ifdef FEAT_CSCOPE
+ return jumped_to_tag;
+ #else
+diff --git a/src/testdir/test_tagfunc.vim b/src/testdir/test_tagfunc.vim
+index 05d8473..9582612 100644
+--- a/src/testdir/test_tagfunc.vim
++++ b/src/testdir/test_tagfunc.vim
+@@ -389,4 +389,16 @@ func Test_tagfunc_callback()
+ %bw!
+ endfunc
+ 
++func Test_tagfunc_wipes_buffer()
++ func g:Tag0unc0(t,f,o)
++ bwipe
++ endfunc
++ set tagfunc=g:Tag0unc0
++ new
++ cal assert_fails('tag 0', 'E987:')
++
++ delfunc g:Tag0unc0
++ set tagfunc=
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+1.8.3.1
+

_service:tar_scm:backport-CVE-2022-2980.patch Added

@@ -0,0 +1,172 @@
+From 80525751c5ce9ed82c41d83faf9ef38667bf61b1 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Wed, 24 Aug 2022 19:27:45 +0100
+Subject: PATCH patch 9.0.0259: crash with mouse click when not initialized
+
+Problem: Crash with mouse click when not initialized.
+Solution: Check TabPageIdxs is not NULL.
+---
+ src/mouse.c | 107 ++++++++++++++++++++++---------------------
+ src/testdir/test_tabline.vim | 14 ++++++
+ 2 files changed, 69 insertions(+), 52 deletions(-)
+
+diff --git a/src/mouse.c b/src/mouse.c
+index c39f614..12895f8 100644
+--- a/src/mouse.c
++++ b/src/mouse.c
+@@ -471,74 +471,77 @@ do_mouse(
+ 
+ start_visual.lnum = 0;
+ 
+- // Check for clicking in the tab page line.
+- if (mouse_row == 0 && firstwin->w_winrow > 0)
++ if (TabPageIdxs != NULL) // only when initialized
+ {
+-	if (is_drag)
++	// Check for clicking in the tab page line.
++	if (mouse_row == 0 && firstwin->w_winrow > 0)
+ 	{
+-	 if (in_tab_line)
++	 if (is_drag)
+ 	 {
+-		c1 = TabPageIdxsmouse_col;
+-		tabpage_move(c1 <= 0 ? 9999 : c1 < tabpage_index(curtab)
+-								? c1 - 1 : c1);
++		if (in_tab_line)
++		{
++		 c1 = TabPageIdxsmouse_col;
++		 tabpage_move(c1 <= 0 ? 9999 : c1 < tabpage_index(curtab)
++								 ? c1 - 1 : c1);
++		}
++		return FALSE;
+ 	 }
+-	 return FALSE;
+-	}
+ 
+-	// click in a tab selects that tab page
+-	if (is_click
++	 // click in a tab selects that tab page
++	 if (is_click
+ # ifdef FEAT_CMDWIN
+-		&& cmdwin_type == 0
++		 && cmdwin_type == 0
+ # endif
+-		&& mouse_col < Columns)
+-	{
+-	 in_tab_line = TRUE;
+-	 c1 = TabPageIdxsmouse_col;
+-	 if (c1 >= 0)
++		 && mouse_col < Columns)
+ 	 {
+-		if ((mod_mask & MOD_MASK_MULTI_CLICK) == MOD_MASK_2CLICK)
+-		{
+-		 // double click opens new page
+-		 end_visual_mode_keep_button();
+-		 tabpage_new();
+-		 tabpage_move(c1 == 0 ? 9999 : c1 - 1);
+-		}
+-		else
++		in_tab_line = TRUE;
++		c1 = TabPageIdxsmouse_col;
++		if (c1 >= 0)
+ 		{
+-		 // Go to specified tab page, or next one if not clicking
+-		 // on a label.
+-		 goto_tabpage(c1);
+-
+-		 // It's like clicking on the status line of a window.
+-		 if (curwin != old_curwin)
++		 if ((mod_mask & MOD_MASK_MULTI_CLICK) == MOD_MASK_2CLICK)
++		 {
++			// double click opens new page
+ 			end_visual_mode_keep_button();
+-		}
+-	 }
+-	 else
+-	 {
+-		tabpage_T	*tp;
++			tabpage_new();
++			tabpage_move(c1 == 0 ? 9999 : c1 - 1);
++		 }
++		 else
++		 {
++			// Go to specified tab page, or next one if not clicking
++			// on a label.
++			goto_tabpage(c1);
+ 
+-		// Close the current or specified tab page.
+-		if (c1 == -999)
+-		 tp = curtab;
++			// It's like clicking on the status line of a window.
++			if (curwin != old_curwin)
++			 end_visual_mode_keep_button();
++		 }
++		}
+ 		else
+-		 tp = find_tabpage(-c1);
+-		if (tp == curtab)
+ 		{
+-		 if (first_tabpage->tp_next != NULL)
+-			tabpage_close(FALSE);
++		 tabpage_T	*tp;
++
++		 // Close the current or specified tab page.
++		 if (c1 == -999)
++			tp = curtab;
++		 else
++			tp = find_tabpage(-c1);
++		 if (tp == curtab)
++		 {
++			if (first_tabpage->tp_next != NULL)
++			 tabpage_close(FALSE);
++		 }
++		 else if (tp != NULL)
++			tabpage_close_other(tp, FALSE);
+ 		}
+-		else if (tp != NULL)
+-		 tabpage_close_other(tp, FALSE);
+ 	 }
++	 return TRUE;
++	}
++	else if (is_drag && in_tab_line)
++	{
++	 c1 = TabPageIdxsmouse_col;
++	 tabpage_move(c1 <= 0 ? 9999 : c1 - 1);
++	 return FALSE;
+ 	}
+-	return TRUE;
+- }
+- else if (is_drag && in_tab_line)
+- {
+-	c1 = TabPageIdxsmouse_col;
+-	tabpage_move(c1 <= 0 ? 9999 : c1 - 1);
+-	return FALSE;
+ }
+ 
+ // When 'mousemodel' is "popup" or "popup_setpos", translate mouse events:
+diff --git a/src/testdir/test_tabline.vim b/src/testdir/test_tabline.vim
+index e58a412..556b859 100644
+--- a/src/testdir/test_tabline.vim
++++ b/src/testdir/test_tabline.vim
+@@ -147,4 +147,18 @@ func Test_tabline_20_format_items_no_overrun()
+ set showtabline& tabline&
+ endfunc
+ 
++func Test_mouse_click_in_tab()
++ " This used to crash because TabPageIdxs was not initialized
++ let lines =<< trim END
++ tabnew
++ set mouse=a
++ exe "norm \<LeftMouse>"
++ END
++ call writefile(lines, 'Xclickscript')
++ call RunVim(, , "-e -s -S Xclickscript -c qa")
++
++ call delete('Xclickscript')
++endfunc
++
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+1.8.3.1
+

_service:tar_scm:backport-CVE-2022-2982.patch Added

@@ -0,0 +1,73 @@
+From d6c67629ed05aae436164eec474832daf8ba7420 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Wed, 24 Aug 2022 20:07:22 +0100
+Subject: PATCH patch 9.0.0260: using freed memory when usinger
+ 'quickfixtextfunc' recursivelyxe
+
+Problem: Using freed memory when using 'quickfixtextfunc' recursively.
+Solution: Do not allow for recursion.
+---
+ src/quickfix.c | 9 +++++++++
+ src/testdir/test_quickfix.vim | 13 +++++++++++++
+ 2 files changed, 22 insertions(+)
+
+diff --git a/src/quickfix.c b/src/quickfix.c
+index c37caa5..5547233 100644
+--- a/src/quickfix.c
++++ b/src/quickfix.c
+@@ -4656,6 +4656,11 @@ call_qftf_func(qf_list_T *qfl, int qf_winid, long start_idx, long end_idx)
+ {
+ callback_T	*cb = &qftf_cb;
+ list_T	*qftf_list = NULL;
++ static int	recursive = FALSE;
++
++ if (recursive)
++	return NULL; // this doesn't work properly recursively
++ recursive = TRUE;
+ 
+ // If 'quickfixtextfunc' is set, then use the user-supplied function to get
+ // the text to display. Use the local value of 'quickfixtextfunc' if it is
+@@ -4670,7 +4675,10 @@ call_qftf_func(qf_list_T *qfl, int qf_winid, long start_idx, long end_idx)
+ 
+ 	// create the dict argument
+ 	if ((d = dict_alloc_lock(VAR_FIXED)) == NULL)
++	{
++	 recursive = FALSE;
+ 	 return NULL;
++	}
+ 	dict_add_number(d, "quickfix", (long)IS_QF_LIST(qfl));
+ 	dict_add_number(d, "winid", (long)qf_winid);
+ 	dict_add_number(d, "id", (long)qfl->qf_id);
+@@ -4693,6 +4701,7 @@ call_qftf_func(qf_list_T *qfl, int qf_winid, long start_idx, long end_idx)
+ 	dict_unref(d);
+ }
+ 
++ recursive = FALSE;
+ return qftf_list;
+ }
+ 
+diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
+index 182d570..46b2cb6 100644
+--- a/src/testdir/test_quickfix.vim
++++ b/src/testdir/test_quickfix.vim
+@@ -6334,4 +6334,17 @@ func Test_qflist_statusmsg()
+ %bw!
+ endfunc
+ 
++func Test_quickfixtextfunc_recursive()
++ func s:QFTfunc(o)
++ cgete '0'
++ endfunc
++ copen
++ let &quickfixtextfunc = 's:QFTfunc'
++ cex ""
++
++ let &quickfixtextfunc = ''
++ cclose
++endfunc
++
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+2.36.1
+

