开源软件构建与测试

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

Changes of Revision 2

_service:tar_scm:vim.spec Changed

@@ -6,116 +6,103 @@
 %{!?_with_lua__:%define _with_lua__ 1}
 %{!?_with_netbeans__:%define _with_netbeans__ 1}
 
-%define vimdir vim82
+%define vimdir vim90
 %define python_ver %{python3_version}
 
 Name:           vim
 Epoch:          2
-Version:        8.2
-Release:        39
+Version:        9.0
+Release:        33
 Summary:        Vim is a highly configurable text editor for efficiently creating and changing any kind of text.
 License:        Vim and MIT
 URL:            http://www.vim.org
-Source0:        ftp://ftp.vim.org/pub/vim/unix/vim-8.2.tar.bz2
+Source0:        ftp://ftp.vim.org/pub/vim/unix/vim-%{version}.tar.bz2
 Source1:	    virc
 Source2:	    vimrc
 
 Patch0000:      vim-7.0-fixkeys.patch
 Patch0001:      vim-7.4-specsyntax.patch
-Patch0002:      vim-7.4-syntax.patch
-Patch0003:      vim-7.4-nowarnings.patch
-Patch0004:      vim-7.0-rclocation.patch
-Patch0005:      vim-7.4-checkhl.patch
 Patch0006:      vim-7.4-fstabsyntax.patch
-Patch0007:      vim-7.4-syncolor.patch
 Patch0009:      vim-7.4-globalsyntax.patch
-Patch0010:      vim-7.4-releasestring-1318991.patch
 Patch0011:      vim-8.0-copy-paste.patch
 Patch0012:      vim-python3-tests.patch
-Patch0013:	Fix-vim-lua5.4.0-defines+luaL_typeerror-twice.patch
-Patch6000:      backport-Configure-does-not-recognize-gcc-10.0-and-later.patch
-Patch6001:      backport-8.2.2550-signal-stack-size-is-wrong-with-lates.patch
-Patch6002:      backport-CVE-2021-3770.patch
-Patch6003:      backport-memory-leak-for-retab-with-invalid-argument.patch
-Patch6004:      backport-CVE-2021-3778.patch
-Patch6005:      backport-CVE-2021-3796.patch
-Patch6006:      backport-CVE-2021-3872.patch
-Patch6007:      backport-CVE-2021-3875.patch
-Patch6008:      backport-CVE-2021-3903.patch
-Patch6009:      backport-CVE-2021-3927.patch
-Patch6010:      backport-CVE-2021-3928.patch
-Patch6011:      backport-Python-3.9-does-not-define-_Py_DEC_REFTOTAL.patch
-Patch6012:      backport-linker-errors-when-building-with-dynamic-Python-3.9.patch
-Patch6013:      backport-PyEval_InitThreads-is-deprecated-in-Python-3.9.patch
-Patch6014:      backport-linker-errors-with-dynamic-Python-3.10.patch
-Patch6015:      backport-configure-cannot-detect-Python-3.10.patch
-Patch6016:      backport-CVE-2021-3973.patch
-Patch6017:      backport-CVE-2021-3974.patch
-Patch6018:      backport-find-test-fails.patch
-Patch6019:      backport-no-early-check-if-find-and-sfind-have-an-argument.patch
-Patch6020:      backport-CVE-2021-3984.patch
-Patch6021:      backport-CVE-2021-4019.patch
-Patch6022:      backport-CVE-2021-4069.patch
-Patch6023:      backport-build-failure-with-Perl5.32.patch
-Patch6024:      backport-cannot-build-with-Strawberry-Perl-5.32.0.patch
-Patch6025:      backport-cannot-build-with-Perl-5.34.patch
-Patch6026:      backport-macros-for-Ruby-are-too-complicated.patch
-Patch6027:      backport-build-problem-with-Ruby-2.7.patch
-Patch6028:      backport-Ruby-missing-function-prototype.patch
-Patch6029:      backport-build-failure-with-some-Ruby-versions.patch
-Patch6030:      backport-compilation-error-with-Ruby-3.0.patch
-Patch6031:      backport-build-failure-with-Ruby-3.0-and-32-bits.patch
-Patch6032:      backport-missing-error-message.patch
-Patch6033:      backport-fix-giving-the-error-0-more-files-to-edit.patch
-Patch6034:      backport-add-the-arglist_locked-flag.patch
-Patch6035:      backport-CVE-2021-4166.patch
-Patch6036:      backport-fix-arglist-test-fails.patch
-Patch6037:      backport-CVE-2021-4192.patch
-Patch6038:      backport-CVE-2021-4193.patch
-Patch6039:	backport-CVE-2022-0213.patch
-Patch6040:	backport-CVE-2022-0261.patch
-Patch6041:	backport-CVE-2022-0318.patch
-Patch6042:      backport-vim-fix-garbled-characters-display-when-file-name-ma.patch
-Patch6043:      backport-CVE-2022-0351.patch
-Patch6044:      backport-CVE-2022-0408.patch
-Patch6045:      backport-CVE-2022-0361.patch
-Patch6046:      backport-CVE-2022-0359.patch
-Patch6047:      backport-CVE-2022-0413.patch
-Patch6048:      backport-CVE-2022-0368.patch
-Patch6049:      backport-CVE-2022-0443.patch
-Patch6050:      backport-CVE-2022-0392.patch
-Patch6051:      backport-invalid-argument-errmsg.patch
-Patch6052:      backport-CVE-2022-0417.patch
-Patch6053:      backport-crash-when-pasting-too-many-times.patch
-Patch6054:      backport-CVE-2022-0572.patch
-Patch6055:      backport-CVE-2022-0629.patch
-Patch6056:      backport-CVE-2022-0714.patch
-Patch6057:      backport-CVE-2022-0729.patch
-Patch6058:      backport-CVE-2022-0685.patch
-Patch6059:      backport-CVE-2022-0319.patch
-Patch6060:      backport-CVE-2022-0554.patch
-Patch6061:      backport-CVE-2022-0943.patch
-Patch6062:      backport-CVE-2022-1616.patch
-Patch6063:      backport-CVE-2022-1154.patch
-Patch6064:      backport-html-text-objects-are-not-fully-tested.patch
-Patch6065:      backport-CVE-2022-1629.patch
-Patch6066:      backport-insufficient-code-coverage-for-ex_docmd.c_functions.patch
-Patch6067:      backport-CVE-2022-1620.patch
-Patch6068:      backport-CVE-2022-1674.patch
-Patch6069:      backport-CVE-2022-1621.patch
-Patch6070:      backport-spell-test-fails-because-of-new-illegal-byte-check.patch
-Patch6071:      backport-command-line-editing-not-sufficiently-tested.patch
-Patch6072:      backport-CVE-2022-1619.patch
-Patch6073:      backport-CVE-2022-1733.patch
-Patch6074:      backport-CVE-2022-1735.patch
-Patch6075:      backport-CVE-2022-1771.patch
-Patch6076:      backport-CVE-2022-2124.patch
+
+Patch6000:      backport-CVE-2022-2257.patch
+Patch6001:      backport-CVE-2022-2264.patch
+Patch6002:      backport-CVE-2022-2284.patch
+Patch6003:      backport-CVE-2022-2285.patch
+Patch6004:      backport-CVE-2022-2286.patch
+Patch6005:      backport-CVE-2022-2287.patch
+Patch6006:      backport-CVE-2022-2288.patch
+Patch6007:      backport-patch-9.0.0022-spell-test-fails.patch
+Patch6008:      backport-CVE-2022-2289.patch
+Patch6009:      backport-CVE-2022-2304.patch
+Patch6010:      backport-CVE-2022-2343.patch
+Patch6011:      backport-CVE-2022-2344.patch
+Patch6012:      backport-CVE-2022-2345.patch
+Patch6013:      backport-patch-9.0.0054-compiler-warning-for-size_t-to-int-co.patch
+Patch6014:      backport-CVE-2022-2522.patch
+Patch6015:      backport-CVE-2022-2598.patch
+Patch6016:      backport-CVE-2022-2571.patch
+Patch6017:      backport-CVE-2022-2580.patch
+Patch6018:      backport-CVE-2022-2581.patch
+Patch6019:      backport-CVE-2022-2819.patch
+Patch6020:      backport-CVE-2022-2816.patch
+Patch6021:      backport-CVE-2022-2817.patch
+Patch6022:      backport-CVE-2022-2845.patch
+Patch6023:      backport-CVE-2022-2849.patch
+Patch6024:      backport-CVE-2022-2862.patch
+Patch6025:      backport-CVE-2022-2874.patch
+Patch6026:      backport-CVE-2022-2889.patch
+Patch6027:      backport-CVE-2022-2923.patch
+Patch6028:      backport-CVE-2022-2946.patch
+Patch6029:      backport-CVE-2022-2980.patch
+Patch6030:      backport-CVE-2022-2982.patch
+Patch6031:      backport-CVE-2022-3016.patch
+Patch6032:      backport-CVE-2022-3037.patch
+Patch6033:      backport-CVE-2022-3099.patch
+Patch6034:      backport-CVE-2022-3134.patch
+Patch6035:      backport-CVE-2022-3153.patch
+Patch6036:      backport-CVE-2022-3234.patch
+Patch6037:      backport-CVE-2022-3235.patch
+Patch6038:      backport-CVE-2022-3256.patch
+Patch6039:      backport-CVE-2022-3296.patch
+Patch6040:      backport-CVE-2022-3352.patch
+Patch6041:      backport-spell-test-fails-because-error-message-changed.patch
+Patch6042:      backport-CVE-2022-3278.patch
+Patch6043:      backport-CVE-2022-3297.patch
+Patch6044:      backport-9.0.0581-adding-a-character-for-incsearch-fails-at-end-of-line.patch
+Patch6045:      backport-CVE-2022-3324.patch
+Patch6046:      backport-CVE-2022-3705.patch
+Patch6047:      backport-CVE-2022-4141.patch
+Patch6048:      backport-CVE-2022-3491.patch
+Patch6049:      backport-CVE-2022-3520.patch
+Patch6050:      backport-CVE-2022-3591.patch
+Patch6051:      backport-patch-9.0.0790-test-for-dummy-buffer-does-not-always.patch
+Patch6052:      backport-CVE-2022-4292.patch
+Patch6053:      backport-patch-9.0.0712-wrong-column-when-calling-setcursorch-with-zero-lnum.patch
+Patch6054:      backport-CVE-2022-4293.patch
+Patch6055:      backport-CVE-2023-0049.patch
+Patch6056:      backport-CVE-2023-0051.patch
+Patch6057:      backport-CVE-2023-0054.patch
+Patch6058:      backport-CVE-2022-47024.patch
+Patch6059:      backport-CVE-2023-0288.patch
+Patch6060:      backport-CVE-2023-0433.patch
+Patch6061:      backport-patch-9.0.0024-may-access-part-of-typeahead-buf-that-is-not-filled.patch
+Patch6062:      backport-patch-9.0.1331-illegal-memory-access-when-using-ball-in-Visual-mode.patch
+Patch6063:      backport-CVE-2023-1170.patch
+Patch6064:      backport-CVE-2023-1175.patch
+Patch6065:      backport-CVE-2023-1264.patch
+Patch6066:      backport-vim-7.0-rclocation.patch
+Patch6067:      backport-CVE-2023-2426.patch
+Patch6068:      backport-CVE-2023-2609.patch
+Patch6069:      backport-CVE-2023-2610.patch
 
 Patch9000:      bugfix-rm-modify-info-version.patch
 
 BuildRequires:  autoconf python3-devel ncurses-devel gettext perl-devel perl-generators gcc
 BuildRequires:  perl(ExtUtils::Embed) perl(ExtUtils::ParseXS) libacl-devel gpm-devel file
-BuildRequires:  desktop-file-utils >= 0.2.93
+BuildRequires:  desktop-file-utils >= 0.2.93 libtool make chrpath
 %if %{_with_selinux__}
 BuildRequires:  libselinux-devel
 %endif
@@ -197,6 +184,9 @@
 %prep
 %autosetup -b 0 -n %{vimdir} -p1
 
+#ipv6 test fail in CI, it should be related to the ipv6 configuration on jenkins, which is successful on openEuler obs
+rm -rf src/testdir/test_channel.*
+

_service:tar_scm:Fix-vim-lua5.4.0-defines+luaL_typeerror-twice.patch Deleted

@@ -1,56 +0,0 @@
-From ea3ebd50e2a4ec26ee503f352a1280e11e4af93b Mon Sep 17 00:00:00 2001
-From: Zdenek Dohnal <zdohnal@redhat.com>
-Date: Tue, 14 Jul 2020 12:14:03 +0200
-Subject: PATCH if_lua.c: new Lua 5.4.0 defines luaL_typeerror, so don't
- define it twice
- 
----
- src/if_lua.c | 11 ++++++++++-
- 1 file changed, 10 insertions(+), 1 deletion(-)
-
-diff --git a/src/if_lua.c b/src/if_lua.c
-index 9b03c97..81faf92 100644
---- a/src/if_lua.c
-+++ b/src/if_lua.c
-@@ -109,6 +109,9 @@ static luaV_Funcref *luaV_pushfuncref(lua_State *L, char_u *name);
- #define luaL_loadbufferx dll_luaL_loadbufferx
- #define luaL_argerror dll_luaL_argerror
- #endif
-+#if LUA_VERSION_NUM >= 504
-+#define luaL_typeerror dll_luaL_typeerror
-+#endif
- #define luaL_checkany dll_luaL_checkany
- #define luaL_checklstring dll_luaL_checklstring
- #define luaL_checkinteger dll_luaL_checkinteger
-@@ -203,6 +206,9 @@ int (*dll_luaL_loadfilex) (lua_State *L, const char *filename, const char *mode)
- int (*dll_luaL_loadbufferx) (lua_State *L, const char *buff, size_t sz, const char *name, const char *mode);
- int (*dll_luaL_argerror) (lua_State *L, int numarg, const char *extramsg);
- #endif
-+#if LUA_VERSION_NUM >= 504
-+int (*dll_luaL_typeerror) (lua_State *L, int narg, const char *tname);
-+#endif
- void (*dll_luaL_checkany) (lua_State *L, int narg);
- const char *(*dll_luaL_checklstring) (lua_State *L, int numArg, size_t *l);
- lua_Integer (*dll_luaL_checkinteger) (lua_State *L, int numArg);
-@@ -314,6 +320,9 @@ static const luaV_Reg luaV_dll = {
- {"luaL_loadfilex", (luaV_function) &dll_luaL_loadfilex},
- {"luaL_loadbufferx", (luaV_function) &dll_luaL_loadbufferx},
- {"luaL_argerror", (luaV_function) &dll_luaL_argerror},
-+#endif
-+#if LUA_VERSION_NUM >= 504
-+ {"luaL_typeerror", (luaV_function) &dll_luaL_typeerror},
- #endif
- {"luaL_checkany", (luaV_function) &dll_luaL_checkany},
- {"luaL_checklstring", (luaV_function) &dll_luaL_checklstring},
-@@ -443,7 +452,7 @@ lua_enabled(int verbose)
- }
- #endif
- 
--#if LUA_VERSION_NUM > 501
-+#if LUA_VERSION_NUM > 501 && LUA_VERSION_NUM < 504
- static int
- luaL_typeerror(lua_State *L, int narg, const char *tname)
- {
--- 
-2.23.0
-

_service:tar_scm:backport-8.2.2550-signal-stack-size-is-wrong-with-lates.patch Deleted