_service:tar_scm:backport-CVE-2022-3016.patch Added

@@ -0,0 +1,151 @@
+From 6d24a51b94beb1991cddce221f90b455e2d50db7 Mon Sep 17 00:00:00 2001
+From: Yegappan Lakshmanan <yegappan@yahoo.com>
+Date: Sat, 27 Aug 2022 20:59:57 +0100
+Subject: PATCH patch 9.0.0286: using freed memory when location list changed
+ in autocmd
+
+Problem: Using freed memory when location list changed in autocmd.
+Solution: Return QF_ABORT and handle it. (Yegappan Lakshmanan,
+ closes #10993)
+---
+ src/quickfix.c | 28 ++++++++++++++++++----------
+ src/testdir/test_quickfix.vim | 17 +++++++++++++++++
+ 2 files changed, 35 insertions(+), 10 deletions(-)
+
+diff --git a/src/quickfix.c b/src/quickfix.c
+index 6af62e8..78f6880 100644
+--- a/src/quickfix.c
++++ b/src/quickfix.c
+@@ -594,6 +594,7 @@ enum {
+ QF_NOMEM = 3,
+ QF_IGNORE_LINE = 4,
+ QF_MULTISCAN = 5,
++ QF_ABORT = 6
+ };
+ 
+ /*
+@@ -3153,7 +3154,7 @@ qf_jump_to_usable_window(int qf_fnum, int newwin, int *opened_window)
+ /*
+ * Edit the selected file or help file.
+ * Returns OK if successfully edited the file, FAIL on failing to open the
+- * buffer and NOTDONE if the quickfix/location list was freed by an autocmd
++ * buffer and QF_ABORT if the quickfix/location list was freed by an autocmd
+ * when opening the buffer.
+ */
+ static int
+@@ -3199,14 +3200,14 @@ qf_jump_edit_buffer(
+ 	{
+ 	 emsg(_(e_current_window_was_closed));
+ 	 *opened_window = FALSE;
+-	 return NOTDONE;
++	 return QF_ABORT;
+ 	}
+ }
+ 
+ if (qfl_type == QFLT_QUICKFIX && !qflist_valid(NULL, save_qfid))
+ {
+ 	emsg(_(e_current_quickfix_list_was_changed));
+-	return NOTDONE;
++	return QF_ABORT;
+ }
+ 
+ // Check if the list was changed. The pointers may happen to be identical,
+@@ -3219,7 +3220,7 @@ qf_jump_edit_buffer(
+ 	 emsg(_(e_current_quickfix_list_was_changed));
+ 	else
+ 	 emsg(_(e_current_location_list_was_changed));
+-	return NOTDONE;
++	return QF_ABORT;
+ }
+ 
+ return retval;
+@@ -3317,7 +3318,8 @@ qf_jump_print_msg(
+ * a new window.
+ * Returns OK if successfully jumped or opened a window. Returns FAIL if not
+ * able to jump/open a window. Returns NOTDONE if a file is not associated
+- * with the entry.
++ * with the entry. Returns QF_ABORT if the quickfix/location list was modified
++ * by an autocmd.
+ */
+ static int
+ qf_jump_open_window(
+@@ -3344,7 +3346,7 @@ qf_jump_open_window(
+ 	 emsg(_(e_current_quickfix_list_was_changed));
+ 	else
+ 	 emsg(_(e_current_location_list_was_changed));
+-	return FAIL;
++	return QF_ABORT;
+ }
+ 
+ // If currently in the quickfix window, find another window to show the
+@@ -3368,7 +3370,7 @@ qf_jump_open_window(
+ 	 emsg(_(e_current_quickfix_list_was_changed));
+ 	else
+ 	 emsg(_(e_current_location_list_was_changed));
+-	return FAIL;
++	return QF_ABORT;
+ }
+ 
+ return OK;
+@@ -3379,7 +3381,7 @@ qf_jump_open_window(
+ * particular line/column, adjust the folds and display a message about the
+ * jump.
+ * Returns OK on success and FAIL on failing to open the file/buffer. Returns
+- * NOTDONE if the quickfix/location list is freed by an autocmd when opening
++ * QF_ABORT if the quickfix/location list is freed by an autocmd when opening
+ * the file.
+ */
+ static int
+@@ -3508,14 +3510,20 @@ qf_jump_newwin(qf_info_T	*qi,
+ retval = qf_jump_open_window(qi, qf_ptr, newwin, &opened_window);
+ if (retval == FAIL)
+ 	goto failed;
++ if (retval == QF_ABORT)
++ {
++	qi = NULL;
++	qf_ptr = NULL;
++	goto theend;
++ }
+ if (retval == NOTDONE)
+ 	goto theend;
+ 
+ retval = qf_jump_to_buffer(qi, qf_index, qf_ptr, forceit, prev_winid,
+ 				 &opened_window, old_KeyTyped, print_message);
+- if (retval == NOTDONE)
++ if (retval == QF_ABORT)
+ {
+-	// Quickfix/location list is freed by an autocmd
++	// Quickfix/location list was modified by an autocmd
+ 	qi = NULL;
+ 	qf_ptr = NULL;
+ }
+diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
+index 762fa8d..31d36ef 100644
+--- a/src/testdir/test_quickfix.vim
++++ b/src/testdir/test_quickfix.vim
+@@ -6363,5 +6363,22 @@ func Test_quickfixtextfunc_recursive()
+ cclose
+ endfunc
+ 
++" Test for replacing the location list from an autocmd. This used to cause a
++" read from freed memory.
++func Test_loclist_replace_autocmd()
++ %bw!
++ call setloclist(0, , 'f')
++ let s:bufnr = bufnr()
++ cal setloclist(0, {'0': 0, '': ''})
++ au BufEnter * cal setloclist(1, {'t': ''}, {'bufnr': s:bufnr}, 'r')
++ lopen
++ try
++ exe "norm j\<CR>"
++ catch
++ endtry
++ lnext
++ %bw!
++ call setloclist(0, , 'f')
++endfunc
+ 
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+1.8.3.1
+

_service:tar_scm:backport-CVE-2022-3037.patch Added

@@ -0,0 +1,56 @@
+From 4f1b083be43f351bc107541e7b0c9655a5d2c0bb Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Mon, 29 Aug 2022 20:45:16 +0100
+Subject: PATCH patch 9.0.0322: crash when no errors and 'quickfixtextfunc'
+ is set
+
+Problem: Crash when no errors and 'quickfixtextfunc' is set.
+Solution: Do not handle errors if there aren't any.
+---
+ src/quickfix.c | 2 +-
+ src/testdir/test_quickfix.vim | 16 ++++++++++++++++
+ 2 files changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/src/quickfix.c b/src/quickfix.c
+index f6851ef..edf262c 100644
+--- a/src/quickfix.c
++++ b/src/quickfix.c
+@@ -4743,7 +4743,7 @@ qf_fill_buffer(qf_list_T *qfl, buf_T *buf, qfline_T *old_last, int qf_winid)
+ }
+ 
+ // Check if there is anything to display
+- if (qfl != NULL)
++ if (qfl != NULL && qfl->qf_start != NULL)
+ {
+ 	char_u		dirnameMAXPATHL;
+ 	int		invalid_val = FALSE;
+diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
+index cf803ca..27bed51 100644
+--- a/src/testdir/test_quickfix.vim
++++ b/src/testdir/test_quickfix.vim
+@@ -4090,6 +4090,22 @@ func Xgetlist_empty_tests(cchar)
+ endif
+ endfunc
+ 
++func Test_empty_list_quickfixtextfunc()
++ " This was crashing. Can only reproduce by running it in a separate Vim
++ " instance.
++ let lines =<< trim END
++ func s:Func(o)
++ cgetexpr '0'
++ endfunc
++ cope
++ let &quickfixtextfunc = 's:Func'
++ cgetfile ex
++ END
++ call writefile(lines, 'Xquickfixtextfunc')
++ call RunVim(, , '-e -s -S Xquickfixtextfunc -c qa')
++ call delete('Xquickfixtextfunc')
++endfunc
++
+ func Test_getqflist()
+ call Xgetlist_empty_tests('c')
+ call Xgetlist_empty_tests('l')
+-- 
+2.33.0
+

_service:tar_scm:backport-CVE-2022-3099.patch Added

_service:tar_scm:backport-CVE-2022-3134.patch Added

@@ -0,0 +1,69 @@
+From ccfde4d028e891a41e3548323c3d47b06fb0b83e Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Mon, 5 Sep 2022 19:51:13 +0100
+Subject: PATCH patch 9.0.0389: crash when 'tagfunc' closes the window
+
+Problem: Crash when 'tagfunc' closes the window.
+Solution: Bail out when the window was closed.
+
+---
+ src/errors.h | 2 ++
+ src/tag.c | 10 ++++++++++
+ src/testdir/test_tagfunc.vim | 12 ++++++++++++
+ 3 files changed, 24 insertions(+)
+
+diff --git a/src/errors.h b/src/errors.h
+index 43a1c9b..bfb4ae8 100644
+--- a/src/errors.h
++++ b/src/errors.h
+@@ -3304,3 +3304,5 @@ EXTERN char e_could_not_check_for_pending_sigalrm_str
+ EXTERN char e_substitute_nesting_too_deep
+ 	INIT(= N_("E1290: substitute nesting too deep"));
+ #endif
++EXTERN char e_window_unexpectedly_close_while_searching_for_tags
++	INIT(= N_("E1299: Window unexpectedly closed while searching for tags"));
+diff --git a/src/tag.c b/src/tag.c
+index 8edb0c7..b4915cb 100644
+--- a/src/tag.c
++++ b/src/tag.c
+@@ -690,6 +690,16 @@ do_tag(
+ 		max_num_matches = MAXCOL; // If less than max_num_matches
+ 					 // found: all matches found.
+ 
++		// A tag function may do anything, which may cause various
++	 // information to become invalid. At least check for the tagstack
++	 // to still be the same.
++	 if (tagstack != curwin->w_tagstack)
++	 {
++		emsg(_(e_window_unexpectedly_close_while_searching_for_tags));
++		FreeWild(new_num_matches, new_matches);
++		break;
++	 }
++
+ 	 // If there already were some matches for the same name, move them
+ 	 // to the start. Avoids that the order changes when using
+ 	 // ":tnext" and jumping to another file.
+diff --git a/src/testdir/test_tagfunc.vim b/src/testdir/test_tagfunc.vim
+index 9582612..c10a82d 100644
+--- a/src/testdir/test_tagfunc.vim
++++ b/src/testdir/test_tagfunc.vim
+@@ -401,4 +401,16 @@ func Test_tagfunc_wipes_buffer()
+ set tagfunc=
+ endfunc
+ 
++func Test_tagfunc_closes_window()
++ split any
++ func MytagfuncClose(pat, flags, info)
++ close
++ return {'name' : 'mytag', 'filename' : 'Xtest', 'cmd' : '1'}
++ endfunc
++ set tagfunc=MytagfuncClose
++ call assert_fails('tag xyz', 'E1299:')
++
++ set tagfunc=
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+2.33.0
+

_service:tar_scm:backport-CVE-2022-3153.patch Added

@@ -0,0 +1,87 @@
+From 1540d334a04d874c2aa9d26b82dbbcd4bc5a78de Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Wed, 7 Sep 2022 15:20:26 +0100
+Subject: PATCH patch 9.0.0404: crash when passing invalid arguments to
+ assert_fails()
+
+Problem: Crash when passing invalid arguments to assert_fails().
+Solution: Check for NULL string.
+---
+ src/testdir/test_assert.vim | 19 +++++++++++++++++--
+ src/testing.c | 9 +++++++++
+ 2 files changed, 26 insertions(+), 2 deletions(-)
+
+diff --git a/src/testdir/test_assert.vim b/src/testdir/test_assert.vim
+index 7c9d090..9d8a018 100644
+--- a/src/testdir/test_assert.vim
++++ b/src/testdir/test_assert.vim
+@@ -278,6 +278,21 @@ func Test_assert_fail_fails()
+ endtry
+ call assert_match("E1222: String or List required for argument 2", exp)
+ 
++ try
++ call assert_equal(0, assert_fails('xxx', #{one: 1}))
++ catch
++ let exp = v:exception
++ endtry
++ call assert_match("E731: Using a Dictionary as a String", exp)
++
++ let exp = ''
++ try
++ call assert_equal(0, assert_fails('xxx', 'E492', #{one: 1}))
++ catch
++ let exp = v:exception
++ endtry
++ call assert_match("E731: Using a Dictionary as a String", exp)
++
+ try
+ call assert_equal(1, assert_fails('xxx', 'E492', '', 'burp'))
+ catch
+@@ -292,8 +307,8 @@ func Test_assert_fail_fails()
+ endtry
+ call assert_match("E1174: String required for argument 5", exp)
+ 
+- call assert_equal(1, assert_fails('c0', '', '\1'))
+- call assert_match("Expected '\\\\\\\\1' but got 'E939: Positive count required: c0': c0", v:errors0)
++ call assert_equal(1, assert_fails('c0', '', '$.$\1'))
++ call assert_match("Expected '\\\\\\\$.\\\\\\\$\\\\\\\\1' but got 'E939: Positive count required: c0': c0", v:errors0)
+ call remove(v:errors, 0)
+ endfunc
+ 
+diff --git a/src/testing.c b/src/testing.c
+index 43b8d20..b4c4ff4 100644
+--- a/src/testing.c
++++ b/src/testing.c
+@@ -616,6 +616,11 @@ f_assert_fails(typval_T *argvars, typval_T *rettv)
+ in_assert_fails = TRUE;
+ 
+ do_cmdline_cmd(cmd);
++
++ // reset here for any errors reported below
++ trylevel = save_trylevel;
++ suppress_errthrow = FALSE;
++
+ if (called_emsg == called_emsg_before)
+ {
+ 	prepare_assert_error(&ga);
+@@ -654,6 +659,8 @@ f_assert_fails(typval_T *argvars, typval_T *rettv)
+ 	 CHECK_LIST_MATERIALIZE(list);
+ 	 tv = &list->lv_first->li_tv;
+ 	 expected = tv_get_string_buf_chk(tv, buf);
++	 if (expected == NULL)
++		goto theend;
+ 	 if (!pattern_match(expected, actual, FALSE))
+ 	 {
+ 		error_found = TRUE;
+@@ -667,6 +674,8 @@ f_assert_fails(typval_T *argvars, typval_T *rettv)
+ 		{
+ 		 tv = &list->lv_u.mat.lv_last->li_tv;
+ 		 expected = tv_get_string_buf_chk(tv, buf);
++		 if (expected == NULL)
++			goto theend;
+ 		 if (!pattern_match(expected, actual, FALSE))
+ 		 {
+ 			error_found = TRUE;
+-- 
+2.27.0
+

_service:tar_scm:backport-CVE-2022-3234.patch Added

@@ -0,0 +1,78 @@
+From c249913edc35c0e666d783bfc21595cf9f7d9e0d Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Fri, 16 Sep 2022 22:16:59 +0100
+Subject: PATCH patch 9.0.0483: illegal memory access when replacing in
+ virtualedit mode
+
+Problem: Illegal memory access when replacing in virtualedit mode.
+Solution: Check for replacing NUL after Tab.
+---
+ src/ops.c | 12 ++++++++++--
+ src/testdir/test_virtualedit.vim | 14 ++++++++++++++
+ 2 files changed, 24 insertions(+), 2 deletions(-)
+
+diff --git a/src/ops.c b/src/ops.c
+index b930878..33cbd8e 100644
+--- a/src/ops.c
++++ b/src/ops.c
+@@ -1160,6 +1160,8 @@ op_replace(oparg_T *oap, int c)
+ 
+ 	while (LTOREQ_POS(curwin->w_cursor, oap->end))
+ 	{
++	 int done = FALSE;
++
+ 	 n = gchar_cursor();
+ 	 if (n != NUL)
+ 	 {
+@@ -1173,6 +1175,7 @@ op_replace(oparg_T *oap, int c)
+ 		 if (curwin->w_cursor.lnum == oap->end.lnum)
+ 			oap->end.col += new_byte_len - old_byte_len;
+ 		 replace_character(c);
++		 done = TRUE;
+ 		}
+ 		else
+ 		{
+@@ -1191,10 +1194,15 @@ op_replace(oparg_T *oap, int c)
+ 			if (curwin->w_cursor.lnum == oap->end.lnum)
+ 			 getvpos(&oap->end, end_vcol);
+ 		 }
+-		 PBYTE(curwin->w_cursor, c);
++		 // with "coladd" set may move to just after a TAB
++		 if (gchar_cursor() != NUL)
++		 {
++			PBYTE(curwin->w_cursor, c);
++			done = TRUE;
++		 }
+ 		}
+ 	 }
+-	 else if (virtual_op && curwin->w_cursor.lnum == oap->end.lnum)
++	 if (!done && virtual_op && curwin->w_cursor.lnum == oap->end.lnum)
+ 	 {
+ 		int virtcols = oap->end.coladd;
+ 
+diff --git a/src/testdir/test_virtualedit.vim b/src/testdir/test_virtualedit.vim
+index b31f3a2..0031b22 100644
+--- a/src/testdir/test_virtualedit.vim
++++ b/src/testdir/test_virtualedit.vim
+@@ -537,4 +537,18 @@ func Test_global_local_virtualedit()
+ set virtualedit&
+ endfunc
+ 
++" this was replacing the NUL at the end of the line 
++func Test_virtualedit_replace_after_tab()
++ new
++ s/\v/	0
++ set ve=all
++ let @" = ''
++ sil! norm vPvr0
++ 
++ call assert_equal("\t0", getline(1))
++ set ve&
++ bwipe!
++endfunc
++
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+2.27.0
+

_service:tar_scm:backport-CVE-2022-3235.patch Added

@@ -0,0 +1,75 @@
+From 1c3dd8ddcba63c1af5112e567215b3cec2de11d0 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Sat, 17 Sep 2022 19:43:23 +0100
+Subject: PATCH patch 9.0.0490: using freed memory with cmdwin and BufEnter
+ autocmd
+
+Problem: Using freed memory with cmdwin and BufEnter autocmd.
+Solution: Make sure pointer to b_p_iminsert is still valid.
+---
+ src/ex_getln.c | 8 ++++++--
+ src/testdir/test_cmdline.vim | 10 ++++++++++
+ 2 files changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/src/ex_getln.c b/src/ex_getln.c
+index 8dc03dc..535bfb5 100644
+--- a/src/ex_getln.c
++++ b/src/ex_getln.c
+@@ -1607,6 +1607,7 @@ getcmdline_int(
+ #endif
+ expand_T	xpc;
+ long	*b_im_ptr = NULL;
++ buf_T	*b_im_ptr_buf = NULL;	// buffer where b_im_ptr is valid
+ cmdline_info_T save_ccline;
+ int		did_save_ccline = FALSE;
+ int		cmdline_type;
+@@ -1703,6 +1704,7 @@ getcmdline_int(
+ 	 b_im_ptr = &curbuf->b_p_iminsert;
+ 	else
+ 	 b_im_ptr = &curbuf->b_p_imsearch;
++	b_im_ptr_buf = curbuf;
+ 	if (*b_im_ptr == B_IMODE_LMAP)
+ 	 State |= MODE_LANGMAP;
+ #ifdef HAVE_INPUT_METHOD
+@@ -2060,7 +2062,8 @@ getcmdline_int(
+ 		goto cmdline_not_changed;
+ 
+ 	case Ctrl_HAT:
+-		cmdline_toggle_langmap(b_im_ptr);
++		cmdline_toggle_langmap(
++				 buf_valid(b_im_ptr_buf) ? b_im_ptr : NULL);
+ 		goto cmdline_not_changed;
+ 
+ //	case '@': only in very old vi
+@@ -2573,7 +2576,8 @@ returncmd:
+ #endif
+ 
+ #ifdef HAVE_INPUT_METHOD
+- if (b_im_ptr != NULL && *b_im_ptr != B_IMODE_LMAP)
++ if (b_im_ptr != NULL && buf_valid(b_im_ptr_buf)
++						 && *b_im_ptr != B_IMODE_LMAP)
+ 	im_save_status(b_im_ptr);
+ im_set_active(FALSE);
+ #endif
+diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
+index 08e2de7..440df96 100644
+--- a/src/testdir/test_cmdline.vim
++++ b/src/testdir/test_cmdline.vim
+@@ -3447,4 +3447,14 @@ func Test_cmdwin_virtual_edit()
+ set ve= cpo-=$
+ endfunc
+ 
++" This was using a pointer to a freed buffer
++func Test_cmdwin_freed_buffer_ptr()
++ au BufEnter * next 0| file &#xb;
++ edit 0
++ silent! norm q/
++
++ au! BufEnter
++ bwipe!
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+2.27.0
+

_service:tar_scm:backport-CVE-2022-3256.patch Added

@@ -0,0 +1,66 @@
+From 8ecfa2c56b4992c7f067b92488aa9acea5a454ad Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Wed, 21 Sep 2022 13:07:22 +0100
+Subject: PATCH patch 9.0.0530: using freed memory when autocmd changes mark
+
+Problem: Using freed memory when autocmd changes mark.
+Solution: Copy the mark before editing another buffer.
+---
+ src/mark.c | 12 +++++++-----
+ src/testdir/test_marks.vim | 13 +++++++++++++
+ 2 files changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/src/mark.c b/src/mark.c
+index ade5a10..584db03 100644
+--- a/src/mark.c
++++ b/src/mark.c
+@@ -221,17 +221,19 @@ movemark(int count)
+ 	 fname2fnum(jmp);
+ 	if (jmp->fmark.fnum != curbuf->b_fnum)
+ 	{
+-	 // jump to other file
+-	 if (buflist_findnr(jmp->fmark.fnum) == NULL)
++	 // Make a copy, an autocommand may make "jmp" invalid.
++	 fmark_T fmark = jmp->fmark;
++
++	 // jump to the file with the mark
++	 if (buflist_findnr(fmark.fnum) == NULL)
+ 	 {					 // Skip this one ..
+ 		count += count < 0 ? -1 : 1;
+ 		continue;
+ 	 }
+-	 if (buflist_getfile(jmp->fmark.fnum, jmp->fmark.mark.lnum,
+-							 0, FALSE) == FAIL)
++	 if (buflist_getfile(fmark.fnum, fmark.mark.lnum, 0, FALSE) == FAIL)
+ 		return (pos_T *)NULL;
+ 	 // Set lnum again, autocommands my have changed it
+-	 curwin->w_cursor = jmp->fmark.mark;
++	 curwin->w_cursor = fmark.mark;
+ 	 pos = (pos_T *)-1;
+ 	}
+ 	else
+diff --git a/src/testdir/test_marks.vim b/src/testdir/test_marks.vim
+index 12501a3..20fb304 100644
+--- a/src/testdir/test_marks.vim
++++ b/src/testdir/test_marks.vim
+@@ -305,4 +305,17 @@ func Test_getmarklist()
+ close!
+ endfunc
+ 
++" This was using freed memory
++func Test_jump_mark_autocmd()
++ next 00
++ edit 0
++ sargument
++ au BufEnter 0 all
++ sil norm &#xf;&#xf;
++
++ au! BufEnter
++ bwipe!
++endfunc
++
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+2.27.0
+

_service:tar_scm:backport-CVE-2022-3278.patch Added

@@ -0,0 +1,56 @@
+From 69082916c8b5d321545d60b9f5facad0a2dd5a4e Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Thu, 22 Sep 2022 21:35:19 +0100
+Subject: PATCH patch 9.0.0552: crash when using NUL in buffer that uses
+ :source
+
+Problem: Crash when using NUL in buffer that uses :source.
+Solution: Don't get a next line when skipping over NL.
+---
+ src/eval.c | 2 +-
+ src/testdir/test_source.vim | 17 +++++++++++++++++
+ 2 files changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/src/eval.c b/src/eval.c
+index 60daca5..8df374a 100644
+--- a/src/eval.c
++++ b/src/eval.c
+@@ -2278,7 +2278,7 @@ eval_next_non_blank(char_u *arg, evalarg_T *evalarg, int *getnext)
+ 
+ 	if (next != NULL)
+ 	{
+-	 *getnext = TRUE;
++	 *getnext = *p != NL;
+ 	 return skipwhite(next);
+ 	}
+ }
+diff --git a/src/testdir/test_source.vim b/src/testdir/test_source.vim
+index 4736e93..d6aed57 100644
+--- a/src/testdir/test_source.vim
++++ b/src/testdir/test_source.vim
+@@ -665,5 +665,22 @@ func Test_source_buffer_long_line()
+ call delete('Xtest.vim')
+ endfunc
+ 
++func Test_source_buffer_with_NUL_char()
++ " This was trying to use a line below the buffer.
++ let lines =<< trim END
++ if !exists('g:loaded')
++ let g:loaded = 1
++ source
++ endif
++ END
++ " Can't have a NL in heredoc
++ let lines += "silent! vim9 echo 0 \<NL> ? 'a' : 'b'"
++ call writefile(lines, 'XsourceNul', '')
++ edit XsourceNul
++ source
++
++ bwipe!
++endfunc
++
+ 
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+2.27.0
+