@@ -1,132 +0,0 @@
-From 0e62a6742bca186624e97e2121c98ada30e009a0 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 25 Feb 2021 17:17:56 +0100
-Subject: PATCH 4236/5000 patch 8.2.2550: signal stack size is wrong with
- latest glibc 2.34
-
-Problem: Signal stack size is wrong with latest glibc 2.34.
-Solution: Use sysconf(_SC_SIGSTKSZ) if available. (Zdenek Dohnal, closes
- #7895)
----
- src/auto/configure | 24 ++++++++++++++++++++++++
- src/config.h.in | 3 +++
- src/configure.ac | 9 +++++++++
- src/os_unix.c | 14 +++++++++++++-
- 4 files changed, 49 insertions(+), 1 deletion(-)
-
-diff --git a/src/auto/configure b/src/auto/configure
-index 250e5ae..8183499 100755
---- a/src/auto/configure
-+++ b/src/auto/configure
-@@ -13943,6 +13943,30 @@ $as_echo "not usable" >&6; }
- fi
- rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- 
-+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for _SC_SIGSTKSZ via sysconf()" >&5
-+$as_echo_n "checking for _SC_SIGSTKSZ via sysconf()... " >&6; }
-+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-+/* end confdefs.h. */
-+#include <unistd.h>
-+int
-+main ()
-+{
-+	(void)sysconf(_SC_SIGSTKSZ);
-+
-+ ;
-+ return 0;
-+}
-+_ACEOF
-+if ac_fn_c_try_compile "$LINENO"; then :
-+ { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-+$as_echo "yes" >&6; }; $as_echo "#define HAVE_SYSCONF_SIGSTKSZ 1" >>confdefs.h
-+
-+else
-+ { $as_echo "$as_me:${as_lineno-$LINENO}: result: not usable" >&5
-+$as_echo "not usable" >&6; }
-+fi
-+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-+
- # The cast to long int works around a bug in the HP C Compiler
- # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
- # declarations like `int a3(sizeof (unsigned char)) >= 0;'.
-diff --git a/src/config.h.in b/src/config.h.in
-index b114480..5d01e2c 100644
---- a/src/config.h.in
-+++ b/src/config.h.in
-@@ -496,3 +496,6 @@
- 
- /* Define to inline symbol or empty */
- #undef inline
-+
-+/* Define if _SC_SIGSTKSZ is available via sysconf() */
-+#undef HAVE_SYSCONF_SIGSTKSZ
-diff --git a/src/configure.ac b/src/configure.ac
-index 58bfa19..798e9b8 100644
---- a/src/configure.ac
-+++ b/src/configure.ac
-@@ -4105,6 +4105,15 @@ AC_TRY_COMPILE(
- 	AC_MSG_RESULT(yes); AC_DEFINE(HAVE_SYSCONF),
- 	AC_MSG_RESULT(not usable))
- 
-+dnl check if we have _SC_SIGSTKSZ via sysconf()
-+AC_MSG_CHECKING(for _SC_SIGSTKSZ via sysconf())
-+AC_TRY_COMPILE(
-+#include <unistd.h>,
-+	(void)sysconf(_SC_SIGSTKSZ);
-+	,
-+	AC_MSG_RESULT(yes); AC_DEFINE(HAVE_SYSCONF_SIGSTKSZ),
-+	AC_MSG_RESULT(not usable))
-+
- AC_CHECK_SIZEOF(int)
- AC_CHECK_SIZEOF(long)
- AC_CHECK_SIZEOF(time_t)
-diff --git a/src/os_unix.c b/src/os_unix.c
-index 1edc7e6..1c80799 100644
---- a/src/os_unix.c
-+++ b/src/os_unix.c
-@@ -783,7 +783,7 @@ mch_stackcheck(char *p)
- * completely full.
- */
- 
--#ifndef SIGSTKSZ
-+#if !defined SIGSTKSZ && !defined(HAVE_SYSCONF_SIGSTKSZ)
- # define SIGSTKSZ 8000 // just a guess of how much stack is needed...
- #endif
- 
-@@ -806,13 +806,21 @@ init_signal_stack(void)
- # else
- 	sigstk.ss_sp = signal_stack;
- # endif
-+# ifdef HAVE_SYSCONF_SIGSTKSZ
-+	sigstk.ss_size = sysconf(_SC_SIGSTKSZ);
-+# else
- 	sigstk.ss_size = SIGSTKSZ;
-+# endif
- 	sigstk.ss_flags = 0;
- 	(void)sigaltstack(&sigstk, NULL);
- # else
- 	sigstk.ss_sp = signal_stack;
- 	if (stack_grows_downwards)
-+# ifdef HAVE_SYSCONF_SIGSTKSZ
-+	 sigstk.ss_sp += sysconf(_SC_SIGSTKSZ) - 1;
-+# else
- 	 sigstk.ss_sp += SIGSTKSZ - 1;
-+# endif
- 	sigstk.ss_onstack = 0;
- 	(void)sigstack(&sigstk, NULL);
- # endif
-@@ -3261,7 +3269,11 @@ mch_early_init(void)
- * Ignore any errors.
- */
- #if defined(HAVE_SIGALTSTACK) || defined(HAVE_SIGSTACK)
-+# ifdef HAVE_SYSCONF_SIGSTKSZ
-+ signal_stack = alloc(sysconf(_SC_SIGSTKSZ));
-+# else
- signal_stack = alloc(SIGSTKSZ);
-+# endif
- init_signal_stack();
- #endif
- }
--- 
-1.8.3.1
-

_service:tar_scm:backport-9.0.0581-adding-a-character-for-incsearch-fails-at-end-of-line.patch Added

_service:tar_scm:backport-CVE-2021-3770.patch -> _service:tar_scm:backport-CVE-2022-2257.patch Changed

@@ -1,206 +1,53 @@
-From b7081e135a16091c93f6f5f7525a5c58fb7ca9f9 Mon Sep 17 00:00:00 2001
+From 083692d598139228e101b8c521aaef7bcf256e9a Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Sat, 4 Sep 2021 18:47:28 +0200
-Subject: PATCH patch 8.2.3402: invalid memory access when using :retab with
- large value
+Date: Wed, 29 Jun 2022 21:16:58 +0100
+Subject: PATCH patch 9.0.0009: going past the end of a menu item with only
+ modifier
 
-Problem: Invalid memory access when using :retab with large value.
-Solution: Check the number is positive.
+Problem: Going past the end of a menu item with only modifier.
+Solution: Check for NUL.
 ---
- src/indent.c | 34 +++++++++++++++++++++-------------
- src/option.c | 12 ++++++------
- src/optionstr.c | 4 ++--
- src/testdir/test_retab.vim | 3 +++
- src/version.c | 2 ++
- 5 files changed, 34 insertions(+), 21 deletions(-)
+ src/message.c | 4 ++--
+ src/testdir/test_menu.vim | 13 +++++++++++++
+ 2 files changed, 15 insertions(+), 2 deletions(-)
 
-diff --git a/src/indent.c b/src/indent.c
-index 32f1e12..7e196c2 100644
---- a/src/indent.c
-+++ b/src/indent.c
-@@ -18,18 +18,19 @@
- /*
- * Set the integer values corresponding to the string setting of 'vartabstop'.
- * "array" will be set, caller must free it if needed.
-+ * Return FAIL for an error.
- */
- int
- tabstop_set(char_u *var, int **array)
- {
-- int valcount = 1;
-- int t;
-- char_u *cp;
-+ int	 valcount = 1;
-+ int	 t;
-+ char_u *cp;
- 
- if (var0 == NUL || (var0 == '0' && var1 == NUL))
- {
- 	*array = NULL;
--	return TRUE;
-+	return OK;
- }
- 
- for (cp = var; *cp != NUL; ++cp)
-@@ -43,8 +44,8 @@ tabstop_set(char_u *var, int **array)
- 		if (cp != end)
- 		 emsg(_(e_positive));
- 		else
--		 emsg(_(e_invarg));
--		return FALSE;
-+		 semsg(_(e_invarg2), cp);
-+		return FAIL;
- 	 }
- 	}
- 
-@@ -55,26 +56,33 @@ tabstop_set(char_u *var, int **array)
- 	 ++valcount;
- 	 continue;
- 	}
--	emsg(_(e_invarg));
--	return FALSE;
-+	semsg(_(e_invarg2), var);
-+	return FAIL;
- }
- 
- *array = ALLOC_MULT(int, valcount + 1);
- if (*array == NULL)
--	return FALSE;
-+	return FAIL;
- (*array)0 = valcount;
- 
- t = 1;
- for (cp = var; *cp != NUL;)
- {
--	(*array)t++ = atoi((char *)cp);
--	while (*cp != NUL && *cp != ',')
-+	int n = atoi((char *)cp);
-+
-+	if (n < 0 || n > 9999)
-+	{
-+	 semsg(_(e_invarg2), cp);
-+	 return FAIL;
-+	}
-+	(*array)t++ = n;
-+	while (*cp != NUL && *cp != ',')
- 	 ++cp;
- 	if (*cp != NUL)
- 	 ++cp;
+diff --git a/src/message.c b/src/message.c
+index 02380e9..becb280 100644
+--- a/src/message.c
++++ b/src/message.c
+@@ -1820,8 +1820,8 @@ str2special(
+ 	 *sp = str + 1;
 }
- 
-- return TRUE;
-+ return OK;
- }
- 
- /*
-@@ -1556,7 +1564,7 @@ ex_retab(exarg_T *eap)
- 
- #ifdef FEAT_VARTABS
- new_ts_str = eap->arg;
-- if (!tabstop_set(eap->arg, &new_vts_array))
-+ if (tabstop_set(eap->arg, &new_vts_array) == FAIL)
- 	return;
- while (vim_isdigit(*(eap->arg)) || *(eap->arg) == ',')
- 	++(eap->arg);
-diff --git a/src/option.c b/src/option.c
-index 5c99c69..e9598d6 100644
---- a/src/option.c
-+++ b/src/option.c
-@@ -2292,9 +2292,9 @@ didset_options2(void)
- #endif
- #ifdef FEAT_VARTABS
- vim_free(curbuf->b_p_vsts_array);
-- tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
-+ (void)tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
- vim_free(curbuf->b_p_vts_array);
-- tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array);
-+ (void)tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array);
- #endif
- }
- 
-@@ -5756,7 +5756,7 @@ buf_copy_options(buf_T *buf, int flags)
- 	 buf->b_p_vsts = vim_strsave(p_vsts);
- 	 COPY_OPT_SCTX(buf, BV_VSTS);
- 	 if (p_vsts && p_vsts != empty_option)
--		tabstop_set(p_vsts, &buf->b_p_vsts_array);
-+		(void)tabstop_set(p_vsts, &buf->b_p_vsts_array);
- 	 else
- 		buf->b_p_vsts_array = 0;
- 	 buf->b_p_vsts_nopaste = p_vsts_nopaste
-@@ -5914,7 +5914,7 @@ buf_copy_options(buf_T *buf, int flags)
- 		buf->b_p_isk = save_p_isk;
- #ifdef FEAT_VARTABS
- 		if (p_vts && p_vts != empty_option && !buf->b_p_vts_array)
--		 tabstop_set(p_vts, &buf->b_p_vts_array);
-+		 (void)tabstop_set(p_vts, &buf->b_p_vts_array);
- 		else
- 		 buf->b_p_vts_array = NULL;
- #endif
-@@ -5929,7 +5929,7 @@ buf_copy_options(buf_T *buf, int flags)
- 		buf->b_p_vts = vim_strsave(p_vts);
- 		COPY_OPT_SCTX(buf, BV_VTS);
- 		if (p_vts && p_vts != empty_option && !buf->b_p_vts_array)
--		 tabstop_set(p_vts, &buf->b_p_vts_array);
-+		 (void)tabstop_set(p_vts, &buf->b_p_vts_array);
- 		else
- 		 buf->b_p_vts_array = NULL;
- #endif
-@@ -6634,7 +6634,7 @@ paste_option_changed(void)
- 	 if (buf->b_p_vsts_array)
- 		vim_free(buf->b_p_vsts_array);
- 	 if (buf->b_p_vsts && buf->b_p_vsts != empty_option)
--		tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
-+		(void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
- 	 else
- 		buf->b_p_vsts_array = 0;
- #endif
-diff --git a/src/optionstr.c b/src/optionstr.c
-index 98e90a4..383babe 100644
---- a/src/optionstr.c
-+++ b/src/optionstr.c
-@@ -2166,7 +2166,7 @@ did_set_string_option(
- 	 if (errmsg == NULL)
- 	 {
- 		int *oldarray = curbuf->b_p_vsts_array;
--		if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)))
-+		if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)) == OK)
- 		{
- 		 if (oldarray)
- 			vim_free(oldarray);
-@@ -2205,7 +2205,7 @@ did_set_string_option(
- 	 {
- 		int *oldarray = curbuf->b_p_vts_array;
- 
--		if (tabstop_set(*varp, &(curbuf->b_p_vts_array)))
-+		if (tabstop_set(*varp, &(curbuf->b_p_vts_array)) == OK)
- 		{
- 		 vim_free(oldarray);
- #ifdef FEAT_FOLDING
-diff --git a/src/testdir/test_retab.vim b/src/testdir/test_retab.vim
-index f11a32b..e7b8946 100644
---- a/src/testdir/test_retab.vim
-+++ b/src/testdir/test_retab.vim
-@@ -74,4 +74,7 @@ endfunc
- func Test_retab_error()

_service:tar_scm:backport-CVE-2021-3778.patch -> _service:tar_scm:backport-CVE-2022-2264.patch Changed

@@ -1,46 +1,51 @@
-From 65b605665997fad54ef39a93199e305af2fe4d7f Mon Sep 17 00:00:00 2001
+From d25f003342aca9889067f2e839963dfeccf1fe05 Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 7 Sep 2021 19:26:53 +0200
-Subject: PATCH patch 8.2.3409: reading beyond end of line with invalid utf-8
- character
+Date: Thu, 30 Jun 2022 12:30:19 +0100
+Subject: PATCH patch 9.0.0011: reading beyond the end of the line with put
+ command
 
-Problem: Reading beyond end of line with invalid utf-8 character.
-Solution: Check for NUL when advancing.
+Problem: Reading beyond the end of the line with put command.
+Solution: Adjust the end mark position.
 ---
- src/regexp_nfa.c | 3 ++-
- src/testdir/test_regexp_utf8.vim | 8 ++++++++
- 2 files changed, 10 insertions(+), 1 deletion(-)
+ src/register.c | 2 ++
+ src/testdir/test_put.vim | 12 ++++++++++++
+ 2 files changed, 14 insertions(+)
 
-diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c
-index fb512f9..bc4a4b6 100644
---- a/src/regexp_nfa.c
-+++ b/src/regexp_nfa.c
-@@ -5455,7 +5455,8 @@ find_match_text(colnr_T startcol, int regstart, char_u *match_text)
- 		match = FALSE;
- 		break;
+diff --git a/src/register.c b/src/register.c
+index 93860ba..30e2001 100644
+--- a/src/register.c
++++ b/src/register.c
+@@ -1918,6 +1918,8 @@ do_put(
+ 		 vim_memset(ptr, ' ', (size_t)spaces);
+ 		 ptr += spaces;
+ 		}
++		else
++		 totlen -= spaces; // didn't use these spaces
 	 }
--	 len2 += MB_CHAR2LEN(c2);
-+	 len2 += enc_utf8 ? utf_ptr2len(rex.line + col + len2)
-+							 : MB_CHAR2LEN(c2);
- 	}
- 	if (match
- 		// check that no composing char follows
-diff --git a/src/testdir/test_regexp_utf8.vim b/src/testdir/test_regexp_utf8.vim
-index 19ff882..6d0ce59 100644
---- a/src/testdir/test_regexp_utf8.vim
-+++ b/src/testdir/test_regexp_utf8.vim
-@@ -215,3 +215,11 @@ func Test_optmatch_toolong()
- set re=0
+ 
+ 	 // may insert some spaces after the new text
+diff --git a/src/testdir/test_put.vim b/src/testdir/test_put.vim
+index aa5aa2b..66438bd 100644
+--- a/src/testdir/test_put.vim
++++ b/src/testdir/test_put.vim
+@@ -219,5 +219,17 @@ func Test_put_empty_register()
+ bwipe!
 endfunc
 
-+func Test_match_invalid_byte()
-+ call writefile(0z630a.765d30aa0a.2e0a.790a.4030, 'Xinvalid')
-+ new
-+ source Xinvalid
++" this was putting the end mark after the end of the line
++func Test_put_visual_mode()
++ edit! SomeNewBuffer
++ set selection=exclusive
++ exe "norm o\t"
++ m0
++ sil! norm &#x11;
p&#x11;
p
++
 + bwipe!
-+ call delete('Xinvalid')
++ set selection&
 +endfunc
 +
+ 
+ " vim: shiftwidth=2 sts=2 expandtab
 -- 
 1.8.3.1

_service:tar_scm:backport-CVE-2021-3796.patch -> _service:tar_scm:backport-CVE-2022-2284.patch Changed

@@ -1,67 +1,51 @@
-From 35a9a00afcb20897d462a766793ff45534810dc3 Mon Sep 17 00:00:00 2001
+From 3d51ce18ab1be4f9f6061568a4e7fabf00b21794 Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Sat, 11 Sep 2021 21:14:20 +0200
-Subject: PATCH patch 8.2.3428: using freed memory when replacing
+Date: Fri, 1 Jul 2022 15:26:15 +0100
+Subject: PATCH patch 9.0.0017: accessing memory beyond the end of the
+ line
 
-Problem: Using freed memory when replacing. (Dhiraj Mishra)
-Solution: Get the line pointer after calling ins_copychar().
+Problem: Accessing memory beyond the end of the line.
+Solution: Stop Visual mode when closing a window.
 ---
- src/normal.c | 10 +++++++---
- src/testdir/test_edit.vim | 13 +++++++++++++
- 2 files changed, 20 insertions(+), 3 deletions(-)
+ src/testdir/test_visual.vim | 12 ++++++++++++
+ src/window.c | 2 ++
+ 2 files changed, 14 insertions(+)
 
-diff --git a/src/normal.c b/src/normal.c
-index c4963e6..d6333b9 100644
---- a/src/normal.c
-+++ b/src/normal.c
-@@ -5009,19 +5009,23 @@ nv_replace(cmdarg_T *cap)
- 	 {
- 		/*
- 		 * Get ptr again, because u_save and/or showmatch() will have
--		 * released the line. At the same time we let know that the
--		 * line will be changed.
-+		 * released the line. This may also happen in ins_copychar().
-+		 * At the same time we let know that the line will be changed.
- 		 */
--		ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
- 		if (cap->nchar == Ctrl_E || cap->nchar == Ctrl_Y)
- 		{
- 		 int c = ins_copychar(curwin->w_cursor.lnum
- 					 + (cap->nchar == Ctrl_Y ? -1 : 1));
-+
-+		 ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
- 		 if (c != NUL)
- 		 ptrcurwin->w_cursor.col = c;
- 		}
- 		else
-+		{
-+		 ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
- 		 ptrcurwin->w_cursor.col = cap->nchar;
-+		}
- 		if (p_sm && msg_silent == 0)
- 		 showmatch(cap->nchar);
- 		++curwin->w_cursor.col;
-diff --git a/src/testdir/test_edit.vim b/src/testdir/test_edit.vim
-index 4e29e7f..c3b1af5 100644
---- a/src/testdir/test_edit.vim
-+++ b/src/testdir/test_edit.vim
-@@ -1519,3 +1519,16 @@ func Test_edit_noesckeys()
+diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
+index c323062..e965266 100644
+--- a/src/testdir/test_visual.vim
++++ b/src/testdir/test_visual.vim
+@@ -1469,5 +1469,17 @@ func Test_visual_paste_clipboard()
 bwipe!
- set esckeys
 endfunc
-+
-+" Test for getting the character of the line below after "p"
-+func Test_edit_put_CTRL_E()
-+ set encoding=latin1
-+ new
-+ let @" = ''
-+ sil! norm or&#x3;ggRx
-+ sil! norm pr&#x5;
-+ call assert_equal('r', 'r', getline(1, 2))
+ 
++func Test_visual_area_adjusted_when_hiding()
++ " The Visual area ended after the end of the line after :hide
++ call setline(1, 'xxx')
++ vsplit Xfile
++ call setline(1, 'xxxxxxxx')
++ norm! &#x16;$o
++ hid
++ norm! zW
++ bwipe!
 + bwipe!
-+ set encoding=utf-8
 +endfunc
 +
+ 
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/window.c b/src/window.c
+index 992593b..c91ebbc 100644
+--- a/src/window.c
++++ b/src/window.c
+@@ -2594,6 +2594,8 @@ win_close(win_T *win, int free_buf)
+ 	 */
+ 	if (wp->w_buffer != curbuf)
+ 	{
++	 reset_VIsual_and_resel();	// stop Visual mode
++
+ 	 other_buffer = TRUE;
+ 	 win->w_closing = TRUE;
+ 	 apply_autocmds(EVENT_BUFLEAVE, NULL, NULL, FALSE, curbuf);
 -- 
 1.8.3.1

_service:tar_scm:backport-CVE-2021-3872.patch -> _service:tar_scm:backport-CVE-2022-2285.patch Changed

@@ -1,70 +1,46 @@
-From 826bfe4bbd7594188e3d74d2539d9707b1c6a14b Mon Sep 17 00:00:00 2001
+From 27efc62f5d86afcb2ecb7565587fe8dea4b036fe Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Fri, 8 Oct 2021 18:39:28 +0100
-Subject: PATCH patch 8.2.3487: illegal memory access if buffer name is very
- long
+Date: Fri, 1 Jul 2022 16:35:45 +0100
+Subject: PATCH patch 9.0.0018: going over the end of the typahead
 
-Problem: Illegal memory access if buffer name is very long.
-Solution: Make sure not to go over the end of the buffer.
+Problem: Going over the end of the typahead.
+Solution: Put a NUL after the typeahead.
 ---
- src/drawscreen.c | 10 +++++-----
- src/testdir/test_statusline.vim | 10 ++++++++++
- 2 files changed, 15 insertions(+), 5 deletions(-)
+ src/term.c | 1 +
+ src/testdir/test_mapping.vim | 10 ++++++++++
+ 2 files changed, 11 insertions(+)
 
-diff --git a/src/drawscreen.c b/src/drawscreen.c
-index 3a88ee9..9acb705 100644
---- a/src/drawscreen.c
-+++ b/src/drawscreen.c
-@@ -446,13 +446,13 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED)
- 	 *(p + len++) = ' ';
- 	if (bt_help(wp->w_buffer))
- 	{
--	 STRCPY(p + len, _("Help"));
-+	 vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("Help"));
- 	 len += (int)STRLEN(p + len);
- 	}
- #ifdef FEAT_QUICKFIX
- 	if (wp->w_p_pvw)
- 	{
--	 STRCPY(p + len, _("Preview"));
-+	 vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("Preview"));
- 	 len += (int)STRLEN(p + len);
- 	}
- #endif
-@@ -462,12 +462,12 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED)
- #endif
- 		)
- 	{
--	 STRCPY(p + len, "+");
--	 len += 3;
-+	 vim_snprintf((char *)p + len, MAXPATHL - len, "%s", "+");
-+	 len += (int)STRLEN(p + len);
- 	}
- 	if (wp->w_buffer->b_p_ro)
- 	{
--	 STRCPY(p + len, _("RO"));
-+	 vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("RO"));
- 	 len += (int)STRLEN(p + len);
- 	}
+diff --git a/src/term.c b/src/term.c
+index 754ef82..7d7b84b 100644
+--- a/src/term.c
++++ b/src/term.c
+@@ -5393,6 +5393,7 @@ check_termcode(
+ 	if (*tp == ESC && !p_ek && (State & MODE_INSERT))
+ 	 continue;
 
-diff --git a/src/testdir/test_statusline.vim b/src/testdir/test_statusline.vim
-index 1f705b8..febb5d6 100644
---- a/src/testdir/test_statusline.vim
-+++ b/src/testdir/test_statusline.vim
-@@ -393,3 +393,13 @@ func Test_statusline_visual()
- bwipe! x1
- bwipe! x2
++	tplen = NUL;
+ 	key_name0 = NUL;	// no key name found yet
+ 	key_name1 = NUL;	// no key name found yet
+ 	modifiers = 0;		// no modifiers yet
+diff --git a/src/testdir/test_mapping.vim b/src/testdir/test_mapping.vim
+index ace6453..2927ba7 100644
+--- a/src/testdir/test_mapping.vim
++++ b/src/testdir/test_mapping.vim
+@@ -1715,4 +1715,14 @@ func Test_map_after_timed_out_nop()
+ call delete('Xtest_map_after_timed_out_nop')
 endfunc
+ 
++func Test_using_past_typeahead()
++ nnoremap :00 0
++ exe "norm :set \x80\xfb0=0\<CR>"
++ exe "sil norm :0\x0f\<C-U>\<CR>"
 +
-+" Used to write beyond allocated memory. This assumes MAXPATHL is 4096 bytes.
-+func Test_statusline_verylong_filename()
-+ let fname = repeat('x', 4090)
-+ exe "new " .. fname
-+ set buftype=help
-+ set previewwindow
-+ redraw
-+ bwipe!
++ exe "norm :set \x80\xfb0=\<CR>"
++ nunmap :00
 +endfunc
++
++
+ " vim: shiftwidth=2 sts=2 expandtab
 -- 
-2.27.0
+1.8.3.1

_service:tar_scm:backport-CVE-2021-3875.patch -> _service:tar_scm:backport-CVE-2022-2286.patch Changed

@@ -1,54 +1,61 @@
-From 35a319b77f897744eec1155b736e9372c9c5575f Mon Sep 17 00:00:00 2001
+From f12129f1714f7d2301935bb21d896609bdac221c Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Sat, 9 Oct 2021 13:58:55 +0100
-Subject: PATCH patch 8.2.3489: ml_get error after search with range
+Date: Fri, 1 Jul 2022 19:58:30 +0100
+Subject: PATCH patch 9.0.0020: with some completion reading past end of
+ string
 
-Problem: ml_get error after search with range.
-Solution: Limit the line number to the buffer line count.
+Problem: With some completion reading past end of string.
+Solution: Check the length of the string.
 ---
- src/ex_docmd.c | 6 ++++--
- src/testdir/test_search.vim | 14 ++++++++++++++
- 2 files changed, 18 insertions(+), 2 deletions(-)
+ src/insexpand.c | 14 ++++++++++++--
+ src/testdir/test_ins_complete.vim | 8 ++++++++
+ 2 files changed, 20 insertions(+), 2 deletions(-)
 
-diff --git a/src/ex_docmd.c b/src/ex_docmd.c
-index 76daf43..12554fa 100644
---- a/src/ex_docmd.c
-+++ b/src/ex_docmd.c
-@@ -3586,8 +3586,10 @@ get_address(
- 
- 		 // When '/' or '?' follows another address, start from
- 		 // there.
--		 if (lnum != MAXLNUM)
--			curwin->w_cursor.lnum = lnum;
-+		 if (lnum > 0 && lnum != MAXLNUM)
-+			curwin->w_cursor.lnum =
-+				lnum > curbuf->b_ml.ml_line_count
-+					 ? curbuf->b_ml.ml_line_count : lnum;
- 
- 		 // Start a forward search at the end of the line (unless
- 		 // before the first line).
-diff --git a/src/testdir/test_search.vim b/src/testdir/test_search.vim
-index 1876713..ac0881c 100644
---- a/src/testdir/test_search.vim
-+++ b/src/testdir/test_search.vim
-@@ -1366,3 +1366,17 @@ func Test_searchdecl()
+diff --git a/src/insexpand.c b/src/insexpand.c
+index 4a5feac..734550f 100644
+--- a/src/insexpand.c
++++ b/src/insexpand.c
+@@ -2209,11 +2209,21 @@ ins_compl_stop(int c, int prev_mode, int retval)
+ // but only do this, if the Popup is still visible
+ if (c == Ctrl_E)
+ {
++	char_u *p = NULL;
++
+ 	ins_compl_delete();
+ 	if (compl_leader != NULL)
+-	 ins_bytes(compl_leader + get_compl_len());
++	 p = compl_leader;
+ 	else if (compl_first_match != NULL)
+-	 ins_bytes(compl_orig_text + get_compl_len());
++	 p = compl_orig_text;
++	if (p != NULL)
++	{
++	 int	 compl_len = get_compl_len();
++	 int	 len = (int)STRLEN(p);
++
++	 if (len > compl_len)
++		ins_bytes_len(p + compl_len, len - compl_len);
++	}
+ 	retval = TRUE;
+ }
 
- bwipe!
+diff --git a/src/testdir/test_ins_complete.vim b/src/testdir/test_ins_complete.vim
+index 365c646..20c2b4f 100644
+--- a/src/testdir/test_ins_complete.vim
++++ b/src/testdir/test_ins_complete.vim
+@@ -2184,4 +2184,12 @@ func Test_complete_smartindent()
+ delfunction! FooBarComplete
 endfunc
-+
-+func Test_search_with_invalid_range()
+ 
++func Test_complete_overrun()
++ " this was going past the end of the copied text
 + new
-+ let lines =<< trim END
-+ /\%.v
-+ 5/
-+ c
-+ END
-+ call writefile(lines, 'Xrangesearch')
-+ source Xrangesearch
-+
++ sil norm si&#x14;0&#x3;s&#xf;0&#x18;&#xc;&#x5;
 + bwipe!
-+ call delete('Xrangesearch')
 +endfunc
++
++
+ " vim: shiftwidth=2 sts=2 expandtab
 -- 
-2.27.0
+1.8.3.1

_service:tar_scm:backport-CVE-2021-3903.patch -> _service:tar_scm:backport-CVE-2022-2287.patch Changed

@@ -1,78 +1,90 @@
-From 777e7c21b7627be80961848ac560cb0a9978ff43 Mon Sep 17 00:00:00 2001
+From 5e59ea54c0c37c2f84770f068d95280069828774 Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Mon, 25 Oct 2021 17:07:04 +0100
-Subject: PATCH patch 8.2.3564: invalid memory access when scrolling without
- valid screen
+Date: Fri, 1 Jul 2022 22:26:20 +0100
+Subject: PATCH patch 9.0.0021: invalid memory access when adding word to
+ spell word list
 
-Problem: Invalid memory access when scrolling without a valid screen.
-Solution: Do not set VALID_BOTLINE in w_valid.
+Problem: Invalid memory access when adding word with a control character to
+ the internal spell word list.
+Solution: Disallow adding a word with control characters or a trailing
+ slash.
 ---
- src/move.c | 1 -
- src/testdir/test_normal.vim | 22 +++++++++++++++++++---
- 2 files changed, 19 insertions(+), 4 deletions(-)
+ src/spellfile.c | 21 +++++++++++++++++++--
+ src/testdir/test_spell.vim | 15 +++++++++++++++
+ 2 files changed, 34 insertions(+), 2 deletions(-)
 
-diff --git a/src/move.c b/src/move.c
-index 8e53d8b..10165ef 100644
---- a/src/move.c
-+++ b/src/move.c
-@@ -198,7 +198,6 @@ update_topline(void)
- {
- 	curwin->w_topline = curwin->w_cursor.lnum;
- 	curwin->w_botline = curwin->w_topline;
--	curwin->w_valid |= VALID_BOTLINE|VALID_BOTLINE_AP;
- 	curwin->w_scbind_pos = 1;
- 	return;
- }
-diff --git a/src/testdir/test_normal.vim b/src/testdir/test_normal.vim
-index d45cf41..1f0088a 100644
---- a/src/testdir/test_normal.vim
-+++ b/src/testdir/test_normal.vim
-@@ -33,14 +33,14 @@ func CountSpaces(type, ...)
- else
- silent exe "normal! `v`y"
- endif
-- let g:a=strlen(substitute(@@, '^ ', '', 'g'))
-+ let g:a = strlen(substitute(@@, '^ ', '', 'g'))
- let &selection = sel_save
- let @@ = reg_save
- endfunc
+diff --git a/src/spellfile.c b/src/spellfile.c
+index f0d6d96..4a0de52 100644
+--- a/src/spellfile.c
++++ b/src/spellfile.c
+@@ -4367,6 +4367,23 @@ wordtree_alloc(spellinfo_T *spin)
+ }
 
- func OpfuncDummy(type, ...)
- " for testing operatorfunc
-- let g:opt=&linebreak
-+ let g:opt = &linebreak
+ /*
++ * Return TRUE if "word" contains valid word characters.
++ * Control characters and trailing '/' are invalid. Space is OK.
++ */
++ static int
++valid_spell_word(char_u *word)
++{
++ char_u *p;
++
++ if (enc_utf8 && !utf_valid_string(word, NULL))
++	return FALSE;
++ for (p = word; *p != NUL; p += mb_ptr2len(p))
++	if (*p < ' ' || (p0 == '/' && p1 == NUL))
++	 return FALSE;
++ return TRUE;
++}
++
++/*
+ * Store a word in the tree(s).
+ * Always store it in the case-folded tree. For a keep-case word this is
+ * useful when the word can also be used with all caps (no WF_FIXCAP flag) and
+@@ -4391,7 +4408,7 @@ store_word(
+ char_u	*p;
 
- if a:0 " Invoked from Visual mode, use gv command.
- silent exe "normal! gvy"
-@@ -51,7 +51,7 @@ func OpfuncDummy(type, ...)
- endif
- " Create a new dummy window
- new
-- let g:bufnr=bufnr('%')
-+ let g:bufnr = bufnr('%')
- endfunc
+ // Avoid adding illegal bytes to the word tree.
+- if (enc_utf8 && !utf_valid_string(word, NULL))
++ if (!valid_spell_word(word))
+ 	return FAIL;
 
- fun! Test_normal00_optrans()
-@@ -2705,3 +2705,19 @@ func Test_normal_gk()
- bw!
- set cpoptions& number& numberwidth&
+ (void)spell_casefold(curwin, word, len, foldword, MAXWLEN);
+@@ -6194,7 +6211,7 @@ spell_add_word(
+ int		i;
+ char_u	*spf;
+ 
+- if (enc_utf8 && !utf_valid_string(word, NULL))
++ if (!valid_spell_word(word))
+ {
+ 	emsg(_(e_illegal_character_in_word));
+ 	return;
+diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
+index 0fd5ed9..0187a17 100644
+--- a/src/testdir/test_spell.vim
++++ b/src/testdir/test_spell.vim
+@@ -854,6 +854,21 @@ func Test_spellsuggest_too_deep()
+ bwipe!
 endfunc
+ 
++func Test_spell_good_word_invalid()
++ " This was adding a word with a 0x02 byte, which causes havoc.
++ enew
++ norm o0
++ sil! norm rzzWs00&#x2;/
++ 2
++ sil! norm VzGprzzW
++ sil! norm z=
 +
-+func Test_scroll_in_ex_mode()
-+ " This was using invalid memory because w_botline was invalid.
-+ let lines =<< trim END
-+ diffsplit
-+ norm os0&#x3;0(&#x4;
-+ call writefile('done', 'Xdone')
-+ qa!
-+ END
-+ call writefile(lines, 'Xscript')
-+ call assert_equal(1, RunVim(, , '--clean -X -Z -e -s -S Xscript'))
-+ call assert_equal('done', readfile('Xdone'))
-+
-+ call delete('Xscript')
-+ call delete('Xdone')
++ bwipe!
++ " clear the internal word list
++ set enc=latin1
++ set enc=utf-8
 +endfunc
++
+ func LoadAffAndDic(aff_contents, dic_contents)
+ set enc=latin1
+ set spellfile=
 -- 
 1.8.3.1

_service:tar_scm:backport-CVE-2021-3927.patch -> _service:tar_scm:backport-CVE-2022-2288.patch Changed

@@ -1,44 +1,54 @@
-From 0b5b06cb4777d1401fdf83e7d48d287662236e7e Mon Sep 17 00:00:00 2001
+From c6fdb15d423df22e1776844811d082322475e48a Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 4 Nov 2021 15:10:11 +0000
-Subject: PATCH patch 8.2.3581: reading character past end of line
+Date: Sat, 2 Jul 2022 13:43:21 +0100
+Subject: PATCH patch 9.0.0025: accessing beyond allocated memory with the
+ cmdline window
 