_service:tar_scm:backport-CVE-2022-3296.patch Added

@@ -0,0 +1,634 @@
+From 96b9bf8f74af8abf1e30054f996708db7dc285be Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Sat, 24 Sep 2022 17:24:12 +0100
+Subject: patch 9.0.0577: buffer underflow with unexpected :finally
+
+Problem: Buffer underflow with unexpected :finally.
+Solution: Check CSF_TRY can be found.
+---
+ src/ex_eval.c | 523 +++++++++++++++++-----------------
+ src/testdir/test_trycatch.vim | 22 ++
+ 2 files changed, 282 insertions(+), 263 deletions(-)
+
+diff --git a/src/ex_eval.c b/src/ex_eval.c
+index 5721b766e..77d6e8bb9 100644
+--- a/src/ex_eval.c
++++ b/src/ex_eval.c
+@@ -1935,128 +1935,127 @@ ex_finally(exarg_T *eap)
+ if (cmdmod_error(FALSE))
+ 	return;
+ 
+- if (cstack->cs_trylevel <= 0 || cstack->cs_idx < 0)
++ for (idx = cstack->cs_idx; idx >= 0; --idx)
++	if (cstack->cs_flagsidx & CSF_TRY)
++	 break;
++ if (cstack->cs_trylevel <= 0 || idx < 0)
++ {
+ 	eap->errmsg = _(e_finally_without_try);
+- else
++	return;
++ }
++
++ if (!(cstack->cs_flagscstack->cs_idx & CSF_TRY))
+ {
+-	if (!(cstack->cs_flagscstack->cs_idx & CSF_TRY))
+-	{
+-	 eap->errmsg = get_end_emsg(cstack);
+-	 for (idx = cstack->cs_idx - 1; idx > 0; --idx)
+-		if (cstack->cs_flagsidx & CSF_TRY)
+-		 break;
+-	 // Make this error pending, so that the commands in the following
+-	 // finally clause can be executed. This overrules also a pending
+-	 // ":continue", ":break", ":return", or ":finish".
+-	 pending = CSTP_ERROR;
+-	}
+-	else
+-	 idx = cstack->cs_idx;
++	eap->errmsg = get_end_emsg(cstack);
++	// Make this error pending, so that the commands in the following
++	// finally clause can be executed. This overrules also a pending
++	// ":continue", ":break", ":return", or ":finish".
++	pending = CSTP_ERROR;
++ }
+ 
+-	if (cstack->cs_flagsidx & CSF_FINALLY)
++ if (cstack->cs_flagsidx & CSF_FINALLY)
++ {
++	// Give up for a multiple ":finally" and ignore it.
++	eap->errmsg = _(e_multiple_finally);
++	return;
++ }
++ rewind_conditionals(cstack, idx, CSF_WHILE | CSF_FOR,
++						 &cstack->cs_looplevel);
++
++ /*
++ * Don't do something when the corresponding try block never got active
++ * (because of an inactive surrounding conditional or after an error or
++ * interrupt or throw) or for a ":finally" without ":try" or a multiple
++ * ":finally". After every other error (did_emsg or the conditional
++ * errors detected above) or after an interrupt (got_int) or an
++ * exception (did_throw), the finally clause must be executed.
++ */
++ skip = !(cstack->cs_flagscstack->cs_idx & CSF_TRUE);
++
++ if (!skip)
++ {
++	// When debugging or a breakpoint was encountered, display the
++	// debug prompt (if not already done). The user then knows that the
++	// finally clause is executed.
++	if (dbg_check_skipped(eap))
+ 	{
+-	 // Give up for a multiple ":finally" and ignore it.
+-	 eap->errmsg = _(e_multiple_finally);
+-	 return;
++	 // Handle a ">quit" debug command as if an interrupt had
++	 // occurred before the ":finally". That is, discard the
++	 // original exception and replace it by an interrupt
++	 // exception.
++	 (void)do_intthrow(cstack);
+ 	}
+-	rewind_conditionals(cstack, idx, CSF_WHILE | CSF_FOR,
+-						 &cstack->cs_looplevel);
+ 
+ 	/*
+-	 * Don't do something when the corresponding try block never got active
+-	 * (because of an inactive surrounding conditional or after an error or
+-	 * interrupt or throw) or for a ":finally" without ":try" or a multiple
+-	 * ":finally". After every other error (did_emsg or the conditional
+-	 * errors detected above) or after an interrupt (got_int) or an
+-	 * exception (did_throw), the finally clause must be executed.
++	 * If there is a preceding catch clause and it caught the exception,
++	 * finish the exception now. This happens also after errors except
++	 * when this is a multiple ":finally" or one not within a ":try".
++	 * After an error or interrupt, this also discards a pending
++	 * ":continue", ":break", ":finish", or ":return" from the preceding
++	 * try block or catch clause.
+ 	 */
+-	skip = !(cstack->cs_flagscstack->cs_idx & CSF_TRUE);
++	cleanup_conditionals(cstack, CSF_TRY, FALSE);
+ 
+-	if (!skip)
++	if (cstack->cs_idx >= 0
++			 && (cstack->cs_flagscstack->cs_idx & CSF_TRY))
+ 	{
+-	 // When debugging or a breakpoint was encountered, display the
+-	 // debug prompt (if not already done). The user then knows that the
+-	 // finally clause is executed.
+-	 if (dbg_check_skipped(eap))
+-	 {
+-		// Handle a ">quit" debug command as if an interrupt had
+-		// occurred before the ":finally". That is, discard the
+-		// original exception and replace it by an interrupt
+-		// exception.
+-		(void)do_intthrow(cstack);
+-	 }
+-
+-	 /*
+-	 * If there is a preceding catch clause and it caught the exception,
+-	 * finish the exception now. This happens also after errors except
+-	 * when this is a multiple ":finally" or one not within a ":try".
+-	 * After an error or interrupt, this also discards a pending
+-	 * ":continue", ":break", ":finish", or ":return" from the preceding
+-	 * try block or catch clause.
+-	 */
+-	 cleanup_conditionals(cstack, CSF_TRY, FALSE);
++	 // Variables declared in the previous block can no longer be
++	 // used.
++	 leave_block(cstack);
++	 enter_block(cstack);
++	}
+ 
+-	 if (cstack->cs_idx >= 0
+-			 && (cstack->cs_flagscstack->cs_idx & CSF_TRY))
++	/*
++	 * Make did_emsg, got_int, did_throw pending. If set, they overrule
++	 * a pending ":continue", ":break", ":return", or ":finish". Then
++	 * we have particularly to discard a pending return value (as done
++	 * by the call to cleanup_conditionals() above when did_emsg or
++	 * got_int is set). The pending values are restored by the
++	 * ":endtry", except if there is a new error, interrupt, exception,
++	 * ":continue", ":break", ":return", or ":finish" in the following
++	 * finally clause. A missing ":endwhile", ":endfor" or ":endif"
++	 * detected here is treated as if did_emsg and did_throw had
++	 * already been set, respectively in case that the error is not
++	 * converted to an exception, did_throw had already been unset.
++	 * We must not set did_emsg here since that would suppress the
++	 * error message.
++	 */
++	if (pending == CSTP_ERROR || did_emsg || got_int || did_throw)
++	{
++	 if (cstack->cs_pendingcstack->cs_idx == CSTP_RETURN)
+ 	 {
+-		// Variables declared in the previous block can no longer be
+-		// used.
+-		leave_block(cstack);
+-		enter_block(cstack);
++		report_discard_pending(CSTP_RETURN,
++				 cstack->cs_rettvcstack->cs_idx);
++		discard_pending_return(cstack->cs_rettvcstack->cs_idx);
+ 	 }
+-
+-	 /*
+-	 * Make did_emsg, got_int, did_throw pending. If set, they overrule
+-	 * a pending ":continue", ":break", ":return", or ":finish". Then
+-	 * we have particularly to discard a pending return value (as done
+-	 * by the call to cleanup_conditionals() above when did_emsg or
+-	 * got_int is set). The pending values are restored by the
+-	 * ":endtry", except if there is a new error, interrupt, exception,
+-	 * ":continue", ":break", ":return", or ":finish" in the following
+-	 * finally clause. A missing ":endwhile", ":endfor" or ":endif"
+-	 * detected here is treated as if did_emsg and did_throw had
+-	 * already been set, respectively in case that the error is not
+-	 * converted to an exception, did_throw had already been unset.
+-	 * We must not set did_emsg here since that would suppress the
+-	 * error message.
+-	 */
+-	 if (pending == CSTP_ERROR || did_emsg || got_int || did_throw)
+-	 {
+-		if (cstack->cs_pendingcstack->cs_idx == CSTP_RETURN)
+-		{
+-		 report_discard_pending(CSTP_RETURN,
+-					 cstack->cs_rettvcstack->cs_idx);
+-		 discard_pending_return(cstack->cs_rettvcstack->cs_idx);
+-		}
+-		if (pending == CSTP_ERROR && !did_emsg)
+-		 pending |= (THROW_ON_ERROR) ? CSTP_THROW : 0;
+-		else
+-		 pending |= did_throw ? CSTP_THROW : 0;
+-		pending |= did_emsg ? CSTP_ERROR : 0;
+-		pending |= got_int ? CSTP_INTERRUPT : 0;

_service:tar_scm:backport-CVE-2022-3297.patch Added

@@ -0,0 +1,162 @@
+From 0ff01835a40f549c5c4a550502f62a2ac9ac447c Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Sat, 24 Sep 2022 19:20:30 +0100
+Subject: PATCH patch 9.0.0579: using freed memory when 'tagfunc' wipes out
+ buffer
+
+Problem: Using freed memory when 'tagfunc' wipes out buffer that holds
+ 'complete'.
+Solution: Make a copy of the option. Make sure cursor position is valid.
+---
+ src/insexpand.c | 40 ++++++++++++++++++++++++-------
+ src/move.c | 1 +
+ src/testdir/test_ins_complete.vim | 20 ++++++++++++++--
+ 3 files changed, 50 insertions(+), 11 deletions(-)
+
+diff --git a/src/insexpand.c b/src/insexpand.c
+index 24308e6..3585ef2 100644
+--- a/src/insexpand.c
++++ b/src/insexpand.c
+@@ -2485,7 +2485,8 @@ ins_compl_next_buf(buf_T *buf, int flag)
+ 
+ if (flag == 'w')		// just windows
+ {
+-	if (buf == curbuf || wp == NULL) // first call for this flag/expansion
++	if (buf == curbuf || !win_valid(wp))
++	 // first call for this flag/expansion or window was closed
+ 	 wp = curwin;
+ 	while ((wp = (wp->w_next != NULL ? wp->w_next : firstwin)) != curwin
+ 		&& wp->w_buffer->b_scanned)
+@@ -3188,9 +3189,10 @@ enum
+ */
+ typedef struct
+ {
+- char_u	*e_cpt;			// current entry in 'complete'
++ char_u	*e_cpt_copy;		// copy of 'complete'
++ char_u	*e_cpt;			// current entry in "e_cpt_copy"
+ buf_T	*ins_buf;		// buffer being scanned
+- pos_T	*cur_match_pos;			// current match position
++ pos_T	*cur_match_pos;		// current match position
+ pos_T	prev_match_pos;		// previous match position
+ int		set_match_pos;		// save first_match_pos/last_match_pos
+ pos_T	first_match_pos;	// first match position
+@@ -3257,7 +3259,8 @@ process_next_cpt_value(
+ 	st->set_match_pos = TRUE;
+ }
+ else if (vim_strchr((char_u *)"buwU", *st->e_cpt) != NULL
+-	 && (st->ins_buf = ins_compl_next_buf(st->ins_buf, *st->e_cpt)) != curbuf)
++	 && (st->ins_buf = ins_compl_next_buf(
++					 st->ins_buf, *st->e_cpt)) != curbuf)
+ {
+ 	// Scan a buffer, but not the current one.
+ 	if (st->ins_buf->b_ml.ml_mfp != NULL) // loaded buffer
+@@ -3756,19 +3759,30 @@ get_next_completion_match(int type, ins_compl_next_state_T *st, pos_T *ini)
+ static int
+ ins_compl_get_exp(pos_T *ini)
+ {
+- static ins_compl_next_state_T st;
++ static ins_compl_next_state_T st;
++ static int			 st_cleared = FALSE;
+ int		i;
+ int		found_new_match;
+ int		type = ctrl_x_mode;
+ 
+ if (!compl_started)
+ {
+-	FOR_ALL_BUFFERS(st.ins_buf)
+-	 st.ins_buf->b_scanned = 0;
++	buf_T *buf;
++
++	FOR_ALL_BUFFERS(buf)
++	 buf->b_scanned = 0;
++	if (!st_cleared)
++	{
++	 CLEAR_FIELD(st);
++	 st_cleared = TRUE;
++	}
+ 	st.found_all = FALSE;
+ 	st.ins_buf = curbuf;
+-	st.e_cpt = (compl_cont_status & CONT_LOCAL)
+-					 ? (char_u *)"." : curbuf->b_p_cpt;
++	vim_free(st.e_cpt_copy);
++	// Make a copy of 'complete', if case the buffer is wiped out.
++	st.e_cpt_copy = vim_strsave((compl_cont_status & CONT_LOCAL)
++					 ? (char_u *)"." : curbuf->b_p_cpt);
++	st.e_cpt = st.e_cpt_copy == NULL ? (char_u *)"" : st.e_cpt_copy;
+ 	st.last_match_pos = st.first_match_pos = *ini;
+ }
+ else if (st.ins_buf != curbuf && !buf_valid(st.ins_buf))
+@@ -4112,6 +4126,7 @@ ins_compl_next(
+ int	 todo = count;
+ int	 advance;
+ int	 started = compl_started;
++ buf_T *orig_curbuf = curbuf;
+ 
+ // When user complete function return -1 for findstart which is next
+ // time of 'always', compl_shown_match become NULL.
+@@ -4144,6 +4159,13 @@ ins_compl_next(
+ 							&num_matches) == -1)
+ 	return -1;
+ 
++ if (curbuf != orig_curbuf)
++ {
++	// In case some completion function switched buffer, don't want to
++	// insert the completion elsewhere.
++	return -1;
++ }
++
+ // Insert the text of the new completion, or the compl_leader.
+ if (compl_no_insert && !started)
+ {
+diff --git a/src/move.c b/src/move.c
+index b061a75..6c654ac 100644
+--- a/src/move.c
++++ b/src/move.c
+@@ -652,6 +652,7 @@ cursor_valid(void)
+ void
+ validate_cursor(void)
+ {
++ check_cursor();
+ check_cursor_moved(curwin);
+ if ((curwin->w_valid & (VALID_WCOL|VALID_WROW)) != (VALID_WCOL|VALID_WROW))
+ 	curs_columns(TRUE);
+diff --git a/src/testdir/test_ins_complete.vim b/src/testdir/test_ins_complete.vim
+index b303993..702a87c 100644
+--- a/src/testdir/test_ins_complete.vim
++++ b/src/testdir/test_ins_complete.vim
+@@ -628,9 +628,8 @@ func Test_pum_with_preview_win()
+ 
+ call writefile(lines, 'Xpreviewscript')
+ let buf = RunVimInTerminal('-S Xpreviewscript', #{rows: 12})
+- call TermWait(buf, 50)
+ call term_sendkeys(buf, "Gi\<C-X>\<C-O>")
+- call TermWait(buf, 100)
++ call TermWait(buf, 200)
+ call term_sendkeys(buf, "\<C-N>")
+ call VerifyScreenDump(buf, 'Test_pum_with_preview_win', {})
+ 
+@@ -2233,4 +2232,21 @@ func Test_ins_complete_end_of_line()
+ bwipe!
+ endfunc
+ 
++func s:Tagfunc(t,f,o)
++ bwipe!
++ return 
++endfunc
++
++" This was using freed memory, since 'complete' was in a wiped out buffer.
++" Also using a window that was closed.
++func Test_tagfunc_wipes_out_buffer()
++ new
++ set complete=.,t,w,b,u,i
++ se tagfunc=s:Tagfunc
++ sil norm i&#xe;
++
++ bwipe!
++endfunc
++
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+2.27.0
+