-Problem: Reading character past end of line.
-Solution: Correct the cursor column.
+Problem: Accessing beyond allocated memory when using the cmdline window in
+ Ex mode.
+Solution: Use "*" instead of "'<,'>" for Visual mode.
 ---
- src/ex_docmd.c | 1 +
- src/testdir/test_put.vim | 9 +++++++++
- 2 files changed, 10 insertions(+)
+ src/ex_docmd.c | 6 ++++--
+ src/testdir/test_cmdline.vim | 8 ++++++++
+ 2 files changed, 12 insertions(+), 2 deletions(-)
 
 diff --git a/src/ex_docmd.c b/src/ex_docmd.c
-index 12554fa..203174a 100644
+index 271e7e2..697337c 100644
 --- a/src/ex_docmd.c
 +++ b/src/ex_docmd.c
-@@ -6906,6 +6906,7 @@ ex_put(exarg_T *eap)
- 	eap->forceit = TRUE;
- }
- curwin->w_cursor.lnum = eap->line2;
-+ check_cursor_col();
- do_put(eap->regname, eap->forceit ? BACKWARD : FORWARD, 1L,
- 						 PUT_LINE|PUT_CURSLINE);
- }
-diff --git a/src/testdir/test_put.vim b/src/testdir/test_put.vim
-index 225ebd1..f5037dc 100644
---- a/src/testdir/test_put.vim
-+++ b/src/testdir/test_put.vim
-@@ -113,3 +113,12 @@ func Test_put_p_indent_visual()
- call assert_equal('select that text', getline(2))
- bwipe!
+@@ -3118,9 +3118,11 @@ parse_command_modifiers(
+ 		size_t len = STRLEN(cmd_start);
+ 
+ 		// Special case: empty command uses "+":
+-		// "'<,'>mods" -> "mods'<,'>+
++		// "'<,'>mods" -> "mods *+
++		// Use "*" instead of "'<,'>" to avoid the command getting
++		// longer, in case is was allocated.
+ 		mch_memmove(orig_cmd, cmd_start, len);
+-		STRCPY(orig_cmd + len, "'<,'>+");
++		STRCPY(orig_cmd + len, " *+");
+ 	 }
+ 	 else
+ 	 {
+diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
+index 3685336..f0498a1 100644
+--- a/src/testdir/test_cmdline.vim
++++ b/src/testdir/test_cmdline.vim
+@@ -2103,6 +2103,14 @@ func Test_cmdwin_insert_mode_close()
+ call assert_equal(1, winnr('$'))
 endfunc
-+
-+func Test_put_above_first_line()
+ 
++func Test_cmdwin_ex_mode_with_modifier()
++ " this was accessing memory after allocated text in Ex mode
 + new
-+ let @" = 'text'
-+ silent! normal 0o00
-+ 0put
-+ call assert_equal('text', getline(1))
++ call setline(1, 'some', 'text', 'lines')
++ silent! call feedkeys("gQnormal vq:atopleft\<C-V>\<CR>\<CR>", 'xt')
 + bwipe!
 +endfunc
++
+ " test that ";" works to find a match at the start of the first line
+ func Test_zero_line_search()
+ new
 -- 
 1.8.3.1

_service:tar_scm:backport-CVE-2021-3928.patch -> _service:tar_scm:backport-CVE-2022-2289.patch Changed

@@ -1,48 +1,65 @@
-From 15d9890eee53afc61eb0a03b878a19cb5672f732 Mon Sep 17 00:00:00 2001
+From c5274dd12224421f2430b30c53b881b9403d649e Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 4 Nov 2021 15:46:05 +0000
-Subject: PATCH patch 8.2.3582: reading uninitialized memory when giving
- spell suggestions
+Date: Sat, 2 Jul 2022 15:10:00 +0100
+Subject: PATCH patch 9.0.0026: accessing freed memory with diff put
 
-Problem: Reading uninitialized memory when giving spell suggestions.
-Solution: Check that preword is not empty.
+Problem: Accessing freed memory with diff put.
+Solution: Bail out when diff pointer is no longer valid.
 ---
- src/spellsuggest.c | 2 +-
- src/testdir/test_spell.vim | 8 ++++++++
- 2 files changed, 9 insertions(+), 1 deletion(-)
+ src/diff.c | 24 ++++++++++++++++++++++--
+ 1 files changed, 22 insertions(+), 2 deletions(-)
 
-diff --git a/src/spellsuggest.c b/src/spellsuggest.c
-index 9d6df79..8615d52 100644
---- a/src/spellsuggest.c
-+++ b/src/spellsuggest.c
-@@ -1600,7 +1600,7 @@ suggest_trie_walk(
- 		 // char, e.g., "thes," -> "these".
- 		 p = fword + sp->ts_fidx;
- 		 MB_PTR_BACK(fword, p);
--		 if (!spell_iswordp(p, curwin))
-+		 if (!spell_iswordp(p, curwin) && *preword != NUL)
- 		 {
- 			p = preword + STRLEN(preword);
- 			MB_PTR_BACK(preword, p);
-diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
-index 79fb892..e435e91 100644
---- a/src/testdir/test_spell.vim
-+++ b/src/testdir/test_spell.vim
-@@ -498,6 +498,14 @@ func Test_spell_screendump()
- call delete('XtestSpell')
- endfunc
+diff --git a/src/diff.c b/src/diff.c
+index 91e5ae2..e4bafe2 100644
+--- a/src/diff.c
++++ b/src/diff.c
+@@ -2643,6 +2643,20 @@ nv_diffgetput(int put, long count)
+ }
 
-+func Test_spell_single_word()
-+ new
-+ silent! norm 0R00
-+ spell! ßÂ
-+ silent 0norm 0r$ Dvz=
-+ bwipe!
-+endfunc
+ /*
++ * Return TRUE if "diff" appears in the list of diff blocks of the current tab.
++ */
++ static int
++valid_diff(diff_T *diff)
++{
++ diff_T	*dp;
 +
- let g:test_data_aff1 = 
- \"SET ISO8859-1",
- \"TRY esianrtolcdugmphbyfvkwjkqxz-\xEB\xE9\xE8\xEA\xEF\xEE\xE4\xE0\xE2\xF6\xFC\xFB'ESIANRTOLCDUGMPHBYFVKWJKQXZ",
++ for (dp = curtab->tp_first_diff; dp != NULL; dp = dp->df_next)
++	if (dp == diff)
++	 return TRUE;
++ return FALSE;
++}
++
++/*
+ * ":diffget"
+ * ":diffput"
+ */
+@@ -2899,9 +2913,9 @@ ex_diffgetput(exarg_T *eap)
+ 		}
+ 	 }
+ 
+-	 // Adjust marks. This will change the following entries!
+ 	 if (added != 0)
+ 	 {
++		// Adjust marks. This will change the following entries!
+ 		mark_adjust(lnum, lnum + count - 1, (long)MAXLNUM, (long)added);
+ 		if (curwin->w_cursor.lnum >= lnum)
+ 		{
+@@ -2923,7 +2937,13 @@ ex_diffgetput(exarg_T *eap)
+ #endif
+ 		vim_free(dfree);
+ 	 }
+-	 else
++
++	 // mark_adjust() may have made "dp" invalid. We don't know where
++	 // to continue then, bail out.
++	 if (added != 0 && !valid_diff(dp))
++		break;
++
++	 if (dfree == NULL)
+ 		// mark_adjust() may have changed the count in a wrong way
+ 		dp->df_countidx_to = new_count;
+ 
 -- 
 1.8.3.1

_service:tar_scm:backport-CVE-2021-3973.patch -> _service:tar_scm:backport-CVE-2022-2304.patch Changed

@@ -1,79 +1,55 @@
-From 615ddd5342b50a6878a907062aa471740bd9a847 Mon Sep 17 00:00:00 2001
+From 54e5fed6d27b747ff152cdb6edfb72ff60e70939 Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Wed, 17 Nov 2021 18:00:31 +0000
-Subject: PATCH patch 8.2.3611: crash when using CTRL-W f without finding a
- file name
+Date: Mon, 4 Jul 2022 13:37:07 +0100
+Subject: PATCH patch 9.0.0035: spell dump may go beyond end of an array
 
-Problem: Crash when using CTRL-W f without finding a file name.
-Solution: Bail out when the file name length is zero.
-
-Reference:https://github.com/vim/vim/commit/615ddd5342b50a6878a907062aa471740bd9a847
+Problem: Spell dump may go beyond end of an array.
+Solution: Limit the word length.
 ---
- src/findfile.c | 8 ++++++++
- src/normal.c | 6 ++++--
- src/testdir/test_visual.vim | 8 ++++++++
- 3 files changed, 20 insertions(+), 2 deletions(-)
+ src/spell.c | 5 +++--
+ src/testdir/test_spell.vim | 12 ++++++++++++
+ 2 files changed, 15 insertions(+), 2 deletions(-)
 
-diff --git a/src/findfile.c b/src/findfile.c
-index ba996c4..7a4dfe5 100644
---- a/src/findfile.c
-+++ b/src/findfile.c
-@@ -1727,6 +1727,9 @@ find_file_in_path_option(
- proc->pr_WindowPtr = (APTR)-1L;
- # endif
- 
-+ if (len == 0)
-+	return NULL;
-+
- if (first == TRUE)
- {
- 	// copy file name into NameBuff, expanding environment variables
-@@ -2103,7 +2106,12 @@ find_file_name_in_path(
- int		c;
- # if defined(FEAT_FIND_ID) && defined(FEAT_EVAL)
- char_u	*tofree = NULL;
-+# endif
- 
-+ if (len == 0)
-+	return NULL;
-+
-+# if defined(FEAT_FIND_ID) && defined(FEAT_EVAL)
- if ((options & FNAME_INCL) && *curbuf->b_p_inex != NUL)
- {
- 	tofree = eval_includeexpr(ptr, len);
-diff --git a/src/normal.c b/src/normal.c
-index d6333b9..e9e587d 100644
---- a/src/normal.c
-+++ b/src/normal.c
-@@ -3778,8 +3778,10 @@ get_visual_text(
- 	 *pp = ml_get_pos(&VIsual);
- 	 *lenp = curwin->w_cursor.col - VIsual.col + 1;
- 	}
--	if (has_mbyte)
--	 // Correct the length to include the whole last character.
-+	if (**pp == NUL)
-+	 *lenp = 0;
-+	if (has_mbyte && *lenp > 0)
-+	 // Correct the length to include all bytes of the last character.
- 	 *lenp += (*mb_ptr2len)(*pp + (*lenp - 1)) - 1;
- }
- reset_VIsual_and_resel();
-diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
-index ae28123..0705fdb 100644
---- a/src/testdir/test_visual.vim
-+++ b/src/testdir/test_visual.vim
-@@ -894,4 +894,12 @@ func Test_block_insert_replace_tabs()
+diff --git a/src/spell.c b/src/spell.c
+index d866a2d..24abce4 100644
+--- a/src/spell.c
++++ b/src/spell.c
+@@ -3996,9 +3996,10 @@ spell_dump_compl(
+ 		 n = arridxdepth + curidepth;
+ 		 ++curidepth;
+ 		 c = bytsn;
+-		 if (c == 0)
++		 if (c == 0 || depth >= MAXWLEN - 1)
+ 		 {
+-			// End of word, deal with the word.
++			// End of word or reached maximum length, deal with the
++			// word.
+ 			// Don't use keep-case words in the fold-case tree,
+ 			// they will appear in the keep-case tree.
+ 			// Only use the word when the region matches.
+diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
+index d3f56d8..a291eb5 100644
+--- a/src/testdir/test_spell.vim
++++ b/src/testdir/test_spell.vim
+@@ -285,6 +285,18 @@ func Test_spellreall()
 bwipe!
 endfunc
 
-+func Test_visual_block_ctrl_w_f()
-+ " Emtpy block selected in new buffer should not result in an error.
-+ au! BufNew foo sil norm &#x16;&#x17;f
-+ edit foo
++func Test_spell_dump_word_length()
++ " this was running over MAXWLEN
++ new
++ noremap 0 0a0zW0000000
++ sil! norm &#x16;0z=0&#x18;&#xb;
++ sil norm 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
++ sil! norm &#x16;0z=0&#x18;&#xb;
 +
-+ au! BufNew
++ bwipe!
++ nunmap 0
 +endfunc
 +
- " vim: shiftwidth=2 sts=2 expandtab
+ " Test spellsuggest({word} , {max} , {capital})
+ func Test_spellsuggest()
+ " Verify suggestions are given even when spell checking is not enabled.
 -- 
-2.23.0
\ No newline at end of file
+1.8.3.1
+

_service:tar_scm:backport-CVE-2021-3974.patch -> _service:tar_scm:backport-CVE-2022-2343.patch Changed

@@ -1,67 +1,235 @@
-From 64066b9acd9f8cffdf4840f797748f938a13f2d6 Mon Sep 17 00:00:00 2001
+FROM CAEA66442D86E7BBBA3BF3DC202C3C0D549B9853 MON SEP 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Wed, 17 Nov 2021 18:22:56 +0000
-Subject: PATCH patch 8.2.3612: using freed memory with regexp using a mark
+Date: Thu, 7 Jul 2022 19:42:04 +0100
+Subject: PATCH patch 9.0.0045: reading past end of completion with a
+ long line
 
-Problem: Using freed memory with regexp using a mark.
-Solution: Get the line again after getting the mark position.
-
-Reference:https://github.com/vim/vim/commit/64066b9acd9f8cffdf4840f797748f938a13f2d6
+Problem: Reading past end of completion with a long line and 'infercase'
+set.
+Solution: Allocate the string if needed.
 ---
- src/regexp.c | 2 +-
- src/regexp_nfa.c | 8 ++++++++
- src/testdir/test_regexp_latin.vim | 8 ++++++++
- 3 files changed, 17 insertions(+), 1 deletion(-)
+ src/insexpand.c | 94 ++++++++++++++++++++++---------
+ src/testdir/test_ins_complete.vim | 16 ++++++
+ 2 files changed, 82 insertions(+), 28 deletions(-)
 
-diff --git a/src/regexp.c b/src/regexp.c
-index 112f753..2e94e5a 100644
---- a/src/regexp.c
-+++ b/src/regexp.c
-@@ -1092,7 +1092,7 @@ typedef struct {
- // The current match-position is stord in these variables:
- linenr_T	lnum;		// line number, relative to first line
- char_u	*line;		// start of current line
-- char_u	*input;		// current input, points into "regline"
-+ char_u	*input;		// current input, points into "line"
+diff --git a/src/insexpand.c b/src/insexpand.c
+index 734550f..0ecb656 100644
+--- a/src/insexpand.c
++++ b/src/insexpand.c
+@@ -524,29 +524,32 @@ ins_compl_accept_char(int c)
+ 
+ /*
+ * Get the completed text by inferring the case of the originally typed text.
++ * If the result is in allocated memory "tofree" is set to it.
+ */
+ static char_u *
+ ins_compl_infercase_gettext(
+ 	char_u	*str,
+-	int	actual_len,
+-	int	actual_compl_length,
+-	int	min_len)
++	int	char_len,
++	int	compl_char_len,
++	int	min_len,
++	char_u **tofree)
+ {
+ int		*wca;			// Wide character array.
+ char_u	*p;
+ int		i, c;
+ int		has_lower = FALSE;
+ int		was_letter = FALSE;
++ garray_T	gap;
+ 
+ IObuff0 = NUL;
+ 
+ // Allocate wide character array for the completion and fill it.
+- wca = ALLOC_MULT(int, actual_len);
++ wca = ALLOC_MULT(int, char_len);
+ if (wca == NULL)
+ 	return IObuff;
+ 
+ p = str;
+- for (i = 0; i < actual_len; ++i)
++ for (i = 0; i < char_len; ++i)
+ 	if (has_mbyte)
+ 	 wcai = mb_ptr2char_adv(&p);
+ 	else
+@@ -566,7 +569,7 @@ ins_compl_infercase_gettext(
+ 	 if (MB_ISUPPER(wcai))
+ 	 {
+ 		// Rule 1 is satisfied.
+-		for (i = actual_compl_length; i < actual_len; ++i)
++		for (i = compl_char_len; i < char_len; ++i)
+ 		 wcai = MB_TOLOWER(wcai);
+ 		break;
+ 	 }
+@@ -587,7 +590,7 @@ ins_compl_infercase_gettext(
+ 	 if (was_letter && MB_ISUPPER(c) && MB_ISLOWER(wcai))
+ 	 {
+ 		// Rule 2 is satisfied.
+-		for (i = actual_compl_length; i < actual_len; ++i)
++		for (i = compl_char_len; i < char_len; ++i)
+ 		 wcai = MB_TOUPPER(wcai);
+ 		break;
+ 	 }
+@@ -610,20 +613,52 @@ ins_compl_infercase_gettext(
+ }
 
- int	need_clear_subexpr;	// subexpressions still need to be cleared
- #ifdef FEAT_SYN_HL
-diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c
-index bc4a4b6..433523e 100644
---- a/src/regexp_nfa.c
-+++ b/src/regexp_nfa.c
-@@ -6623,8 +6623,16 @@ nfa_regmatch(
- 	 case NFA_MARK_GT:
- 	 case NFA_MARK_LT:
- 	 {
-+ size_t	col = rex.input - rex.line;
- 		pos_T	*pos = getmark_buf(rex.reg_buf, t->state->val, FALSE);
+ // Generate encoding specific output from wide character array.
+- // Multi-byte characters can occupy up to five bytes more than
+- // ASCII characters, and we also need one byte for NUL, so stay
+- // six bytes away from the edge of IObuff.
+ p = IObuff;
+ i = 0;
+- while (i < actual_len && (p - IObuff + 6) < IOSIZE)
+-	if (has_mbyte)
++ ga_init2(&gap, 1, 500);
++ while (i < char_len)
++ {
++	if (gap.ga_data != NULL)
++	{
++	 if (ga_grow(&gap, 10) == FAIL)
++	 {
++		ga_clear(&gap);
++		return (char_u *)"failed";
++	 }
++	 p = (char_u *)gap.ga_data + gap.ga_len;
++	 if (has_mbyte)
++		gap.ga_len += (*mb_char2bytes)(wcai++, p);
++	 else
++	 {
++		*p = wcai++;
++		++gap.ga_len;
++	 }
++	}
++	else if ((p - IObuff) + 6 >= IOSIZE)
++	{
++	 // Multi-byte characters can occupy up to five bytes more than
++	 // ASCII characters, and we also need one byte for NUL, so when
++	 // getting to six bytes from the edge of IObuff switch to using a
++	 // growarray. Add the character in the next round.
++	 if (ga_grow(&gap, IOSIZE) == FAIL)
++		return (char_u *)"failed";
++	 STRCPY(gap.ga_data, IObuff);
++	 gap.ga_len = STRLEN(IObuff);
++	}
++	else if (has_mbyte)
+ 	 p += (*mb_char2bytes)(wcai++, p);
+ 	else
+ 	 *(p++) = wcai++;
+- *p = NUL;
+-
++ }
+ vim_free(wca);
 
-+		// Line may have been freed, get it again.
-+		if (REG_MULTI)
-+		{
-+		 rex.line = reg_getline(rex.lnum);
-+		 rex.input = rex.line + col;
-+		}
++ if (gap.ga_data != NULL)
++ {
++	*tofree = gap.ga_data;
++	return gap.ga_data;
++ }
 +
- 		// Compare the mark position to the match position.
- 		result = (pos != NULL		 // mark doesn't exist
- 			&& pos->lnum > 0 // mark isn't set in reg_buf
-diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim
-index 7a4d98f..3168edc 100644
---- a/src/testdir/test_regexp_latin.vim
-+++ b/src/testdir/test_regexp_latin.vim
-@@ -141,3 +141,11 @@ func Test_pattern_compile_speed()
- call assert_inrange(0.01, 10.0, reltimefloat(reltime(start)))
- set spc=
++ *p = NUL;
+ return IObuff;
+ }
+ 
+@@ -644,10 +679,12 @@ ins_compl_add_infercase(
+ {
+ char_u	*str = str_arg;
+ char_u	*p;
+- int		actual_len;		// Take multi-byte characters
+- int		actual_compl_length;	// into account.
++ int		char_len;		// count multi-byte characters
++ int		compl_char_len;
+ int		min_len;
+ int		flags = 0;
++ int		res;
++ char_u	*tofree = NULL;
+ 
+ if (p_ic && curbuf->b_p_inf && len > 0)
+ {
+@@ -657,44 +694,45 @@ ins_compl_add_infercase(

_service:tar_scm:backport-CVE-2021-3984.patch -> _service:tar_scm:backport-CVE-2022-2344.patch Changed

@@ -1,63 +1,49 @@
-From 2de9b7c7c8791da8853a9a7ca9c467867465b655 Mon Sep 17 00:00:00 2001
+From baefde14550231f6468ac2ed2ed495bc381c0c92 Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Fri, 19 Nov 2021 19:41:13 +0000
-Subject: PATCH patch 8.2.3625: illegal memory access when C-indenting
+Date: Thu, 7 Jul 2022 19:59:49 +0100
+Subject: PATCH patch 9.0.0046: reading past end of completion with
+ duplicate match
 
-Problem: Illegal memory access when C-indenting.
-Solution: Also set the cursor column.
+Problem: Reading past end of completion with duplicate match.
+Solution: Check string length
 ---
- src/cindent.c | 10 +++++-----
- src/testdir/test_cindent.vim | 12 ++++++++++++
- 2 files changed, 17 insertions(+), 5 deletions(-)
+ src/insexpand.c | 3 ++-
+ src/testdir/test_ins_complete.vim | 10 ++++++++++
+ 2 files changed, 12 insertions(+), 1 deletion(-)
 
-diff --git a/src/cindent.c b/src/cindent.c
-index c7caed6..28d1558 100644
---- a/src/cindent.c
-+++ b/src/cindent.c
-@@ -1635,10 +1635,10 @@ get_baseclass_amount(int col)
- static pos_T *
- find_start_brace(void)	 // XXX
- {
-- pos_T	cursor_save;
-- pos_T	*trypos;
-- pos_T	*pos;
-- static pos_T	pos_copy;
-+ pos_T	 cursor_save;
-+ pos_T	 *trypos;
-+ pos_T	 *pos;
-+ static pos_T pos_copy;
- 
- cursor_save = curwin->w_cursor;
- while ((trypos = findmatchlimit(NULL, '{', FM_BLOCKSTOP, 0)) != NULL)
-@@ -1652,7 +1652,7 @@ find_start_brace(void)	 // XXX
- 		 && (pos = ind_find_start_CORS(NULL)) == NULL) // XXX
- 	 break;
- 	if (pos != NULL)
--	 curwin->w_cursor.lnum = pos->lnum;
-+	 curwin->w_cursor = *pos;
- }
- curwin->w_cursor = cursor_save;
- return trypos;
-diff --git a/src/testdir/test_cindent.vim b/src/testdir/test_cindent.vim
-index 2cb3f24..2a87460 100644
---- a/src/testdir/test_cindent.vim
-+++ b/src/testdir/test_cindent.vim
-@@ -5251,4 +5251,16 @@ func Test_cindent_56()
- enew! | close
+diff --git a/src/insexpand.c b/src/insexpand.c
+index 0ecb656..9c598a8 100644
+--- a/src/insexpand.c
++++ b/src/insexpand.c
+@@ -786,7 +786,8 @@ ins_compl_add(
+ 	{
+ 	 if (!match_at_original_text(match)
+ 		 && STRNCMP(match->cp_str, str, len) == 0
+-		 && match->cp_strlen == NUL)
++		 && ((int)STRLEN(match->cp_str) <= len
++						 || match->cp_strlen == NUL))
+ 		return NOTDONE;
+ 	 match = match->cp_next;
+ 	} while (match != NULL && !is_first_match(match));
+diff --git a/src/testdir/test_ins_complete.vim b/src/testdir/test_ins_complete.vim
+index 5e5b1bb..2be6d06 100644
+--- a/src/testdir/test_ins_complete.vim
++++ b/src/testdir/test_ins_complete.vim
+@@ -2112,5 +2112,15 @@ func Test_infercase_very_long_line()
+ set noic noinfercase
 endfunc
 
-+func Test_find_brace_backwards()
-+ " this was looking beyond the end of the line
++func Test_ins_complete_add()
++ " this was reading past the end of allocated memory
 + new
-+ norm R/*
-+ norm o0{
-+ norm o//
-+ norm V{=
-+ call assert_equal('/*', ' 0{', '//', getline(1, 3))
++ norm o&#x7f;
++ norm 7o
++ sil! norm o&#x10;&#x18;&#x10;&#x18;&#x10;
++
 + bwipe!
 +endfunc
 +
-+
+ 
 " vim: shiftwidth=2 sts=2 expandtab
 -- 
 1.8.3.1

_service:tar_scm:backport-CVE-2021-4019.patch -> _service:tar_scm:backport-CVE-2022-2345.patch Changed

@@ -1,45 +1,79 @@
-From bd228fd097b41a798f90944b5d1245eddd484142 Mon Sep 17 00:00:00 2001
+From 32acf1f1a72ebb9d8942b9c9d80023bf1bb668ea Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 25 Nov 2021 10:50:12 +0000
-Subject: PATCH patch 8.2.3669: buffer overflow with long help argument
+Date: Thu, 7 Jul 2022 22:20:31 +0100
+Subject: PATCH patch 9.0.0047: using freed memory with recursive
+ substitute
 
-Problem: Buffer overflow with long help argument.
-Solution: Use snprintf().
+Problem: Using freed memory with recursive substitute.
+Solution: Always make a copy for reg_prev_sub.
 ---
- src/ex_cmds.c | 3 +--
- src/testdir/test_help.vim | 8 ++++++++
- 2 files changed, 9 insertions(+), 2 deletions(-)
+ src/ex_cmds.c | 11 ++++++++++-
+ src/regexp.c | 8 ++++----
+ src/testdir/test_regexp_latin.vim | 11 +++++++++++
+ 3 files changed, 25 insertions(+), 5 deletions(-)
 
 diff --git a/src/ex_cmds.c b/src/ex_cmds.c
-index 45c733b..8f6444f 100644
+index eb3016f..5253863 100644
 --- a/src/ex_cmds.c
 +++ b/src/ex_cmds.c
-@@ -5436,8 +5436,7 @@ find_help_tags(
- 		 || (vim_strchr((char_u *)"%_z@", arg1) != NULL
- 							 && arg2 != NUL)))
- 	{
--	 STRCPY(d, "/\\\\");
--	 STRCPY(d + 3, arg + 1);
-+ vim_snprintf((char *)d, IOSIZE, "/\\\\%s", arg + 1);
- 	 // Check for "/\\_$", should be "/\\_\$"
- 	 if (d3 == '_' && d4 == '$')
- 		STRCPY(d + 4, "\\$");
-diff --git a/src/testdir/test_help.vim b/src/testdir/test_help.vim
-index 5dd937a..c2aeb1f 100644
---- a/src/testdir/test_help.vim
-+++ b/src/testdir/test_help.vim
-@@ -55,3 +55,11 @@ func Test_help_local_additions()
- call delete('Xruntime', 'rf')
- let &rtp = rtp_save
+@@ -3994,7 +3994,16 @@ ex_substitute(exarg_T *eap)
+ 	sub_copy = sub;
+ }
+ else
+-	sub = regtilde(sub, magic_isset());
++ {
++	char_u *newsub = regtilde(sub, magic_isset());
++
++	if (newsub != sub)
++	{
++	 // newsub was allocated, free it later.
++	 sub_copy = newsub;
++	 sub = newsub;
++	}
++ }
+ 
+ /*
+ * Check for a match on each line.
+diff --git a/src/regexp.c b/src/regexp.c
+index 2cbe64e..f35a5e8 100644
+--- a/src/regexp.c
++++ b/src/regexp.c
+@@ -1766,11 +1766,11 @@ regtilde(char_u *source, int magic)
+ 	}
+ }
+ 
++ // Store a copy of newsub in reg_prev_sub. It is always allocated,
++ // because recursive calls may make the returned string invalid.
+ vim_free(reg_prev_sub);
+- if (newsub != source)	// newsub was allocated, just keep it
+-	reg_prev_sub = newsub;
+- else			// no ~ found, need to save newsub
+-	reg_prev_sub = vim_strsave(newsub);
++ reg_prev_sub = vim_strsave(newsub);
++
+ return newsub;
+ }
+ 
+diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim
+index 1fe4699..dce6709 100644
+--- a/src/testdir/test_regexp_latin.vim
++++ b/src/testdir/test_regexp_latin.vim
+@@ -1114,4 +1114,15 @@ func Test_using_two_engines_pattern()
+ bwipe!
 endfunc
+ 
++func Test_recursive_substitute_expr()
++ new
++ func Repl()
++ s
++ endfunc
++ silent! s/\%')/~\=Repl()
 +
-+func Test_help_long_argument()
-+ try
-+ exe 'help \%' .. repeat('0', 1021)
-+ catch
-+ call assert_match("E149:", v:exception)
-+ endtry
++ bwipe!
++ delfunc Repl
 +endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
 -- 
 1.8.3.1

_service:tar_scm:backport-CVE-2021-4069.patch -> _service:tar_scm:backport-CVE-2022-2522.patch Changed

@@ -1,56 +1,46 @@
-From e031fe90cf2e375ce861ff5e5e281e4ad229ebb9 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sun, 5 Dec 2021 12:06:24 +0000
-Subject: PATCH patch 8.2.3741: using freed memory in open command
-
-Problem: Using freed memory in open command.
-Solution: Make a copy of the current line.
-
-Reference:https://github.com/vim/vim/commit/e031fe90cf2e375ce861ff5e5e281e4ad229ebb9
-Conflict:src/testdir/test_ex_mode.vim, The current version does not exist and therefore does not fit into this test case
----
- src/ex_docmd.c | 10 +++++++---
- src/version.c | 2 ++
- 2 files changed, 9 insertions(+), 3 deletions(-)
-
-diff --git a/src/ex_docmd.c b/src/ex_docmd.c
-index 203174a..cb6b64a 100644
---- a/src/ex_docmd.c
-+++ b/src/ex_docmd.c
-@@ -6030,13 +6030,17 @@ ex_open(exarg_T *eap)
- 	regmatch.regprog = vim_regcomp(eap->arg, p_magic ? RE_MAGIC : 0);
- 	if (regmatch.regprog != NULL)
- 	{
-+	 // make a copy of the line, when searching for a mark it might be
-+	 // flushed
-+	 char_u *line = vim_strsave(ml_get_curline());
-+
- 	 regmatch.rm_ic = p_ic;
--	 p = ml_get_curline();
--	 if (vim_regexec(&regmatch, p, (colnr_T)0))
--		curwin->w_cursor.col = (colnr_T)(regmatch.startp0 - p);
-+	 if (vim_regexec(&regmatch, line, (colnr_T)0))
-+		curwin->w_cursor.col = (colnr_T)(regmatch.startp0 - line);
- 	 else
- 		emsg(_(e_nomatch));
- 	 vim_regfree(regmatch.regprog);
-+	 vim_free(line);
- 	}
- 	// Move to the NUL, ignore any other arguments.
- 	eap->arg += STRLEN(eap->arg);
-diff --git a/src/version.c b/src/version.c
-index 035c46f..bd45631 100644
---- a/src/version.c
-+++ b/src/version.c
-@@ -742,6 +742,8 @@ static char *(features) =
- 
- static int included_patches =
- { /* Add new patch number below this line */
-+/**/
-+ 3741,
- /**/
- 3403,
- /**/
--- 
-2.27.0
-
+From b9e717367c395490149495cf375911b5d9de889e Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Sat, 23 Jul 2022 06:53:08 +0100
+Subject: PATCH patch 9.0.0060: accessing uninitialized memory when
+ completing long line
+
+Problem: Accessing uninitialized memory when completing long line.
+Solution: Terminate string with NUL.
+---
+ src/insexpand.c | 1 +
+ src/testdir/test_ins_complete.vim | 7 +++++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/src/insexpand.c b/src/insexpand.c
+index b49a631..c505158 100644
+--- a/src/insexpand.c
++++ b/src/insexpand.c
+@@ -642,6 +642,7 @@ ins_compl_infercase_gettext(
+ 	 // growarray. Add the character in the next round.
+ 	 if (ga_grow(&gap, IOSIZE) == FAIL)
+ 		return (char_u *)"failed";
++	 *p = NUL;
+ 	 STRCPY(gap.ga_data, IObuff);
+ 	 gap.ga_len = (int)STRLEN(IObuff);
+ 	}
+diff --git a/src/testdir/test_ins_complete.vim b/src/testdir/test_ins_complete.vim
+index 2be6d06..7bebc5d 100644
+--- a/src/testdir/test_ins_complete.vim
++++ b/src/testdir/test_ins_complete.vim
+@@ -2108,6 +2108,13 @@ func Test_infercase_very_long_line()
+ exe "normal 2Go\<C-X>\<C-L>\<Esc>"
+ call assert_equal(longLine, getline(3))
+ 
++ " check that the too long text is NUL terminated
++ %del
++ norm o
++ norm 1987ax
++ exec "norm ox\<C-X>\<C-L>"
++ call assert_equal(repeat('x', 1987), getline(3))
++
+ bwipe!
+ set noic noinfercase
+ endfunc
+-- 
+1.8.3.1
+

_service:tar_scm:backport-CVE-2021-4166.patch -> _service:tar_scm:backport-CVE-2022-2571.patch Changed

@@ -1,61 +1,47 @@
-From 6f98371532fcff911b462d51bc64f2ce8a6ae682 Mon Sep 17 00:00:00 2001
+From a6f9e300161f4cb54713da22f65b261595e8e614 Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Fri, 24 Dec 2021 18:11:27 +0000
-Subject: PATCH patch 8.2.3884: crash when clearing the argument list while
- using it
-Conflict:NA
-Reference:https://github.com/vim/vim/commit/6f98371532fcff911b462d51bc64f2ce8a6ae682
+Date: Thu, 28 Jul 2022 21:51:37 +0100
+Subject: PATCH patch 9.0.0102: reading past end of line with insert mode
+ completion
 
-Problem: Crash when clearing the argument list while using it.
-Solution: Lock the argument list for ":all".
+Problem: Reading past end of line with insert mode completion.
+Solution: Check text length.
 ---
- src/arglist.c | 3 +++
- src/testdir/test_arglist.vim | 7 +++++++
- 2 files changed, 10 insertions(+)
+ src/insexpand.c | 2 +-
+ src/testdir/test_ins_complete.vim | 8 ++++++++
+ 2 files changed, 9 insertions(+), 1 deletion(-)
 