_service:tar_scm:backport-CVE-2022-3324.patch Added

@@ -0,0 +1,70 @@
+From 8279af514ca7e5fd3c31cf13b0864163d1a0bfeb Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Mon, 26 Sep 2022 23:08:22 +0100
+Subject: PATCH patch 9.0.0598: using negative array index with negative
+ width window
+
+Problem: Using negative array index with negative width window.
+Solution: Make sure the window width does not become negative.
+---
+ src/testdir/test_cmdline.vim | 22 ++++++++++++++++++++++
+ src/window.c | 5 ++++-
+ 2 files changed, 26 insertions(+), 1 deletion(-)
+
+diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
+index 440df96..ab3bfdf 100644
+--- a/src/testdir/test_cmdline.vim
++++ b/src/testdir/test_cmdline.vim
+@@ -3457,4 +3457,26 @@ func Test_cmdwin_freed_buffer_ptr()
+ bwipe!
+ endfunc
+ 
++" This was resulting in a window with negative width.
++" The test doesn't reproduce the illegal memory access though...
++func Test_cmdwin_split_often()
++ let lines = &lines
++ let columns = &columns
++ set t_WS=
++
++ try
++ set encoding=iso8859
++ set ruler
++ winsize 0 0
++ noremap 0 &#x17;&#xe;&#x17;H
++ sil norm 0000000q:
++ catch /E36:/
++ endtry
++
++ bwipe!
++ set encoding=utf8
++ let &lines = lines
++ let &columns = columns
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/window.c b/src/window.c
+index c91ebbc..73060db 100644
+--- a/src/window.c
++++ b/src/window.c
+@@ -2087,6 +2087,8 @@ win_equal_rec(
+ 		if (hnc)	 // add next_curwin size
+ 		{
+ 		 next_curwin_size -= p_wiw - (m - n);
++		 if (next_curwin_size < 0)
++			next_curwin_size = 0;
+ 		 new_size += next_curwin_size;
+ 		 room -= new_size - next_curwin_size;
+ 		}
+@@ -6495,7 +6497,8 @@ scroll_to_fraction(win_T *wp, int prev_height)
+ void
+ win_new_width(win_T *wp, int width)
+ {
+- wp->w_width = width;
++ // Should we give an error if width < 0?
++ wp->w_width = width < 0 ? 0 : width;
+ wp->w_lines_valid = 0;
+ changed_line_abv_curs_win(wp);
+ invalidate_botline_win(wp);
+-- 
+2.27.0
+

_service:tar_scm:backport-CVE-2022-3352.patch Added

@@ -0,0 +1,79 @@
+From ef976323e770315b5fca544efb6b2faa25674d15 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Wed, 28 Sep 2022 11:48:30 +0100
+Subject: PATCH patch 9.0.0614: SpellFileMissing autocmd may delete buffer
+
+Problem: SpellFileMissing autocmd may delete buffer.
+Solution: Disallow deleting the current buffer to avoid using freed memory.
+---
+ src/buffer.c | 7 ++++++-
+ src/spell.c | 6 ++++++
+ src/testdir/test_autocmd.vim | 10 ++++++++++
+ 3 files changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/src/buffer.c b/src/buffer.c
+index e775398..a85b2a8 100644
+--- a/src/buffer.c
++++ b/src/buffer.c
+@@ -461,7 +461,12 @@ can_unload_buffer(buf_T *buf)
+ 	 }
+ }
+ if (!can_unload)
+-	semsg(_(e_attempt_to_delete_buffer_that_is_in_use_str), buf->b_fname);
++ {
++	char_u *fname = buf->b_fname != NULL ? buf->b_fname : buf->b_ffname;
++
++	semsg(_(e_attempt_to_delete_buffer_that_is_in_use_str),
++				fname != NULL ? fname : (char_u *)"No Name");
++ }
+ return can_unload;
+ }
+ 
+diff --git a/src/spell.c b/src/spell.c
+index 24abce4..3664425 100644
+--- a/src/spell.c
++++ b/src/spell.c
+@@ -1559,6 +1559,10 @@ spell_load_lang(char_u *lang)
+ sl.sl_slang = NULL;
+ sl.sl_nobreak = FALSE;
+ 
++ // Disallow deleting the current buffer. Autocommands can do weird things
++ // and cause "lang" to be freed.
++ ++curbuf->b_locked;
++
+ // We may retry when no spell file is found for the language, an
+ // autocommand may load it then.
+ for (round = 1; round <= 2; ++round)
+@@ -1612,6 +1616,8 @@ spell_load_lang(char_u *lang)
+ 	STRCPY(fname_enc + STRLEN(fname_enc) - 3, "add.spl");
+ 	do_in_runtimepath(fname_enc, DIP_ALL, spell_load_cb, &sl);
+ }
++
++ --curbuf->b_locked;
+ }
+ 
+ /*
+diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
+index e9a59c2..bc74c29 100644
+--- a/src/testdir/test_autocmd.vim
++++ b/src/testdir/test_autocmd.vim
+@@ -2750,6 +2750,16 @@ func Test_FileType_spell()
+ setglobal spellfile=
+ endfunc
+ 
++" this was wiping out the current buffer and using freed memory
++func Test_SpellFileMissing_bwipe()
++ next 0
++ au SpellFileMissing 0 bwipe
++ call assert_fails('set spell spelllang=0', 'E937:')
++
++ au! SpellFileMissing
++ bwipe
++endfunc
++
+ " Test closing a window or editing another buffer from a FileChangedRO handler
+ " in a readonly buffer
+ func Test_FileChangedRO_winclose()
+-- 
+2.27.0
+

_service:tar_scm:backport-CVE-2022-3491.patch Added

_service:tar_scm:backport-CVE-2022-3520.patch Added

@@ -0,0 +1,52 @@
+From 36343ae0fb7247e060abfd35fb8e4337b33abb4b Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Sat, 15 Oct 2022 19:04:05 +0100
+Subject: PATCH patch 9.0.0765: with a Visual block a put command column may
+ go negative
+
+Problem: With a Visual block a put command column may go negative.
+Solution: Check that the column does not become negative.
+---
+ src/register.c | 2 ++
+ src/testdir/test_visual.vim | 12 ++++++++++++
+ 2 files changed, 14 insertions(+)
+
+diff --git a/src/register.c b/src/register.c
+index 30e2001..41089a0 100644
+--- a/src/register.c
++++ b/src/register.c
+@@ -1945,6 +1945,8 @@ do_put(
+ 	// adjust ' mark
+ 	curbuf->b_op_end.lnum = curwin->w_cursor.lnum - 1;
+ 	curbuf->b_op_end.col = bd.textcol + totlen - 1;
++	if (curbuf->b_op_end.col < 0)
++	 curbuf->b_op_end.col = 0;
+ 	curbuf->b_op_end.coladd = 0;
+ 	if (flags & PUT_CURSEND)
+ 	{
+diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
+index e965266..956a3d7 100644
+--- a/src/testdir/test_visual.vim
++++ b/src/testdir/test_visual.vim
+@@ -483,6 +483,18 @@ func Test_visual_block_put()
+ bw!
+ endfunc
+ 
++func Test_visual_block_put_invalid()
++ enew!
++ behave mswin
++ norm yy
++ norm v)P&#x11;s/^/	
++ " this was causing the column to become negative
++ silent norm ggv)&#x16;P
++
++ bwipe!
++ behave xterm
++endfunc
++
+ " Visual modes (v V CTRL-V) followed by an operator; count; repeating
+ func Test_visual_mode_op()
+ new
+-- 
+2.27.0
+

_service:tar_scm:backport-CVE-2022-3591.patch Added

@@ -0,0 +1,62 @@
+From 8f3c3c6cd044e3b5bf08dbfa3b3f04bb3f711bad Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Tue, 18 Oct 2022 17:05:54 +0100
+Subject: PATCH patch 9.0.0789: dummy buffer ends up in a window
+
+Problem: Dummy buffer ends up in a window.
+Solution: Disallow navigating to a dummy buffer.
+---
+ src/buffer.c | 7 +++++++
+ src/testdir/test_autocmd.vim | 20 ++++++++++++++++++++
+ 2 files changed, 27 insertions(+)
+
+diff --git a/src/buffer.c b/src/buffer.c
+index 0849b7099..5a4825feb 100644
+--- a/src/buffer.c
++++ b/src/buffer.c
+@@ -1332,6 +1332,13 @@ do_buffer_ext(
+ )
+ 	return OK;
+ #endif
++ if ((action == DOBUF_GOTO || action == DOBUF_SPLIT)
++						 && (buf->b_flags & BF_DUMMY))
++ {
++	// disallow navigating to the dummy buffer
++	semsg(_(e_buffer_nr_does_not_exist), count);
++	return FAIL;
++ }
+ 
+ #ifdef FEAT_GUI
+ need_mouse_correct = TRUE;
+diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
+index 0706e7307..6ba1b02df 100644
+--- a/src/testdir/test_autocmd.vim
++++ b/src/testdir/test_autocmd.vim
+@@ -3857,4 +3857,24 @@ func Test_autocmd_delete()
+ call assert_true(autocmd_delete(test_null_dict()))
+ endfunc
+ 
++func Test_autocmd_split_dummy()
++ " Autocommand trying to split a window containing a dummy buffer.
++ auto BufReadPre * exe "sbuf " .. expand("<abuf>") 
++ " Avoid the "W11" prompt
++ au FileChangedShell * let v:fcs_choice = 'reload'
++ func Xautocmd_changelist()
++ cal writefile('Xtestfile2:4:4', 'Xerr')
++ edit Xerr
++ lex 'Xtestfile2:4:4'
++ endfunc
++ call Xautocmd_changelist()
++ call assert_fails('call Xautocmd_changelist()', 'E86:')
++
++ au! BufReadPre
++ au! FileChangedShell
++ delfunc Xautocmd_changelist
++ bwipe! Xerr
++ call delete('Xerr')
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+2.27.0
+

_service:tar_scm:backport-CVE-2022-3705.patch Added

@@ -0,0 +1,72 @@
+From d0fab10ed2a86698937e3c3fed2f10bd9bb5e731 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Thu, 20 Oct 2022 16:03:33 +0100
+Subject: PATCH patch 9.0.0805: filetype autocmd may cause freed memory
+ access
+
+Problem: Filetype autocmd may cause freed memory access.
+Solution: Set the quickfix-busy flag while filling the buffer.
+---
+ src/quickfix.c | 6 ++++++
+ src/testdir/test_quickfix.vim | 16 ++++++++++++++++
+ 2 files changed, 22 insertions(+)
+
+diff --git a/src/quickfix.c b/src/quickfix.c
+index a90611475ab1..f85fff56f23d 100644
+--- a/src/quickfix.c
++++ b/src/quickfix.c
+@@ -4543,6 +4543,9 @@ qf_update_buffer(qf_info_T *qi, qfline_T *old_last)
+ 	 qf_winid = win->w_id;
+ 	}
+ 
++	// autocommands may cause trouble
++	incr_quickfix_busy();
++
+ 	if (old_last == NULL)
+ 	 // set curwin/curbuf to buf and save a few things
+ 	 aucmd_prepbuf(&aco, buf);
+@@ -4564,6 +4567,9 @@ qf_update_buffer(qf_info_T *qi, qfline_T *old_last)
+ 	// when the added lines are not visible.
+ 	if ((win = qf_find_win(qi)) != NULL && old_line_count < win->w_botline)
+ 	 redraw_buf_later(buf, NOT_VALID);
++
++	// always called after incr_quickfix_busy()
++	decr_quickfix_busy();
+ }
+ }
+ 
+diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
+index 2ee754b39690..bcaef5da175c 100644
+--- a/src/testdir/test_quickfix.vim
++++ b/src/testdir/test_quickfix.vim
+@@ -3471,6 +3471,21 @@ func Test_resize_from_copen()
+ endtry
+ endfunc
+ 
++func Test_filetype_autocmd()
++ " this changes the location list while it is in use to fill a buffer
++ lexpr ''
++ lopen
++ augroup FT_loclist
++ au FileType * call setloclist(0, , 'f')
++ augroup END
++ silent! lolder
++ lexpr ''
++
++ augroup FT_loclist
++ au! FileType
++ augroup END
++endfunc
++
+ func Test_vimgrep_with_textlock()
+ new
+ 
+@@ -6380,4 +6395,5 @@ func Test_loclist_replace_autocmd()
+ call setloclist(0, , 'f')
+ endfunc
+ 
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+2.33.0
+