-diff --git a/src/arglist.c b/src/arglist.c
-index 21c38c1..cdd70ca 100644
---- a/src/arglist.c
-+++ b/src/arglist.c
-@@ -902,6 +902,7 @@ do_arg_all(
- tabpage_T	*old_curtab, *last_curtab;
- win_T	*new_curwin = NULL;
- tabpage_T	*new_curtab = NULL;
-+ int		prev_arglist_locked = arglist_locked;
- 
- if (ARGCOUNT <= 0)
+diff --git a/src/insexpand.c b/src/insexpand.c
+index 7339ce9..fc3eff0 100644
+--- a/src/insexpand.c
++++ b/src/insexpand.c
+@@ -3501,7 +3501,7 @@ ins_comp_get_next_word_or_line(
 {
-@@ -921,6 +922,7 @@ do_arg_all(
- // watch out for its size to be changed.
- alist = curwin->w_alist;
- ++alist->al_refcount;
-+ arglist_locked = TRUE;
- 
- old_curwin = curwin;
- old_curtab = curtab;
-@@ -1132,6 +1134,7 @@ do_arg_all(
- 
- // Remove the "lock" on the argument list.
- alist_unlink(alist);
-+ arglist_locked = prev_arglist_locked;
+ 	char_u	*tmp_ptr = ptr;
 
- --autocmd_no_enter;
- 
-diff --git a/src/testdir/test_arglist.vim b/src/testdir/test_arglist.vim
-index c486b18..1c94fe9 100644
---- a/src/testdir/test_arglist.vim
-+++ b/src/testdir/test_arglist.vim
-@@ -505,3 +505,10 @@ func Test_argdo()
- call assert_equal('Xa.c', 'Xb.c', 'Xc.c', l)
- bwipe Xa.c Xb.c Xc.c
+-	if (compl_status_adding())
++	if (compl_status_adding() && compl_length <= (int)STRLEN(tmp_ptr))
+ 	{
+ 	 tmp_ptr += compl_length;
+ 	 // Skip if already inside a word.
+diff --git a/src/testdir/test_ins_complete.vim b/src/testdir/test_ins_complete.vim
+index 35c5785..2b0a294 100644
+--- a/src/testdir/test_ins_complete.vim
++++ b/src/testdir/test_ins_complete.vim
+@@ -2142,5 +2142,13 @@ func Test_ins_complete_add()
+ bwipe!
 endfunc
+ 
++func Test_ins_complete_end_of_line()
++ " this was reading past the end of the line
++ new 
++ norm 8oý 
++ sil! norm o&#x10;&#x18;&#x10;&#x18;&#x10;
 +
-+func Test_clear_arglist_in_all()
-+ n 0 00 000 0000 00000 000000
-+ au! * 0 n 0
-+ all
-+ au! *
++ bwipe!
 +endfunc
+ 
+ " vim: shiftwidth=2 sts=2 expandtab
 -- 
-2.27.0
+1.8.3.1

_service:tar_scm:backport-CVE-2021-4192.patch -> _service:tar_scm:backport-CVE-2022-2580.patch Changed

_service:tar_scm:backport-CVE-2021-4193.patch -> _service:tar_scm:backport-CVE-2022-2581.patch Changed

@@ -1,58 +1,65 @@
-From 94f3192b03ed27474db80b4d3a409e107140738b Mon Sep 17 00:00:00 2001
+From f50940531dd57135fe60aa393ac9d3281f352d88 Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 30 Dec 2021 15:29:18 +0000
-Subject: PATCH patch 8.2.3950: going beyond the end of the line with /\%V
-Conflict:NA
-Reference:https://github.com/vim/vim/commit/94f3192b03ed27474db80b4d3a409e107140738b
-
-Problem: Going beyond the end of the line with /\%V.
-Solution: Check for valid column in getvcol().
+Date: Fri, 29 Jul 2022 16:22:25 +0100
+Subject: PATCH 002/123 patch 9.0.0105: illegal memory access when pattern
+ starts with illegal byte
 
+Problem: Illegal memory access when pattern starts with illegal byte.
+Solution: Do not match a character with an illegal byte.
 ---
- src/charset.c | 13 +++++++++----
- src/testdir/test_regexp_latin.vim | 8 ++++++++
- 2 files changed, 17 insertions(+), 4 deletions(-)
+ src/regexp.c | 6 +++++-
+ src/testdir/test_regexp_utf8.vim | 15 +++++++++++++++
+ 2 files changed, 20 insertions(+), 1 deletion(-)
 
-diff --git a/src/charset.c b/src/charset.c
-index 7505fea..a768c17 100644
---- a/src/charset.c
-+++ b/src/charset.c
-@@ -1226,10 +1226,15 @@ getvcol(
- 	posptr = NULL; // continue until the NUL
- else
- {
--	// Special check for an empty line, which can happen on exit, when
--	// ml_get_buf() always returns an empty string.
--	if (*ptr == NUL)
--	 pos->col = 0;
-+	colnr_T i;
+diff --git a/src/regexp.c b/src/regexp.c
+index 1a5cfd0..bec0464 100644
+--- a/src/regexp.c
++++ b/src/regexp.c
+@@ -1641,7 +1641,11 @@ cstrchr(char_u *s, int c)
+ 	{
+ 	 if (enc_utf8 && c > 0x80)
+ 	 {
+-		if (utf_fold(utf_ptr2char(p)) == cc)
++		int uc = utf_ptr2char(p);
++
++		// Do not match an illegal byte. E.g. 0xff matches 0xc3 0xbf,
++		// not 0xff.
++		if ((uc < 0x80 || uc != *p) && utf_fold(uc) == cc)
+ 		 return p;
+ 	 }
+ 	 else if (*p == c || *p == cc)
+diff --git a/src/testdir/test_regexp_utf8.vim b/src/testdir/test_regexp_utf8.vim
+index d88e263..e7672dd 100644
+--- a/src/testdir/test_regexp_utf8.vim
++++ b/src/testdir/test_regexp_utf8.vim
+@@ -1,5 +1,7 @@
+ " Tests for regexp in utf8 encoding
+ 
++source shared.vim
 +
-+	// In a few cases the position can be beyond the end of the line.
-+	for (i = 0; i < pos->col; ++i)
-+	 if (ptri == NUL)
-+	 {
-+		pos->col = i;
-+		break;
-+	 }
- 	posptr = ptr + pos->col;
- 	if (has_mbyte)
- 	 // always start on the first byte
-diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim
-index 3168edc..4f52bac 100644
---- a/src/testdir/test_regexp_latin.vim
-+++ b/src/testdir/test_regexp_latin.vim
-@@ -149,3 +149,11 @@ func Test_using_mark_position()
- call assert_fails("s/\\%')", 'E486:')
- bwipe!
+ func s:equivalence_test()
+ let str = "AÀÁÂÃÄÅĀĂĄǍǞǠǺȂȦȺḀẠẢẤẦẨẪẬẮẰẲẴẶ BƁɃḂḄḆ CÇĆĈĊČƇȻḈꞒ DĎĐƊḊḌḎḐḒ EÈÉÊËĒĔĖĘĚȄȆȨɆḔḖḘḚḜẸẺẼẾỀỂỄỆ FƑḞꞘ GĜĞĠĢƓǤǦǴḠꞠ HĤĦȞḢḤḦḨḪⱧ IÌÍÎÏĨĪĬĮİƗǏȈȊḬḮỈỊ JĴɈ KĶƘǨḰḲḴⱩꝀ LĹĻĽĿŁȽḶḸḺḼⱠ MḾṀṂ NÑŃŅŇǸṄṆṈṊꞤ OÒÓÔÕÖØŌŎŐƟƠǑǪǬǾȌȎȪȬȮȰṌṎṐṒỌỎỐỒỔỖỘỚỜỞỠỢ PƤṔṖⱣ QɊ RŔŖŘȐȒɌṘṚṜṞⱤꞦ SŚŜŞŠȘṠṢṤṦṨⱾꞨ TŢŤŦƬƮȚȾṪṬṮṰ UÙÚÛÜŨŪŬŮŰƯǕǙǛǓǗȔȖɄṲṴṶṸṺỤỦỨỪỬỮỰ VƲṼṾ WŴẀẂẄẆẈ XẊẌ YÝŶŸƳȲɎẎỲỴỶỸ ZŹŻŽƵẐẒẔⱫ aàáâãäåāăąǎǟǡǻȃȧᶏḁẚạảấầẩẫậắằẳẵặⱥ bƀɓᵬᶀḃḅḇ cçćĉċčƈȼḉꞓꞔ dďđɗᵭᶁᶑḋḍḏḑḓ eèéêëēĕėęěȅȇȩɇᶒḕḗḙḛḝẹẻẽếềểễệ fƒᵮᶂḟꞙ gĝğġģǥǧǵɠᶃḡꞡ hĥħȟḣḥḧḩḫẖⱨꞕ iìíîïĩīĭįǐȉȋɨᶖḭḯỉị jĵǰɉ kķƙǩᶄḱḳḵⱪꝁ lĺļľŀłƚḷḹḻḽⱡ mᵯḿṁṃ nñńņňŉǹᵰᶇṅṇṉṋꞥ oòóôõöøōŏőơǒǫǭǿȍȏȫȭȯȱɵṍṏṑṓọỏốồổỗộớờởỡợ pƥᵱᵽᶈṕṗ qɋʠ rŕŗřȑȓɍɽᵲᵳᶉṛṝṟꞧ sśŝşšșȿᵴᶊṡṣṥṧṩꞩ tţťŧƫƭțʈᵵṫṭṯṱẗⱦ uùúûüũūŭůűųǚǖưǔǘǜȕȗʉᵾᶙṳṵṷṹṻụủứừửữự vʋᶌṽṿ wŵẁẃẅẇẉẘ xẋẍ yýÿŷƴȳɏẏẙỳỵỷỹ zźżžƶᵶᶎẑẓẕⱬ"
+ let groups = split(str)
+@@ -560,6 +562,19 @@ func Test_match_invalid_byte()
+ call delete('Xinvalid')
 endfunc
+ 
++func Test_match_illegal_byte()
++ let lines =<< trim END
++ silent! buffer ÿ\c
++ next ÿ
++ 0scriptnames
++ source
++ END
++ call writefile(lines, 'Xregexp')
++ call system(GetVimCommand() .. ' -X -Z -e -s -S Xregexp -c qa!')
 +
-+func Test_using_invalid_visual_position()
-+ " this was going beyond the end of the line
-+ new
-+ exe "norm 0o000\<Esc>0\<C-V>$s0"
-+ /\%V
-+ bwipe!
++ call delete('Xregexp')
 +endfunc
++
+ func Test_match_too_complicated()
+ set regexpengine=1
+ exe "noswapfile vsplit \xeb\xdb\x99"
 -- 
-2.27.0
+1.8.3.1

_service:tar_scm:backport-CVE-2022-0213.patch -> _service:tar_scm:backport-CVE-2022-2598.patch Changed

@@ -1,62 +1,67 @@
-From de05bb25733c3319e18dca44e9b59c6ee389eb26 Mon Sep 17 00:00:00 2001
+From 4e677b9c40ccbc5f090971b31dc2fe07bf05541d Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 13 Jan 2022 13:08:14 +0000
-Subject: PATCH patch 8.2.4074: going over the end of NameBuff
-
-Problem: Going over the end of NameBuff.
-Solution: Check length when appending a space.
+Date: Thu, 28 Jul 2022 18:44:27 +0100
+Subject: PATCH patch 9.0.0101: invalid memory access in diff mode with "dp"
+ and undo
 
+Problem: Invalid memory access in diff mode with "dp" and undo.
+Solution: Make sure the line number does not go below one.
 ---
- src/drawscreen.c | 9 +++++----
- src/testdir/test_edit.vim | 15 +++++++++++++++
- src/version.c | 2 ++
- 3 files changed, 22 insertions(+), 4 deletions(-)
+ src/diff.c | 9 ++++++---
+ src/testdir/test_diffmode.vim | 14 ++++++++++++++
+ 2 files changed, 20 insertions(+), 3 deletions(-)
 
-diff --git a/src/drawscreen.c b/src/drawscreen.c
-index 9acb705..7425ad4 100644
---- a/src/drawscreen.c
-+++ b/src/drawscreen.c
-@@ -437,12 +437,13 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED)
- 	p = NameBuff;
- 	len = (int)STRLEN(p);
- 
--	if (bt_help(wp->w_buffer)
-+	if ((bt_help(wp->w_buffer)
- #ifdef FEAT_QUICKFIX
--		|| wp->w_p_pvw
-+		 || wp->w_p_pvw
- #endif
--		|| bufIsChanged(wp->w_buffer)
--		|| wp->w_buffer->b_p_ro)
-+		 || bufIsChanged(wp->w_buffer)
-+		 || wp->w_buffer->b_p_ro)
-+		&& len < MAXPATHL - 1)
- 	 *(p + len++) = ' ';
- 	if (bt_help(wp->w_buffer))
- 	{
-diff --git a/src/testdir/test_edit.vim b/src/testdir/test_edit.vim
-index c3b1af5..48e6ff2 100644
---- a/src/testdir/test_edit.vim
-+++ b/src/testdir/test_edit.vim
-@@ -1532,3 +1532,18 @@ func Test_edit_put_CTRL_E()
- set encoding=utf-8
+diff --git a/src/diff.c b/src/diff.c
+index e4bafe2..fb43eee 100644
+--- a/src/diff.c
++++ b/src/diff.c
+@@ -464,7 +464,10 @@ diff_mark_adjust_tp(
+ 		 for (i = 0; i < DB_COUNT; ++i)
+ 			if (tp->tp_diffbufi != NULL && i != idx)
+ 			{
+-			 dp->df_lnumi -= off;
++			 if (dp->df_lnumi > off)
++				dp->df_lnumi -= off;
++			 else
++				dp->df_lnumi = 1;
+ 			 dp->df_counti += n;
+ 			}
+ 		}
+@@ -2863,8 +2866,8 @@ ex_diffgetput(exarg_T *eap)
+ 	 {
+ 		// remember deleting the last line of the buffer
+ 		buf_empty = curbuf->b_ml.ml_line_count == 1;
+-		ml_delete(lnum);
+-		--added;
++		if (ml_delete(lnum) == OK)
++		 --added;
+ 	 }
+ 	 for (i = 0; i < dp->df_countidx_from - start_skip - end_skip; ++i)
+ 	 {
+diff --git a/src/testdir/test_diffmode.vim b/src/testdir/test_diffmode.vim
+index dcacd55..41f7fe3 100644
+--- a/src/testdir/test_diffmode.vim
++++ b/src/testdir/test_diffmode.vim
+@@ -1628,5 +1628,19 @@ func Test_diff_manipulations()
+ %bwipe!
 endfunc
 
-+" Weird long file name was going over the end of NameBuff
-+func Test_edit_overlong_file_name()
-+ CheckUnix
-+
-+ file 0000000000000000000000000000
-+ file %%%%%%%%%%%%%%%%%%%%%%%%%%
-+ file %%%%%%
-+ set readonly
-+ set ls=2
++" This was causing the line number in the diff block to go below one.
++" FIXME: somehow this causes a valgrind error when run directly but not when
++" run as a test.
++func Test_diff_put_and_undo()
++ set diff
++ next 0
++ split 00
++ sil! norm o0&#x1b;gguudpo0&#x1b;ggJuudp
 +
-+ redraw!
-+ set noreadonly ls&
 + bwipe!
++ bwipe!
++ set nodiff
 +endfunc
 +
+ 
+ " vim: shiftwidth=2 sts=2 expandtab
 -- 
-2.23.0
+1.8.3.1

_service:tar_scm:backport-CVE-2022-0261.patch -> _service:tar_scm:backport-CVE-2022-2816.patch Changed

@@ -1,109 +1,58 @@
-From 9f8c304c8a390ade133bac29963dc8e56ab14cbc Mon Sep 17 00:00:00 2001
+From dbdd16b62560413abcc3c8e893cc3010ccf31666 Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Mon, 17 Jan 2022 17:30:21 +0000
-Subject: PATCH patch 8.2.4120: block insert goes over the end of the line
+Date: Sun, 14 Aug 2022 21:46:07 +0100
+Subject: PATCH patch 9.0.0212: invalid memory access when compiling :unlet
 
-Problem: Block insert goes over the end of the line.
-Solution: Handle invalid byte better. Fix inserting the wrong text.
+Problem: Invalid memory access when compiling :unlet.
+Solution: Don't read past the end of the line.
 ---
- src/ops.c | 40 ++++++++++++++++++++++++-------------
- src/testdir/test_visual.vim | 10 ++++++++++
- 2 files changed, 36 insertions(+), 14 deletions(-)
+ src/testdir/test_vim9_cmd.vim | 11 +++++++++--
+ src/vim9cmds.c | 6 ++++++
+ 2 files changed, 15 insertions(+), 2 deletions(-)
 
-diff --git a/src/ops.c b/src/ops.c
-index d3e1e47..13e6bdb 100644
---- a/src/ops.c
-+++ b/src/ops.c
-@@ -535,22 +535,27 @@ block_insert(
- 	 if (b_insert)
- 	 {
- 		off = (*mb_head_off)(oldp, oldp + offset + spaces);
-+		spaces -= off;
-+		count -= off;
- 	 }
- 	 else
- 	 {
--		off = (*mb_off_next)(oldp, oldp + offset);
--		offset += off;
-+		// spaces fill the gap, the character that's at the edge moves
-+		// right
-+		off = (*mb_head_off)(oldp, oldp + offset);
-+		offset -= off;
- 	 }
--	 spaces -= off;
--	 count -= off;
- 	}
+diff --git a/src/testdir/test_vim9_cmd.vim b/src/testdir/test_vim9_cmd.vim
+index 16f534e..a40f261 100644
+--- a/src/testdir/test_vim9_cmd.vim
++++ b/src/testdir/test_vim9_cmd.vim
+@@ -1704,12 +1704,19 @@ def Test_lockvar()
 