_service:tar_scm:backport-CVE-2022-4141.patch Added

@@ -0,0 +1,145 @@
+From cc762a48d42b579fb7bdec2c614636b830342dd5 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Fri, 25 Nov 2022 13:03:31 +0000
+Subject: PATCH patch 9.0.0947: invalid memory access in substitute with
+ function
+
+Problem: Invalid memory access in substitute with function that goes to
+ another file.
+Solution: Check for text locked in CTRL-W gf.
+---
+ src/normal.c | 33 ++++++++++++++++++++++++---------
+ src/proto/normal.pro | 1 +
+ src/testdir/test_substitute.vim | 19 +++++++++++++++++++
+ src/window.c | 4 +++-
+ 4 files changed, 47 insertions(+), 10 deletions(-)
+
+diff --git a/src/normal.c b/src/normal.c
+index 938ae718efa2..0d1eba759e69 100644
+--- a/src/normal.c
++++ b/src/normal.c
+@@ -192,13 +192,33 @@ check_text_locked(oparg_T *oap)
+ {
+ if (text_locked())
+ {
+-	clearopbeep(oap);
++	if (oap != NULL)
++	 clearopbeep(oap);
+ 	text_locked_msg();
+ 	return TRUE;
+ }
+ return FALSE;
+ }
+ 
++/*
++ * If text is locked, "curbuf_lock" or "allbuf_lock" is set:
++ * Give an error message, possibly beep and return TRUE.
++ * "oap" may be NULL.
++ */
++ int
++check_text_or_curbuf_locked(oparg_T *oap)
++{
++ if (check_text_locked(oap))
++	return TRUE;
++ if (curbuf_locked())
++ {
++	if (oap != NULL)
++	 clearop(oap);
++	return TRUE;
++ }
++ return FALSE;
++}
++
+ /*
+ * Handle the count before a normal command and set cap->count0.
+ */
+@@ -816,8 +836,7 @@ normal_cmd(
+ 	goto normal_end;
+ }
+ 
+- if ((nv_cmdsidx.cmd_flags & NV_NCW)
+-				&& (check_text_locked(oap) || curbuf_locked()))
++ if ((nv_cmdsidx.cmd_flags & NV_NCW) && check_text_or_curbuf_locked(oap))	 
+ 	// this command is not allowed now
+ 	goto normal_end;
+ 
+@@ -4058,13 +4077,9 @@ nv_gotofile(cmdarg_T *cap)
+ char_u	*ptr;
+ linenr_T	lnum = -1;
+ 
+- if (check_text_locked(cap->oap))
+-	return;
+- if (curbuf_locked())
+- {
+-	clearop(cap->oap);
++ if (check_text_or_curbuf_locked(cap->oap))	
+ 	return;
+- }
++
+ #ifdef FEAT_PROP_POPUP
+ if (ERROR_IF_TERM_POPUP_WINDOW)
+ 	return;
+diff --git a/src/proto/normal.pro b/src/proto/normal.pro
+index 106d0e1..eff08df 100644
+--- a/src/proto/normal.pro
++++ b/src/proto/normal.pro
+@@ -1,4 +1,5 @@
+ /* normal.c */
++int check_text_or_curbuf_locked(oparg_T *oap);
+ void normal_cmd(oparg_T *oap, int toplevel);
+ void check_visual_highlight(void);
+ void end_visual_mode(void);
+diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
+index 7e7ccff..73c8c57 100644
+--- a/src/testdir/test_substitute.vim
++++ b/src/testdir/test_substitute.vim
+@@ -1076,6 +1076,25 @@ func Test_sub_edit_scriptfile()
+ bwipe!
+ endfunc
+ 
++" This was editing another file from the expression.
++func Test_sub_expr_goto_other_file()
++ call writefile('', 'Xfileone', 'D')
++ enew!
++ call setline(1, 'a', 'b', 'c', 'd',
++	\ 'Xfileone zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz')
++
++ func g:SplitGotoFile()
++ exe "sil! norm 0\<C-W>gf"
++ return ''
++ endfunc
++
++ $
++ s/\%')/\=g:SplitGotoFile()
++
++ delfunc g:SplitGotoFile
++ bwipe!
++endfunc
++
+ " Test for the 2-letter and 3-letter :substitute commands
+ func Test_substitute_short_cmd()
+ new
+diff --git a/src/window.c b/src/window.c
+index 97cc77035f95..a2bebcaea4df 100644
+--- a/src/window.c
++++ b/src/window.c
+@@ -534,6 +534,8 @@ do_window(
+ case Ctrl_F:
+ wingotofile:
+ 		CHECK_CMDWIN;
++		if (check_text_or_curbuf_locked(NULL))
++		 break;
+ 
+ 		ptr = grab_file_name(Prenum1, &lnum);
+ 		if (ptr != NULL)
+@@ -857,7 +859,7 @@ win_split(int size, int flags)
+ * When "new_wp" is NULL: split the current window in two.
+ * When "new_wp" is not NULL: insert this window at the far
+ * top/left/right/bottom.
+- * return FAIL for failure, OK otherwise
++ * Return FAIL for failure, OK otherwise.
+ */
+ int
+ win_split_ins(
+-- 
+2.33.0

_service:tar_scm:backport-CVE-2022-4292.patch Added

@@ -0,0 +1,55 @@
+From c3d27ada14acd02db357f2d16347acc22cb17e93 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Mon, 14 Nov 2022 20:52:14 +0000
+Subject: PATCH patch 9.0.0882: using freed memory after SpellFileMissing
+ autocmd uses bwipe
+
+Problem: Using freed memory after SpellFileMissing autocmd uses bwipe.
+Solution: Bail out if the window no longer exists.
+---
+ src/spell.c | 4 ++--
+ src/testdir/test_spell.vim | 13 +++++++++++++
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/src/spell.c b/src/spell.c
+index 3664425..d204a95 100644
+--- a/src/spell.c
++++ b/src/spell.c
+@@ -2101,8 +2101,8 @@ did_set_spelllang(win_T *wp)
+ 	 {
+ 		spell_load_lang(lang);
+ 		// SpellFileMissing autocommands may do anything, including
+-		// destroying the buffer we are using...
+-		if (!bufref_valid(&bufref))
++		// destroying the buffer we are using or closing the window.
++		if (!bufref_valid(&bufref) || !win_valid_any_tab(wp))
+ 		{
+ 		 ret_msg = N_(e_spellfilemising_autocommand_deleted_buffer);
+ 		 goto theend;
+diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
+index bc948b0..33f0931 100644
+--- a/src/testdir/test_spell.vim
++++ b/src/testdir/test_spell.vim
+@@ -157,6 +157,19 @@ func Test_spell_file_missing()
+ %bwipe!
+ endfunc
+ 
++func Test_spell_file_missing_bwipe()
++ " this was using a window that was wiped out in a SpellFileMissing autocmd
++ set spelllang=xy
++ au SpellFileMissing * n0
++ set spell
++ au SpellFileMissing * bw
++ snext somefile
++
++ au! SpellFileMissing
++ bwipe!
++ set nospell spelllang=en
++endfunc
++
+ func Test_spelldump()
+ " In case the spell file is not found avoid getting the download dialog, we
+ " would get stuck at the prompt.
+-- 
+2.33.0
+

_service:tar_scm:backport-CVE-2022-4293.patch Added

@@ -0,0 +1,55 @@
+From cdef1cefa2a440911c727558562f83ed9b00e16b Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Thu, 20 Oct 2022 14:17:18 +0100
+Subject: PATCH patch 9.0.0804: crash when trying to divide a number by -1
+
+Problem: Crash when trying to divice the largest negative number by -1.
+Solution: Handle this case specifically.
+---
+ src/eval.c | 8 +++++++-
+ src/testdir/test_expr.vim | 6 ++++++
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/src/eval.c b/src/eval.c
+index 1652fcb4ae48..062fab0ac949 100644
+--- a/src/eval.c
++++ b/src/eval.c
+@@ -82,6 +82,12 @@ num_divide(varnumber_T n1, varnumber_T n2, int *failed)
+ 	else
+ 	 result = VARNUM_MAX;
+ }
++ else if (n1 == VARNUM_MIN && n2 == -1)
++ {
++	// specific case: trying to do VARNUM_MIN / -1 results in a positive
++	// number that doesn't fit in varnumber_T and causes an FPE
++	result = VARNUM_MAX;
++ }
+ else
+ 	result = n1 / n2;
+ 
+@@ -5906,7 +5912,7 @@ var2fpos(
+ }
+ 
+ /*
+- * Convert list in "arg" into position "psop" and optional file number "fnump".
++ * Convert list in "arg" into position "posp" and optional file number "fnump".
+ * When "fnump" is NULL there is no file number, only 3 items: lnum, col, off
+ * Note that the column is passed on as-is, the caller may want to decrement
+ * it to use 1 for the first column.
+diff --git a/src/testdir/test_expr.vim b/src/testdir/test_expr.vim
+index b47896340f60..e1fed369b747 100644
+--- a/src/testdir/test_expr.vim
++++ b/src/testdir/test_expr.vim
+@@ -764,6 +764,12 @@ func Test_eval_after_if()
+ call assert_equal('b', s:val)
+ endfunc
+ 
++func Test_divide_by_zero()
++ " only tests that this doesn't crash, the result is not important
++ echo 0 / 0
++ echo 0 / 0 / -1
++endfunc
++
+ " Test for command-line completion of expressions
+ func Test_expr_completion()
+ CheckFeature cmdline_compl

_service:tar_scm:backport-patch-9.0.0022-spell-test-fails.patch Added

_service:tar_scm:backport-patch-9.0.0054-compiler-warning-for-size_t-to-int-co.patch Added

_service:tar_scm:backport-patch-9.0.0712-wrong-column-when-calling-setcursorch-with-zero-lnum.patch Added

@@ -0,0 +1,137 @@
+From 79f234499b6692cc16970b7455bc9b002242632f Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Mon, 10 Oct 2022 12:42:57 +0100
+Subject: PATCH patch 9.0.0712: wrong column when calling setcursorcharpos()
+ with zero lnum
+
+Problem: Wrong column when calling setcursorcharpos() with zero lnum.
+Solution: Set the line number before calling buf_charidx_to_byteidx().
+ (closes #11329)
+---
+ src/eval.c | 10 +++++++---
+ src/evalfunc.c | 26 ++++++++++++++------------
+ src/testdir/test_cursor_func.vim | 6 ++++++
+ 3 files changed, 27 insertions(+), 15 deletions(-)
+
+diff --git a/src/eval.c b/src/eval.c
+index 8df374a..cbd4740 100644
+--- a/src/eval.c
++++ b/src/eval.c
+@@ -5906,10 +5906,12 @@ var2fpos(
+ }
+ 
+ /*
+- * Convert list in "arg" into a position and optional file number.
+- * When "fnump" is NULL there is no file number, only 3 items.
++ * Convert list in "arg" into position "psop" and optional file number "fnump".
++ * When "fnump" is NULL there is no file number, only 3 items: lnum, col, off
+ * Note that the column is passed on as-is, the caller may want to decrement
+ * it to use 1 for the first column.
++ * If "charcol" is TRUE use the column as the character index instead of the
++ * byte index.
+ * Return FAIL when conversion is not possible, doesn't check the position for
+ * validity.
+ */
+@@ -5952,6 +5954,7 @@ list2fpos(
+ if (n < 0)
+ 	return FAIL;
+ // If character position is specified, then convert to byte position
++ // If the line number is zero use the cursor line.
+ if (charcol)
+ {
+ 	buf_T	*buf;
+@@ -5961,7 +5964,8 @@ list2fpos(
+ 	if (buf == NULL || buf->b_ml.ml_mfp == NULL)
+ 	 return FAIL;
+ 
+-	n = buf_charidx_to_byteidx(buf, posp->lnum, n) + 1;
++	n = buf_charidx_to_byteidx(buf,
++		 posp->lnum == 0 ? curwin->w_cursor.lnum : posp->lnum, n) + 1;
+ }
+ posp->col = n;
+ 
+diff --git a/src/evalfunc.c b/src/evalfunc.c
+index cb12a46..2703865 100644
+--- a/src/evalfunc.c
++++ b/src/evalfunc.c
+@@ -3484,7 +3484,7 @@ f_copy(typval_T *argvars, typval_T *rettv)
+ static void
+ set_cursorpos(typval_T *argvars, typval_T *rettv, int charcol)
+ {
+- long	line, col;
++ long	lnum, col;
+ long	coladd = 0;
+ int		set_curswant = TRUE;
+ 
+@@ -3506,7 +3506,7 @@ set_cursorpos(typval_T *argvars, typval_T *rettv, int charcol)
+ 	 emsg(_(e_invalid_argument));
+ 	 return;
+ 	}
+-	line = pos.lnum;
++	lnum = pos.lnum;
+ 	col = pos.col;
+ 	coladd = pos.coladd;
+ 	if (curswant >= 0)
+@@ -3515,17 +3515,19 @@ set_cursorpos(typval_T *argvars, typval_T *rettv, int charcol)
+ 	 set_curswant = FALSE;
+ 	}
+ }
+- else if ((argvars0.v_type == VAR_NUMBER ||
+-					argvars0.v_type == VAR_STRING)
+-	 && (argvars1.v_type == VAR_NUMBER ||
+-					argvars1.v_type == VAR_STRING))
++ else if ((argvars0.v_type == VAR_NUMBER
++					 || argvars0.v_type == VAR_STRING)
++	 && (argvars1.v_type == VAR_NUMBER
++					 || argvars1.v_type == VAR_STRING))
+ {
+-	line = tv_get_lnum(argvars);
+-	if (line < 0)
++	lnum = tv_get_lnum(argvars);
++	if (lnum < 0)
+ 	 semsg(_(e_invalid_argument_str), tv_get_string(&argvars0));
++	else if (lnum == 0)
++	 lnum = curwin->w_cursor.lnum;
+ 	col = (long)tv_get_number_chk(&argvars1, NULL);
+ 	if (charcol)
+-	 col = buf_charidx_to_byteidx(curbuf, line, col) + 1;
++	 col = buf_charidx_to_byteidx(curbuf, lnum, col) + 1;
+ 	if (argvars2.v_type != VAR_UNKNOWN)
+ 	 coladd = (long)tv_get_number_chk(&argvars2, NULL);
+ }
+@@ -3534,10 +3536,10 @@ set_cursorpos(typval_T *argvars, typval_T *rettv, int charcol)
+ 	emsg(_(e_invalid_argument));
+ 	return;
+ }
+- if (line < 0 || col < 0 || coladd < 0)
++ if (lnum < 0 || col < 0 || coladd < 0)
+ 	return;		// type error; errmsg already given
+- if (line > 0)
+-	curwin->w_cursor.lnum = line;
++ if (lnum > 0)
++	curwin->w_cursor.lnum = lnum;
+ if (col > 0)
+ 	curwin->w_cursor.col = col - 1;
+ curwin->w_cursor.coladd = coladd;
+diff --git a/src/testdir/test_cursor_func.vim b/src/testdir/test_cursor_func.vim
+index d5f0ac7..d2685ed 100644
+--- a/src/testdir/test_cursor_func.vim
++++ b/src/testdir/test_cursor_func.vim
+@@ -399,8 +399,14 @@ func Test_setcursorcharpos()
+ normal G
+ call setcursorcharpos(1, 1)
+ call assert_equal(1, 1, line('.'), col('.'))
++
+ call setcursorcharpos(2, 7, 0)
+ call assert_equal(2, 9, line('.'), col('.'))
++ call setcursorcharpos(0, 7, 0)
++ call assert_equal(2, 9, line('.'), col('.'))
++ call setcursorcharpos(0, 7, 0)
++ call assert_equal(2, 9, line('.'), col('.'))
++
+ call setcursorcharpos(3, 4)
+ call assert_equal(3, 1, line('.'), col('.'))
+ call setcursorcharpos(3, 1)
+-- 
+2.33.0
+

_service:tar_scm:backport-patch-9.0.0790-test-for-dummy-buffer-does-not-always.patch Added

@@ -0,0 +1,29 @@
+From 53c5c9f50ca68d3ed559eebb2c5f7d23f39a768c Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Tue, 18 Oct 2022 17:25:03 +0100
+Subject: PATCH patch 9.0.0790: test for dummy buffer does not always produce
+ the E86 error
+
+Problem: Test for dummy buffer does not always produce the E86 error.
+Solution: Do not check if the error is produced.
+---
+ src/testdir/test_autocmd.vim | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
+index 6ba1b02df..04f3e1431 100644
+--- a/src/testdir/test_autocmd.vim
++++ b/src/testdir/test_autocmd.vim
+@@ -3868,7 +3868,8 @@ func Test_autocmd_split_dummy()
+ lex 'Xtestfile2:4:4'
+ endfunc
+ call Xautocmd_changelist()
+- call assert_fails('call Xautocmd_changelist()', 'E86:')
++ " Should get E86, but it doesn't always happen (timing?)
++ silent! call Xautocmd_changelist()
+ 
+ au! BufReadPre
+ au! FileChangedShell
+-- 
+2.27.0
+

_service:tar_scm:backport-spell-test-fails-because-error-message-changed.patch Added

_service:tar_scm:bugfix-rm-modify-info-version.patch Added

_service:tar_scm:vim-7.0-fixkeys.patch Added

_service:tar_scm:vim-7.4-fstabsyntax.patch Added

@@ -0,0 +1,21 @@
+diff -up vim82/runtime/syntax/fstab.vim.fstabsyntax vim82/runtime/syntax/fstab.vim
+--- vim82/runtime/syntax/fstab.vim.fstabsyntax	2020-08-10 12:08:01.000000000 +0200
++++ vim82/runtime/syntax/fstab.vim	2020-08-10 12:17:22.540855735 +0200
+@@ -56,7 +56,7 @@ syn keyword fsMountPointKeyword containe
+ " Type
+ syn cluster fsTypeCluster contains=fsTypeKeyword,fsTypeUnknown
+ syn match fsTypeUnknown /\s\+\zs\w\+/ contained
+-syn keyword fsTypeKeyword contained adfs ados affs anon_inodefs atfs audiofs auto autofs bdev befs bfs btrfs binfmt_misc cd9660 cfs cgroup cifs coda configfs cpuset cramfs devfs devpts devtmpfs e2compr efs ext2 ext2fs ext3 ext4 fdesc ffs filecore fuse fuseblk fusectl hfs hpfs hugetlbfs iso9660 jffs jffs2 jfs kernfs lfs linprocfs mfs minix mqueue msdos ncpfs nfs nfsd nilfs2 none ntfs null nwfs overlay ovlfs pipefs portal proc procfs pstore ptyfs qnx4 reiserfs ramfs romfs securityfs shm smbfs squashfs sockfs sshfs std subfs swap sysfs sysv tcfs tmpfs udf ufs umap umsdos union usbfs userfs vfat vs3fs vxfs wrapfs wvfs xenfs xfs zisofs
++syn keyword fsTypeKeyword contained adfs ados affs anon_inodefs atfs audiofs auto autofs bdev befs bfs btrfs binfmt_misc cd9660 cfs cgroup cifs coda configfs cpuset cramfs devfs devpts devtmpfs e2compr efs ext2 ext2fs ext3 ext4 fdesc ffs filecore fuse fuseblk fusectl hfs hpfs hugetlbfs iso9660 jffs jffs2 jfs kernfs lfs linprocfs mfs minix mqueue msdos ncpfs nfs nfsd nilfs2 none ntfs null nwfs overlay ovlfs pipefs portal proc procfs pstore ptyfs qnx4 reiserfs ramfs romfs rpc_pipefs securityfs shm smbfs squashfs sockfs sshfs std subfs swap sysfs sysv tcfs tmpfs udf ufs umap umsdos union usbfs userfs vfat vs3fs vxfs wrapfs wvfs xenfs xfs zisofs
+ 
+ " Options
+ " -------
+@@ -68,7 +68,7 @@ syn match fsOptionsString /a-zA-Z0-9_-
+ syn keyword fsOptionsYesNo yes no
+ syn cluster fsOptionsCheckCluster contains=fsOptionsExt2Check,fsOptionsFatCheck
+ syn keyword fsOptionsSize 512 1024 2048
+-syn keyword fsOptionsGeneral async atime auto bind current defaults dev devgid devmode devmtime devuid dirsync exec force fstab kudzu loop mand move noatime noauto noclusterr noclusterw nodev nodevmtime nodiratime noexec nomand norelatime nosuid nosymfollow nouser owner rbind rdonly relatime remount ro rq rw suid suiddir supermount sw sync union update user users wxallowed xx nofail failok
++syn keyword fsOptionsGeneral async atime auto bind current defaults dev devgid devmode devmtime devuid dirsync exec force fstab kudzu loop managed mand move noatime noauto noclusterr noclusterw nodev nodevmtime nodiratime noexec nomand norelatime nosuid nosymfollow nouser owner pamconsole rbind rdonly relatime remount ro rq rw suid suiddir supermount sw sync union update user users wxallowed xx nofail
+ syn match fsOptionsGeneral /_netdev/
+ 
+ " Options: adfs

_service:tar_scm:vim-7.4-globalsyntax.patch Added

@@ -0,0 +1,13 @@
+diff --git a/runtime/syntax/spec.vim b/runtime/syntax/spec.vim
+index 1a5a108..b709d20 100644
+--- a/runtime/syntax/spec.vim
++++ b/runtime/syntax/spec.vim
+@@ -111,7 +111,7 @@ syn region specDescriptionArea matchgroup=specSection start='^%description' end=
+ syn region specPackageArea matchgroup=specSection start='^%package' end='^%'me=e-1 contains=specPackageOpts,specPreAmble,specComment
+ 
+ "%% Scripts Section %%
+-syn region specScriptArea matchgroup=specSection start='^%$prep\|build\|install\|clean\|check\|pre\|postun\|preun\|post\|posttrans$\>' skip='^%{\|^%$define\|patch\d*\|configure\|GNUconfigure\|setup\|autosetup\|autopatch\|find_lang\|make_build\|makeinstall\|make_install$\>' end='^%'me=e-1 contains=specSpecialVariables,specVariables,@specCommands,specVariables,shDo,shFor,shCaseEsac,specNoNumberHilite,specCommandOpts,shComment,shIf,specSpecialChar,specMacroIdentifier,specSectionMacroArea,specSectionMacroBracketArea,shOperator,shQuote1,shQuote2
++syn region specScriptArea matchgroup=specSection start='^%$prep\|build\|install\|clean\|check\|pre\|postun\|preun\|post\|posttrans$\>' skip='^%{\|^%$define\|global\|patch\d*\|configure\|GNUconfigure\|setup\|autosetup\|autopatch\|find_lang\|make_build\|makeinstall\|make_install$\>' end='^%'me=e-1 contains=specSpecialVariables,specVariables,@specCommands,specVariables,shDo,shFor,shCaseEsac,specNoNumberHilite,specCommandOpts,shComment,shIf,specSpecialChar,specMacroIdentifier,specSectionMacroArea,specSectionMacroBracketArea,shOperator,shQuote1,shQuote2
+ 
+ "%% Changelog Section %%
+ syn region specChangelogArea matchgroup=specSection start='^%changelog' end='^%'me=e-1 contains=specEmail,specURL,specWeekday,specMonth,specNumber,specComment,specLicense