--	newp = alloc(STRLEN(oldp) + s_len + count + 1);
-+	// Make sure the allocated size matches what is actually copied below.
-+	newp = alloc(STRLEN(oldp) + spaces + s_len
-+		 + (spaces > 0 && !bdp->is_short ? ts_val - spaces : 0)
-+								 + count + 1);
- 	if (newp == NULL)
- 	 continue;
- 
- 	// copy up to shifted part
--	mch_memmove(newp, oldp, (size_t)(offset));
-+	mch_memmove(newp, oldp, (size_t)offset);
- 	oldp += offset;
- 
- 	// insert pre-padding
-@@ -560,14 +565,21 @@ block_insert(
- 	mch_memmove(newp + offset + spaces, s, (size_t)s_len);
- 	offset += s_len;
- 
--	if (spaces && !bdp->is_short)
-+	if (spaces > 0 && !bdp->is_short)
- 	{
--	 // insert post-padding
--	 vim_memset(newp + offset + spaces, ' ', (size_t)(ts_val - spaces));
--	 // We're splitting a TAB, don't copy it.
--	 oldp++;
--	 // We allowed for that TAB, remember this now
--	 count++;
-+	 if (*oldp == TAB)
-+	 {
-+		// insert post-padding
-+		vim_memset(newp + offset + spaces, ' ',
-+						 (size_t)(ts_val - spaces));
-+		// we're splitting a TAB, don't copy it
-+		oldp++;
-+		// We allowed for that TAB, remember this now
-+		count++;
-+	 }
-+	 else
-+		// Not a TAB, no extra spaces
-+		count = spaces;
- 	}
- 
- 	if (spaces > 0)
-@@ -1609,7 +1621,7 @@ op_insert(oparg_T *oap, long count1)
- 		oap->start_vcol = t;
- 	 }
- 	 else if (oap->op_type == OP_APPEND
--		 && oap->end.col + oap->end.coladd
-+			&& oap->start.col + oap->start.coladd
- 			>= curbuf->b_op_start_orig.col
- 					 + curbuf->b_op_start_orig.coladd)
- 	 {
-diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
-index 0705fdb..84a8981 100644
---- a/src/testdir/test_visual.vim
-+++ b/src/testdir/test_visual.vim
-@@ -903,3 +903,13 @@ func Test_visual_block_ctrl_w_f()
- endfunc
- 
- " vim: shiftwidth=2 sts=2 expandtab
+ lines =<< trim END
+ def _()
+- s:0(, s:0)
+ lockv
+ enddef
+ defcomp
+ END
+- v9.CheckScriptFailure(lines, 'E179', 2)
++ v9.CheckScriptFailure(lines, 'E179', 1)
 +
-+func Test_visual_block_append_invalid_char()
-+ " this was going over the end of the line
-+ new
-+ call setline(1, '	 let xxx', 'xxxxx', 'xxxxxxxxxxx')
-+ exe "normal 0\<C-V>jjA-\<Esc>"
-+ call assert_equal('	- let xxx', 'xxxxx -', 'xxxxxxxx-xxx', getline(1, 3))
-+ bwipe!
-+endfunc
++ lines =<< trim END
++ def T()
++ unlet
++ enddef
++ defcomp
++ END
++ v9.CheckScriptFailure(lines, 'E179', 1)
+ enddef
+ 
+ def Test_substitute_expr()
+diff --git a/src/vim9cmds.c b/src/vim9cmds.c
+index 35a3821..93032d6 100644
+--- a/src/vim9cmds.c
++++ b/src/vim9cmds.c
+@@ -92,6 +92,12 @@ free_locals(cctx_T *cctx)
+ int
+ check_vim9_unlet(char_u *name)
+ {
++ if (*name == NUL)
++ {
++	semsg(_(e_argument_required_for_str), "unlet");
++	return FAIL;
++ }
 +
+ if (name1 != ':' || vim_strchr((char_u *)"gwtb", *name) == NULL)
+ {
+ 	// "unlet s:var" is allowed in legacy script.
 -- 
-2.27.0
+2.36.1

_service:tar_scm:backport-CVE-2022-0318.patch -> _service:tar_scm:backport-CVE-2022-2817.patch Changed

@@ -1,63 +1,75 @@
-From 57df9e8a9f9ae1aafdde9b86b10ad907627a87dc Mon Sep 17 00:00:00 2001
+From 249e1b903a9c0460d618f6dcc59aeb8c03b24b20 Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 20 Jan 2022 12:10:48 +0000
-Subject: PATCH patch 8.2.4151: reading beyond the end of a line
+Date: Sun, 14 Aug 2022 22:23:02 +0100
+Subject: PATCH patch 9.0.0213: using freed memory with error in assert
+ argument
 
-Problem: Reading beyond the end of a line.
-Solution: For block insert only use the offset for correcting the length.
+Problem: Using freed memory with error in assert argument.
+Solution: Make a copy of the error.
 ---
- src/ops.c | 20 ++------------------
- src/testdir/test_visual.vim | 9 +++++++++
- 2 files changed, 11 insertions(+), 18 deletions(-)
+ src/testdir/test_assert.vim | 4 ++++
+ src/testing.c | 18 ++++++++++++------
+ 2 files changed, 16 insertions(+), 6 deletions(-)
 
-diff --git a/src/ops.c b/src/ops.c
-index 13e6bdb..2122ff3 100644
---- a/src/ops.c
-+++ b/src/ops.c
-@@ -528,24 +528,8 @@ block_insert(
- 	}
- 
- 	if (has_mbyte && spaces > 0)
--	{
--	 int off;
--
--	 // Avoid starting halfway a multi-byte character.
--	 if (b_insert)
--	 {
--		off = (*mb_head_off)(oldp, oldp + offset + spaces);
--		spaces -= off;
--		count -= off;
--	 }
--	 else
--	 {
--		// spaces fill the gap, the character that's at the edge moves
--		// right
--		off = (*mb_head_off)(oldp, oldp + offset);
--		offset -= off;
--	 }
--	}
-+	 // avoid copying part of a multi-byte character
-+	 offset -= (*mb_head_off)(oldp, oldp + offset);
- 
- 	// Make sure the allocated size matches what is actually copied below.
- 	newp = alloc(STRLEN(oldp) + spaces + s_len
-diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
-index 84a8981..3ed927a 100644
---- a/src/testdir/test_visual.vim
-+++ b/src/testdir/test_visual.vim
-@@ -913,3 +913,12 @@ func Test_visual_block_append_invalid_char()
- bwipe!
+diff --git a/src/testdir/test_assert.vim b/src/testdir/test_assert.vim
+index 27b2d73..7c9d090 100644
+--- a/src/testdir/test_assert.vim
++++ b/src/testdir/test_assert.vim
+@@ -291,6 +291,10 @@ func Test_assert_fail_fails()
+ let exp = v:exception
+ endtry
+ call assert_match("E1174: String required for argument 5", exp)
++
++ call assert_equal(1, assert_fails('c0', '', '\1'))
++ call assert_match("Expected '\\\\\\\\1' but got 'E939: Positive count required: c0': c0", v:errors0)
++ call remove(v:errors, 0)
 endfunc
 
-+func Test_visual_block_insert_round_off()
-+ new
-+ " The number of characters are tuned to fill a 4096 byte allocated block,
-+ " so that valgrind reports going over the end.
-+ call setline(1, 'xxxxx', repeat('0', 1350), "\t", repeat('x', 60))
-+ exe "normal gg0\<C-V>GI" .. repeat('0', 1320) .. "\<Esc>"
-+ bwipe!
-+endfunc
-+
+ func Test_assert_fails_in_try_block()
+diff --git a/src/testing.c b/src/testing.c
+index c49df4b..43b8d20 100644
+--- a/src/testing.c
++++ b/src/testing.c
+@@ -597,6 +597,7 @@ f_assert_fails(typval_T *argvars, typval_T *rettv)
+ int		save_trylevel = trylevel;
+ int		called_emsg_before = called_emsg;
+ char	*wrong_arg_msg = NULL;
++ char_u	*tofree = NULL;
+ 
+ if (check_for_string_or_number_arg(argvars, 0) == FAIL
+ 	 || check_for_opt_string_or_list_arg(argvars, 1) == FAIL
+@@ -660,13 +661,17 @@ f_assert_fails(typval_T *argvars, typval_T *rettv)
+ 	 }
+ 	 else if (list->lv_len == 2)
+ 	 {
+-		tv = &list->lv_u.mat.lv_last->li_tv;
+-		actual = get_vim_var_str(VV_ERRMSG);
+-		expected = tv_get_string_buf_chk(tv, buf);
+-		if (!pattern_match(expected, actual, FALSE))
++		// make a copy, an error in pattern_match() may free it
++		tofree = actual = vim_strsave(get_vim_var_str(VV_ERRMSG));
++		if (actual != NULL)
+ 		{
+-		 error_found = TRUE;
+-		 expected_str = expected;
++		 tv = &list->lv_u.mat.lv_last->li_tv;
++		 expected = tv_get_string_buf_chk(tv, buf);
++		 if (!pattern_match(expected, actual, FALSE))
++		 {
++			error_found = TRUE;
++			expected_str = expected;
++		 }
+ 		}
+ 	 }
+ 	}
+@@ -749,6 +754,7 @@ theend:
+ msg_scrolled = 0;
+ lines_left = Rows;
+ VIM_CLEAR(emsg_assert_fails_msg);
++ vim_free(tofree);
+ set_vim_var_string(VV_ERRMSG, NULL, 0);
+ if (wrong_arg_msg != NULL)
+ 	emsg(_(wrong_arg_msg));
 -- 
-2.27.0
+2.36.1

_service:tar_scm:backport-CVE-2022-0319.patch -> _service:tar_scm:backport-CVE-2022-2819.patch Changed

@@ -1,65 +1,66 @@
-From 05b27615481e72e3b338bb12990fb3e0c2ecc2a9 Mon Sep 17 00:00:00 2001
+From d1d8f6bacb489036d0fd479c9dd3c0102c988889 Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 20 Jan 2022 13:32:50 +0000
-Subject: PATCH patch 8.2.4154: ml_get error when exchanging windows in
- Visual mode
+Date: Sun, 14 Aug 2022 21:28:32 +0100
+Subject: PATCH patch 9.0.0211: invalid memory access when compiling :lockvar
 
-Problem: ml_get error when exchanging windows in Visual mode.
-Solution: Correct end of Visual area when entering another buffer
-
-Reference:https://github.com/vim/vim/commit/05b27615481e72e3b338bb12990fb3e0c2ecc2a9
-Conflict:NA
+Problem: Invalid memory access when compiling :lockvar.
+Solution: Don't read past the end of the line.
 ---
- src/testdir/test_visual.vim | 10 ++++++++++
- src/window.c | 7 ++++++-
- 2 files changed, 16 insertions(+), 1 deletion(-)
+ src/testdir/test_vim9_cmd.vim | 9 +++++++++
+ src/vim9cmds.c | 9 +++++++--
+ 2 files changed, 16 insertions(+), 2 deletions(-)
 
-diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
-index fcf6473..4f8f056 100644
---- a/src/testdir/test_visual.vim
-+++ b/src/testdir/test_visual.vim
-@@ -705,6 +705,16 @@ func Test_visual_undo_deletes_last_line()
- bwipe!
- endfunc
- 
-+" this was causing an ml_get error
-+func Test_visual_exchange_windows()
-+ enew!
-+ new
-+ call setline(1, 'foo', 'bar')
-+ exe "normal G\<C-V>gg\<C-W>\<C-X>OO\<Esc>"
-+ bwipe!
-+ bwipe!
-+endfunc
+diff --git a/src/testdir/test_vim9_cmd.vim b/src/testdir/test_vim9_cmd.vim
+index 7db8e50..16f534e 100644
+--- a/src/testdir/test_vim9_cmd.vim
++++ b/src/testdir/test_vim9_cmd.vim
+@@ -1701,6 +1701,15 @@ def Test_lockvar()
+ UnLockIt()
+ END
+ v9.CheckScriptFailure(lines, 'E46', 1)
 +
- func Test_visual_mode_put()
- new
++ lines =<< trim END
++ def _()
++ s:0(, s:0)
++ lockv
++ enddef
++ defcomp
++ END
++ v9.CheckScriptFailure(lines, 'E179', 2)
+ enddef
 
-diff --git a/src/window.c b/src/window.c
-index 5b407d5..bb17167 100644
---- a/src/window.c
-+++ b/src/window.c
-@@ -1661,6 +1661,11 @@ win_exchange(long Prenum)
+ def Test_substitute_expr()
+diff --git a/src/vim9cmds.c b/src/vim9cmds.c
+index ad32c32..35a3821 100644
+--- a/src/vim9cmds.c
++++ b/src/vim9cmds.c
+@@ -188,10 +188,17 @@ compile_lock_unlock(
+ size_t	len;
+ char_u	*buf;
+ isntype_T	isn = ISN_EXEC;
++ char	*cmd = eap->cmdidx == CMD_lockvar ? "lockvar" : "unlockvar";
 
- (void)win_comp_pos();		// recompute window positions
+ if (cctx->ctx_skip == SKIP_YES)
+ 	return OK;
 
-+ if (wp->w_buffer != curbuf)
-+	reset_VIsual_and_resel();
-+ else if (VIsual_active)
-+	wp->w_cursor = curwin->w_cursor;
++ if (*p == NUL)
++ {
++	semsg(_(e_argument_required_for_str), cmd);
++	return FAIL;
++ }
 +
- win_enter(wp, TRUE);
- redraw_all_later(NOT_VALID);
- }
-@@ -5114,7 +5119,7 @@ frame_remove(frame_T *frp)
- win_alloc_lines(win_T *wp)
- {
- wp->w_lines_valid = 0;
-- wp->w_lines = ALLOC_CLEAR_MULT(wline_T, Rows );
-+ wp->w_lines = ALLOC_CLEAR_MULT(wline_T, Rows);
- if (wp->w_lines == NULL)
- 	return FAIL;
- return OK;
+ // Cannot use :lockvar and :unlockvar on local variables.
+ if (p1 != ':')
+ {
+@@ -223,8 +230,6 @@ compile_lock_unlock(
+ 	ret = FAIL;
+ else
+ {
+-	char *cmd = eap->cmdidx == CMD_lockvar ? "lockvar" : "unlockvar";
+-
+ 	if (deep < 0)
+ 	 vim_snprintf((char *)buf, len, "%s! %s", cmd, p);
+ 	else
 -- 
-2.27.0
+2.36.1

_service:tar_scm:backport-CVE-2022-0351.patch -> _service:tar_scm:backport-CVE-2022-2845.patch Changed

@@ -1,78 +1,61 @@
+From e98c88c44c308edaea5994b8ad4363e65030968c Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Mon, 24 Jan 2022 18:16:12 +0000
-Subject: PATCH patch 8.2.4206: condition with many "(" causes a crash
+Date: Tue, 16 Aug 2022 14:51:53 +0100
+Subject: PATCH patch 9.0.0218: reading before the start of the line
 
-Problem: Condition with many "(" causes a crash.
-Solution: Limit recursion to 1000.
+Problem: Reading before the start of the line.
+Solution: When displaying "$" check the column is not negative.
 ---
- src/eval.c | 12 ++++++++++++
- src/globals.h | 2 ++
- src/testdir/test_eval_stuff.vim | 5 +++++
- 3 files changed, 19 insertions(+)
+ src/edit.c | 3 ++-
+ src/proto/edit.pro | 2 +-
+ src/testdir/test_cmdline.vim | 8 ++++++++
+ 3 files changed, 11 insertions(+), 2 deletions(-)
 
-diff --git a/src/eval.c b/src/eval.c
-index 3b563f7..95dda90 100644
---- a/src/eval.c
-+++ b/src/eval.c
-@@ -2495,6 +2495,7 @@ eval7(
- char_u	*start_leader, *end_leader;
- int		ret = OK;
- char_u	*alias;
-+ static	int recurse = 0;
+diff --git a/src/edit.c b/src/edit.c
+index a8e695c..96f47bd 100644
+--- a/src/edit.c
++++ b/src/edit.c
+@@ -1741,8 +1741,9 @@ edit_unputchar(void)
+ * Only works when cursor is in the line that changes.
+ */
+ void
+-display_dollar(colnr_T col)
++display_dollar(colnr_T col_arg)
+ {
++ colnr_T col = col_arg < 0 ? 0 : col_arg;
+ colnr_T save_col;
 