_service:tar_scm:vim-7.4-specsyntax.patch Added

@@ -0,0 +1,33 @@
+diff -up vim74/runtime/syntax/spec.vim.highlite vim74/runtime/syntax/spec.vim
+--- vim74/runtime/syntax/spec.vim.highlite	2016-07-04 10:17:45.000000000 +0200
++++ vim74/runtime/syntax/spec.vim	2016-08-04 15:20:26.116049343 +0200
+@@ -38,7 +38,7 @@ syn match specNoNumberHilite 'X11\|X11R6
+ syn match specManpageFile 'a-zA-Z\.1'
+ 
+ "Day, Month and most used license acronyms
+-syn keyword specLicense contained GPL LGPL BSD MIT GNU
++syn keyword specLicense contained GPL LGPL BSD MIT GNU distributable
+ syn keyword specWeekday contained Mon Tue Wed Thu Fri Sat Sun
+ syn keyword specMonth contained Jan Feb Mar Apr Jun Jul Aug Sep Oct Nov Dec
+ syn keyword specMonth contained January February March April May June July August September October November December
+@@ -61,9 +61,9 @@ syn cluster specListedFiles contains=spe
+ 
+ "specComands
+ syn match specConfigure contained '\./configure'
+-syn match specTarCommand contained '\<tar\s\+cxvpzIf\{,5}\s*'
++syn match specTarCommand contained '\<tar\s\+cxvpzIjf\{,5}\s*'
+ syn keyword specCommandSpecial contained root
+-syn keyword specCommand		contained make xmkmf mkdir chmod ln find sed rm strip moc echo grep ls rm mv mkdir install cp pwd cat tail then else elif cd gzip rmdir ln eval export touch
++syn keyword specCommand		contained make xmkmf mkdir chmod ln find sed rm strip moc echo grep ls rm mv mkdir install cp pwd cat tail then else elif cd gzip rmdir ln eval export touch bzip2 bunzip2 gunzip
+ syn cluster specCommands contains=specCommand,specTarCommand,specConfigure,specCommandSpecial
+ 
+ "frequently used rpm env vars
+@@ -105,7 +105,7 @@ syn case ignore
+ "%% PreAmble Section %%
+ "Copyright and Serial were deprecated by License and Epoch
+ syn region specPreAmbleDeprecated oneline matchgroup=specError start='^$Copyright\|Serial$' end='$' contains=specEmail,specURL,specURLMacro,specLicense,specColon,specVariables,specSpecialChar,specMacroIdentifier
+-syn region specPreAmble oneline matchgroup=specCommand start='^$Prereq\|Summary\|Name\|Version\|Packager\|Requires\|Recommends\|Suggests\|Supplements\|Enhances\|Icon\|URL\|Source\d*\|Patch\d*\|Prefix\|Packager\|Group\|License\|Release\|BuildRoot\|Distribution\|Vendor\|Provides\|ExclusiveArch\|ExcludeArch\|ExclusiveOS\|Obsoletes\|BuildArch\|BuildArchitectures\|BuildRequires\|BuildConflicts\|BuildPreReq\|Conflicts\|AutoRequires\|AutoReq\|AutoReqProv\|AutoProv\|Epoch$' end='$' contains=specEmail,specURL,specURLMacro,specLicense,specColon,specVariables,specSpecialChar,specMacroIdentifier
++syn region specPreAmble oneline matchgroup=specCommand start='^$Prereq\|Summary\|Name\|Version\|Packager\|Requires\|Recommends\|Suggests\|Supplements\|Enhances\|Icon\|URL\|Source\d*\|Patch\d*\|Prefix\|Packager\|Group\|License\|Release\|BuildRoot\|Distribution\|Vendor\|Provides\|ExclusiveArch\|ExcludeArch\|ExcludeOS\|ExclusiveOS\|Obsoletes\|BuildArch\|BuildArchitectures\|BuildRequires\|BuildConflicts\|BuildPreReq\|Conflicts\|AutoRequires\|AutoReq\|AutoReqProv\|AutoProv\|Epoch$' end='$' contains=specEmail,specURL,specURLMacro,specLicense,specColon,specVariables,specSpecialChar,specMacroIdentifier
+ 
+ "%% Description Section %%
+ syn region specDescriptionArea matchgroup=specSection start='^%description' end='^%'me=e-1 contains=specDescriptionOpts,specEmail,specURL,specNumber,specMacroIdentifier,specComment

_service:tar_scm:vim-8.0-copy-paste.patch Added

@@ -0,0 +1,87 @@
+diff --git a/runtime/defaults.vim b/runtime/defaults.vim
+index f1d5cd1..b08de8e 100644
+--- a/runtime/defaults.vim
++++ b/runtime/defaults.vim
+@@ -74,18 +74,6 @@ sunmap Q
+ " Revert with ":iunmap <C-U>".
+ inoremap <C-U> <C-G>u<C-U>
+ 
+-" In many terminal emulators the mouse works just fine. By enabling it you
+-" can position the cursor, Visually select and scroll with the mouse.
+-" Only xterm can grab the mouse events when using the shift key, for other
+-" terminals use ":", select text and press Esc.
+-if has('mouse')
+- if &term =~ 'xterm'
+- set mouse=a
+- else
+- set mouse=nvi
+- endif
+-endif
+-
+ " Only do this part when Vim was compiled with the +eval feature.
+ if 1
+ 
+diff --git a/src/testdir/test_balloon.vim b/src/testdir/test_balloon.vim
+index ed0c6c1..90c8c40 100644
+--- a/src/testdir/test_balloon.vim
++++ b/src/testdir/test_balloon.vim
+@@ -9,6 +9,7 @@ source screendump.vim
+ CheckScreendump
+ 
+ let s:common_script =<< trim CODE
++ set mouse=a
+ call setline(1, "one one one", "two tXo two", "three three three")
+ set balloonevalterm balloonexpr=MyBalloonExpr()..s:trailing balloondelay=100
+ let s:trailing = '<' " check that script context is set
+diff --git a/src/testdir/test_popupwin.vim b/src/testdir/test_popupwin.vim
+index b91689e..c6b70d1 100644
+--- a/src/testdir/test_popupwin.vim
++++ b/src/testdir/test_popupwin.vim
+@@ -553,6 +553,7 @@ func Test_popup_drag()
+ " create a popup that covers the command line
+ let lines =<< trim END
+ 	call setline(1, range(1, 20))
++	set mouse=a
+ 	split
+ 	vsplit
+ 	$wincmd w
+@@ -621,6 +622,7 @@ func Test_popup_drag_minwidth()
+ 
+ " create a popup that does not fit
+ let lines =<< trim END
++ set mouse=a
+ call range(40)
+ 	 \ ->map({_,i -> string(i)})
+ 	 \ ->popup_create({
+@@ -669,6 +671,7 @@ func Test_popup_drag_termwin()
+ let lines =<< trim END
+ 	set foldmethod=marker
+ 	call setline(1, range(100))
++	set mouse=a
+ 	for nr in range(7)
+ 	 call setline(nr * 12 + 1, "fold {{{")
+ 	 call setline(nr * 12 + 11, "end }}}")
+@@ -722,6 +725,7 @@ func Test_popup_close_with_mouse()
+ 
+ let lines =<< trim END
+ 	call setline(1, range(1, 20))
++	set mouse=a
+ 	" With border, can click on X
+ 	let winid = popup_create('foobar', #{
+ 	 \ close: 'button',
+@@ -1557,6 +1561,7 @@ func Test_popup_beval()
+ let lines =<< trim END
+ 	call setline(1, range(1, 20))
+ 	call setline(5, 'here is some text to hover over')
++	set mouse=a
+ 	set balloonevalterm
+ 	set balloonexpr=BalloonExpr()
+ 	set balloondelay=100
+@@ -2262,6 +2267,7 @@ func Test_popup_scrollbar()
+ 
+ let lines =<< trim END
+ call setline(1, range(1, 20))
++ set mouse=a
+ hi ScrollThumb ctermbg=blue
+ hi ScrollBar ctermbg=red
+ let winid = popup_create('one', 'two', 'three', 'four', 'five',

_service:tar_scm:vim-python3-tests.patch Added

@@ -0,0 +1,87 @@
+diff -up vim82/runtime/tools/demoserver.py.python-tests vim82/runtime/tools/demoserver.py
+--- vim82/runtime/tools/demoserver.py.python-tests	2019-07-26 07:58:50.000000000 +0200
++++ vim82/runtime/tools/demoserver.py	2020-04-17 06:18:06.748977527 +0200
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python3
+ #
+ # Server that will accept connections from a Vim channel.
+ # Run this server and then in Vim you can open the channel:
+diff -up vim82/src/auto/configure.python-tests vim82/src/auto/configure
+--- vim82/src/auto/configure.python-tests	2020-04-17 06:07:48.000000000 +0200
++++ vim82/src/auto/configure	2020-04-17 06:18:06.750977509 +0200
+@@ -6418,7 +6418,7 @@ eof
+ 	 if test "x$MACOS_X" = "xyes" && test -n "${python_PYTHONFRAMEWORK}" && ${vi_cv_path_python} -c \
+ 		"import sys; sys.exit(${vi_cv_var_python_version} < 2.3)"; then
+ 	 vi_cv_path_python_plibs="-framework Python"
+-	 if test "x${vi_cv_path_python}" != "x/usr/bin/python" && test -n "${python_PYTHONFRAMEWORKPREFIX}"; then
++	 if test "x${vi_cv_path_python}" != "x/usr/bin/python2" && test -n "${python_PYTHONFRAMEWORKPREFIX}"; then
+ 		 vi_cv_path_python_plibs="-F${python_PYTHONFRAMEWORKPREFIX} -framework Python"
+ 	 fi
+ 	 else
+diff -up vim82/src/configure.ac.python-tests vim82/src/configure.ac
+--- vim82/src/configure.ac.python-tests	2020-04-17 06:07:48.000000000 +0200
++++ vim82/src/configure.ac	2020-04-17 06:18:06.750977509 +0200
+@@ -1263,7 +1263,7 @@ eof
+ 	 if test "x$MACOS_X" = "xyes" && test -n "${python_PYTHONFRAMEWORK}" && ${vi_cv_path_python} -c \
+ 		"import sys; sys.exit(${vi_cv_var_python_version} < 2.3)"; then
+ 	 vi_cv_path_python_plibs="-framework Python"
+-	 if test "x${vi_cv_path_python}" != "x/usr/bin/python" && test -n "${python_PYTHONFRAMEWORKPREFIX}"; then
++	 if test "x${vi_cv_path_python}" != "x/usr/bin/python2" && test -n "${python_PYTHONFRAMEWORKPREFIX}"; then
+ 		 vi_cv_path_python_plibs="-F${python_PYTHONFRAMEWORKPREFIX} -framework Python"
+ 	 fi
+ 	 else
+diff -up vim82/src/testdir/test_channel_pipe.py.python-tests vim82/src/testdir/test_channel_pipe.py
+--- vim82/src/testdir/test_channel_pipe.py.python-tests	2019-07-26 07:58:53.000000000 +0200
++++ vim82/src/testdir/test_channel_pipe.py	2020-04-17 06:18:06.751977500 +0200
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python3
+ #
+ # Server that will communicate over stdin/stderr
+ #
+diff -up vim82/src/testdir/test_channel.py.python-tests vim82/src/testdir/test_channel.py
+--- vim82/src/testdir/test_channel.py.python-tests	2020-04-17 06:18:06.751977500 +0200
++++ vim82/src/testdir/test_channel.py	2020-04-17 06:18:24.517813082 +0200
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env python
++#!/usr/bin/python3
+ #
+ # Server that will accept connections from a Vim channel.
+ # Used by test_channel.vim.
+diff -up vim82/src/testdir/test_channel_write.py.python-tests vim82/src/testdir/test_channel_write.py
+--- vim82/src/testdir/test_channel_write.py.python-tests	2019-07-26 07:58:53.000000000 +0200
++++ vim82/src/testdir/test_channel_write.py	2020-04-17 06:18:06.751977500 +0200
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python3
+ #
+ # Program that writes a number to stdout repeatedly
+ #
+diff -up vim82/src/testdir/test_makeencoding.py.python-tests vim82/src/testdir/test_makeencoding.py
+--- vim82/src/testdir/test_makeencoding.py.python-tests	2019-07-26 07:58:53.000000000 +0200
++++ vim82/src/testdir/test_makeencoding.py	2020-04-17 06:18:06.751977500 +0200
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python3
+ # -*- coding: utf-8 -*-
+ 
+ # Test program for :make, :grep and :cgetfile.
+diff -up vim82/src/testdir/test_netbeans.py.python-tests vim82/src/testdir/test_netbeans.py
+--- vim82/src/testdir/test_netbeans.py.python-tests	2019-07-26 07:58:53.000000000 +0200
++++ vim82/src/testdir/test_netbeans.py	2020-04-17 06:18:06.751977500 +0200
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python3
+ #
+ # Server that will communicate with Vim through the netbeans interface.
+ # Used by test_netbeans.vim.
+diff -up vim82/src/testdir/test_short_sleep.py.python-tests vim82/src/testdir/test_short_sleep.py
+--- vim82/src/testdir/test_short_sleep.py.python-tests	2019-07-26 07:58:53.000000000 +0200
++++ vim82/src/testdir/test_short_sleep.py	2020-04-17 06:18:06.751977500 +0200
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python3
+ #
+ # Program that sleeps for 100 msec
+ #

_service Changed

_service:extract_file:vim-8.2.tar.bz2 Deleted

_service:extract_file:vim.yaml Deleted

_service:extract_file:vimrc Deleted

_service:extract_file:virc Deleted

_service:tar_scm:vim-1653981035.05679aa.tar -> _service:tar_scm:vim-9.0.tar.bz2 Changed

_service:tar_scm:vim.yaml Added

_service:tar_scm:vimrc Added

_service:tar_scm:virc Added