- /*
- * Initialise variable so that clear_tv() can't mistake this for a
-@@ -2521,6 +2522,15 @@ eval7(
- 	return FAIL;
- }
- 
-+ // Limit recursion to 1000 levels. At least at 10000 we run out of stack
-+ // and crash.
-+ if (recurse == 1000)
-+ {
-+	semsg(_(e_expression_too_recursive_str), *arg);
-+	return FAIL;
-+ }
-+ ++recurse;
-+
- switch (**arg)
- {
- /*
-@@ -2761,6 +2771,8 @@ eval7(
- */
- if (ret == OK && evaluate && end_leader > start_leader)
- 	ret = eval7_leader(rettv, start_leader, &end_leader);
-+
-+ --recurse;
- return ret;
- }
- 
-diff --git a/src/globals.h b/src/globals.h
-index 75092b7..659bad6 100644
---- a/src/globals.h
-+++ b/src/globals.h
-@@ -1464,6 +1464,8 @@ EXTERN char e_endwhile	INIT(= N_("E170: Missing :endwhile"));
- EXTERN char e_endfor	INIT(= N_("E170: Missing :endfor"));
- EXTERN char e_while		INIT(= N_("E588: :endwhile without :while"));
- EXTERN char e_for		INIT(= N_("E588: :endfor without :for"));
-+EXTERN char e_expression_too_recursive_str
-+ INIT(= N_("E1169: Expression too recursive: %s"));
- #endif
- EXTERN char e_exists	INIT(= N_("E13: File exists (add ! to override)"));
- EXTERN char e_failed	INIT(= N_("E472: Command failed"));
-diff --git a/src/testdir/test_eval_stuff.vim b/src/testdir/test_eval_stuff.vim
-index ec566da..32a5411 100644
---- a/src/testdir/test_eval_stuff.vim
-+++ b/src/testdir/test_eval_stuff.vim
-@@ -216,3 +216,8 @@ func Test_scriptversion_fail()
- call assert_fails('source Xversionscript', 'E999:')
- call delete('Xversionscript')
+ if (!redrawing())
+diff --git a/src/proto/edit.pro b/src/proto/edit.pro
+index a233e40..f35ec1e 100644
+--- a/src/proto/edit.pro
++++ b/src/proto/edit.pro
+@@ -5,7 +5,7 @@ void ins_redraw(int ready);
+ void edit_putchar(int c, int highlight);
+ void set_insstart(linenr_T lnum, int col);
+ void edit_unputchar(void);
+-void display_dollar(colnr_T col);
++void display_dollar(colnr_T col_arg);
+ void undisplay_dollar(void);
+ void truncate_spaces(char_u *line);
+ void backspace_until_column(int col);
+diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
+index f0498a1..08e2de7 100644
+--- a/src/testdir/test_cmdline.vim
++++ b/src/testdir/test_cmdline.vim
+@@ -3439,4 +3439,12 @@ func Test_long_error_message()
+ silent! norm Q00000000000000     000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000                                                                                                                                                                                                                        
 endfunc
+ 
++func Test_cmdwin_virtual_edit()
++ enew!
++ set ve=all cpo+=$
++ silent normal q/s
 +
-+func Test_deep_recursion()
-+ " this was running out of stack
-+ call assert_fails("exe 'if ' .. repeat('(', 1002)", 'E1169: Expression too recursive: ((')+endfunc
++ set ve= cpo-=$
 +endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
 -- 
-1.8.3.1
+2.36.1

_service:tar_scm:backport-CVE-2022-0359.patch -> _service:tar_scm:backport-CVE-2022-2849.patch Changed

@@ -1,28 +1,103 @@
-From 85b6747abc15a7a81086db31289cf1b8b17e6cb1 Mon Sep 17 00:00:00 2001
+From f6d39c31d2177549a986d170e192d8351bd571e2 Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 25 Jan 2022 11:55:02 +0000
-Subject: PATCH patch 8.2.4214: illegal memory access with large 'tabstop' in
- Ex mode
+Date: Tue, 16 Aug 2022 17:50:38 +0100
+Subject: PATCH patch 9.0.0220: invalid memory access with for loop over NULL
+ string
 
-Problem: Illegal memory access with large 'tabstop' in Ex mode.
-Solution: Allocate enough memory.
+Problem: Invalid memory access with for loop over NULL string.
+Solution: Make sure mb_ptr2len() consistently returns zero for NUL.
 ---
- src/ex_getln.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
+ src/globals.h | 3 ++-
+ src/mbyte.c | 21 +++++++++++++--------
+ src/testdir/test_eval_stuff.vim | 12 ++++++++++++
+ 3 files changed, 27 insertions(+), 9 deletions(-)
 
-diff --git a/src/ex_getln.c b/src/ex_getln.c
-index 769dcb8..68b4757 100644
---- a/src/ex_getln.c
-+++ b/src/ex_getln.c
-@@ -856,7 +856,7 @@ getcmdline_int(
- ccline.cmdindent = (firstc > 0 ? indent : 0);
+diff --git a/src/globals.h b/src/globals.h
+index 888f6e9..9b40be4 100644
+--- a/src/globals.h
++++ b/src/globals.h
+@@ -1033,7 +1033,8 @@ EXTERN vimconv_T output_conv;			// type of output conversion
+ * (DBCS).
+ * The value is set in mb_init();
+ */
+-// length of char in bytes, including following composing chars
++// Length of char in bytes, including any following composing chars.
++// NUL has length zero.
+ EXTERN int (*mb_ptr2len)(char_u *p) INIT(= latin_ptr2len);
 
- // alloc initial ccline.cmdbuff
-- alloc_cmdbuff(exmode_active ? 250 : indent + 1);
-+ alloc_cmdbuff(indent + 50);
- if (ccline.cmdbuff == NULL)
- 	goto theend;	// out of memory
- ccline.cmdlen = ccline.cmdpos = 0;
+ // idem, with limit on string length
+diff --git a/src/mbyte.c b/src/mbyte.c
+index 3656880..782a7ad 100644
+--- a/src/mbyte.c
++++ b/src/mbyte.c
+@@ -1077,24 +1077,28 @@ dbcs_char2bytes(int c, char_u *buf)
+ }
+ 
+ /*
+- * mb_ptr2len() function pointer.
+- * Get byte length of character at "*p" but stop at a NUL.
+- * For UTF-8 this includes following composing characters.
+- * Returns 0 when *p is NUL.
++ * Get byte length of character at "*p". Returns zero when "*p" is NUL.
++ * Used for mb_ptr2len() when 'encoding' latin.
+ */
+ int
+ latin_ptr2len(char_u *p)
+ {
+- return MB_BYTE2LEN(*p);
++ return *p == NUL ? 0 : 1;
+ }
+ 
++/*
++ * Get byte length of character at "*p". Returns zero when "*p" is NUL.
++ * Used for mb_ptr2len() when 'encoding' DBCS.
++ */
+ static int
+-dbcs_ptr2len(
+- char_u	*p)
++dbcs_ptr2len(char_u *p)
+ {
+ int		len;
+ 
+- // Check if second byte is not missing.
++ if (*p == NUL)
++	return 0;
++
++ // if the second byte is missing the length is 1
+ len = MB_BYTE2LEN(*p);
+ if (len == 2 && p1 == NUL)
+ 	len = 1;
+@@ -2105,6 +2109,7 @@ utf_ptr2len_len(char_u *p, int size)
+ /*
+ * Return the number of bytes the UTF-8 encoding of the character at "p" takes.
+ * This includes following composing characters.
++ * Returns zero for NUL.
+ */
+ int
+ utfc_ptr2len(char_u *p)
+diff --git a/src/testdir/test_eval_stuff.vim b/src/testdir/test_eval_stuff.vim
+index c63082e..313d791 100644
+--- a/src/testdir/test_eval_stuff.vim
++++ b/src/testdir/test_eval_stuff.vim
+@@ -75,6 +75,18 @@ func Test_for_invalid()
+ redraw
+ endfunc
+ 
++func Test_for_over_null_string()
++ let save_enc = &enc
++ set enc=iso8859
++ let cnt = 0
++ for c in test_null_string()
++ let cnt += 1
++ endfor
++ call assert_equal(0, cnt)
++
++ let &enc = save_enc
++endfunc
++
+ func Test_readfile_binary()
+ new
+ call setline(1, 'one', 'two', 'three')
 -- 
-1.8.3.1
+2.36.1

_service:tar_scm:backport-CVE-2022-0361.patch -> _service:tar_scm:backport-CVE-2022-2862.patch Changed

@@ -1,60 +1,72 @@
-From dc5490e2cbc8c16022a23b449b48c1bd0083f366 Mon Sep 17 00:00:00 2001
+From 1889f499a4f248cd84e0e0bf6d0d820016774494 Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 25 Jan 2022 13:52:53 +0000
-Subject: PATCH patch 8.2.4215: illegal memory access when copying lines in
- Visual mode
+Date: Tue, 16 Aug 2022 19:34:44 +0100
+Subject: PATCH patch 9.0.0221: accessing freed memory if compiling nested
+ function fails
 
-Problem: Illegal memory access when copying lines in Visual mode.
-Solution: Adjust the Visual position after copying lines.
+Problem: Accessing freed memory if compiling nested function fails.
+Solution: Mess up the variable name so that it won't be found.
 ---
- src/ex_cmds.c | 2 ++
- src/testdir/test_visual.vim | 13 +++++++++++--
- 2 files changed, 13 insertions(+), 2 deletions(-)
+ src/testdir/test_vim9_func.vim | 12 ++++++++++++
+ src/vim9compile.c | 7 +++++--
+ 2 files changed, 17 insertions(+), 2 deletions(-)
 
-diff --git a/src/ex_cmds.c b/src/ex_cmds.c
-index fea6dfa..aa97b40 100644
---- a/src/ex_cmds.c
-+++ b/src/ex_cmds.c
-@@ -864,6 +864,8 @@ ex_copy(linenr_T line1, linenr_T line2, linenr_T n)
- }
+diff --git a/src/testdir/test_vim9_func.vim b/src/testdir/test_vim9_func.vim
+index 33a6615..426fde4 100644
+--- a/src/testdir/test_vim9_func.vim
++++ b/src/testdir/test_vim9_func.vim
+@@ -907,6 +907,18 @@ def Test_nested_function()
+ v9.CheckScriptFailure(lines, 'E1173: Text found after enddef: burp', 3)
+ enddef
 
- appended_lines_mark(n, count);
-+ if (VIsual_active)
-+	check_pos(curbuf, &VIsual);
++def Test_nested_function_fails()
++ var lines =<< trim END
++ def T()
++ def Func(g: string):string
++ enddef
++ Func()
++ enddef
++ silent! defcompile
++ END
++ v9.CheckScriptFailure(lines, 'E1069:')
++enddef
++
+ def Test_not_nested_function()
+ echo printf('%d',
+ function('len')('xxx'))
+diff --git a/src/vim9compile.c b/src/vim9compile.c
+index b7f590e..fb39997 100644
+--- a/src/vim9compile.c
++++ b/src/vim9compile.c
+@@ -822,6 +822,7 @@ compile_nested_function(exarg_T *eap, cctx_T *cctx, garray_T *lines_to_free)
+ int		r = FAIL;
+ compiletype_T compile_type;
+ isn_T	*funcref_isn = NULL;
++ lvar_T	*lvar = NULL;
 
- msgmore((long)count);
- }
-diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
-index 3ed927a..f82d75b 100644
---- a/src/testdir/test_visual.vim
-+++ b/src/testdir/test_visual.vim
-@@ -658,8 +658,6 @@ func Test_linewise_select_mode()
- call append('$', 'a', 'b', 'c')
- exe "normal GkkgH\<Del>"
- call assert_equal('', 'b', 'c', getline(1, '$'))
--
+ if (eap->forceit)
+ {
+@@ -928,9 +929,8 @@ compile_nested_function(exarg_T *eap, cctx_T *cctx, garray_T *lines_to_free)
+ else
+ {
+ 	// Define a local variable for the function reference.
+-	lvar_T	*lvar = reserve_local(cctx, func_name, name_end - name_start,
++	lvar = reserve_local(cctx, func_name, name_end - name_start,
+ 						 TRUE, ufunc->uf_func_type);
 -
- " linewise select mode: delete middle two lines
- call deletebufline('', 1, '$')
- call append('$', 'a', 'b', 'c')
-@@ -681,6 +679,17 @@ func Test_linewise_select_mode()
- bwipe!
- endfunc
- 
-+" this was leaving the end of the Visual area beyond the end of a line
-+func Test_visual_ex_copy_line()
-+ new
-+ call setline(1, "aaa", "bbbbbbbbbxbb")
-+ /x
-+ exe "normal ggvjfxO"
-+ t0
-+ normal gNU
-+ bwipe!
-+endfunc
-+
- func Test_visual_mode_put()
- new
+ 	if (lvar == NULL)
+ 	 goto theend;
+ 	if (generate_FUNCREF(cctx, ufunc, &funcref_isn) == FAIL)
+@@ -949,6 +949,9 @@ compile_nested_function(exarg_T *eap, cctx_T *cctx, garray_T *lines_to_free)
+ 	 && compile_def_function(ufunc, TRUE, compile_type, cctx) == FAIL)
+ {
+ 	func_ptr_unref(ufunc);
++	if (lvar != NULL)
++	 // Now the local variable can't be used.
++	 *lvar->lv_name = '/'; // impossible value
+ 	goto theend;
+ }
 
 -- 
-2.27.0
+2.36.1

_service:tar_scm:backport-CVE-2022-0368.patch -> _service:tar_scm:backport-CVE-2022-2874.patch Changed

@@ -1,55 +1,73 @@
-From 8d02ce1ed75d008c34a5c9aaa51b67cbb9d33baa Mon Sep 17 00:00:00 2001
+From 4875d6ab068f09df88d24d81de40dcd8d56e243d Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 25 Jan 2022 18:24:00 +0000
-Subject: PATCH patch 8.2.4217: illegal memory access when undo makes Visual
- area invalid
+Date: Wed, 17 Aug 2022 15:55:51 +0100
+Subject: PATCH patch 9.0.0224: Using NULL pointer when skipping compiled
+ code
 
-Problem: Illegal memory access when undo makes Visual area invalid.
-Solution: Correct the Visual area after undo.
+Problem: Using NULL pointer when skipping compiled code.
+Solution: Check for skipping.
 ---
- src/testdir/test_visual.vim | 15 +++++++++++++++
- src/undo.c | 2 ++
- 2 files changed, 17 insertions(+)
+ src/testdir/test_vim9_script.vim | 13 +++++++++++++
+ src/vim9compile.c | 14 ++++++++++----
+ 2 files changed, 23 insertions(+), 4 deletions(-)
 
-diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
-index f82d75b..fcf6473 100644
---- a/src/testdir/test_visual.vim
-+++ b/src/testdir/test_visual.vim
-@@ -690,6 +690,21 @@ func Test_visual_ex_copy_line()
- bwipe!
- endfunc
+diff --git a/src/testdir/test_vim9_script.vim b/src/testdir/test_vim9_script.vim
+index fc0ef15..75b3e9c 100644
+--- a/src/testdir/test_vim9_script.vim
++++ b/src/testdir/test_vim9_script.vim
+@@ -2097,6 +2097,19 @@ def Test_for_skipped_block()
+ v9.CheckDefAndScriptSuccess(lines)
+ enddef
 
-+" This was leaving the end of the Visual area beyond the end of a line.
-+" Set 'undolevels' to start a new undo block.
-+func Test_visual_undo_deletes_last_line()
-+ new
-+ call setline(1, "aaa", "ccc", "dyd")
-+ set undolevels=100
-+ exe "normal obbbbbbbbbxbb\<Esc>"
-+ set undolevels=100
-+ /y
-+ exe "normal ggvjfxO"
-+ undo
-+ normal gNU
-+ bwipe!
-+endfunc
++def Test_skipped_redir()
++ var lines =<< trim END
++ def T()
++ if 0
++ redir =>l0
++ redir END
++ endif
++ enddef
++ defcompile
++ END
++ v9.CheckScriptSuccess(lines)
++enddef
 +
- func Test_visual_mode_put()
- new
- 
-diff --git a/src/undo.c b/src/undo.c
-index 54a6e1c..706dee9 100644
---- a/src/undo.c
-+++ b/src/undo.c
-@@ -2985,6 +2985,8 @@ u_undo_end(
+ def Test_for_loop()
+ var lines =<< trim END
+ var result = ''
+diff --git a/src/vim9compile.c b/src/vim9compile.c
+index fb39997..a8fa5dc 100644
+--- a/src/vim9compile.c
++++ b/src/vim9compile.c
+@@ -1157,11 +1157,14 @@ generate_loadvar(
+ 	 generate_LOADV(cctx, name + 2);
+ 	 break;
+ 	case dest_local:
+-	 if (lvar->lv_from_outer > 0)
+-		generate_LOADOUTER(cctx, lvar->lv_idx, lvar->lv_from_outer,
++	 if (cctx->ctx_skip != SKIP_YES)
++	 {
++		if (lvar->lv_from_outer > 0)
++		 generate_LOADOUTER(cctx, lvar->lv_idx, lvar->lv_from_outer,
+ 									 type);
+-	 else
+-		generate_LOAD(cctx, ISN_LOAD, lvar->lv_idx, NULL, type);
++		else
++		 generate_LOAD(cctx, ISN_LOAD, lvar->lv_idx, NULL, type);
++	 }
+ 	 break;
+ 	case dest_expr:
+ 	 // list or dict value should already be on the stack.
+@@ -1944,6 +1947,9 @@ compile_assign_unlet(
 	}
 }
- #endif
-+ if (VIsual_active)
-+	check_pos(curbuf, &VIsual);
 
- smsg_attr_keep(0, _("%ld %s; %s #%ld %s"),
- 	 u_oldcount < 0 ? -u_oldcount : u_oldcount,
++ if (cctx->ctx_skip == SKIP_YES)
++	return OK;
++
+ // Load the dict or list. On the stack we then have:
+ // - value (for assignment, not for :unlet)
+ // - index
 -- 
-2.27.0
+2.36.1

_service:tar_scm:backport-CVE-2022-0392.patch -> _service:tar_scm:backport-CVE-2022-2889.patch Changed

@@ -1,50 +1,245 @@
-From 806d037671e133bd28a7864248763f643967973a Mon Sep 17 00:00:00 2001
+From 91c7cbfe31bbef57d5fcf7d76989fc159f73ef15 Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 25 Jan 2022 20:45:16 +0000
-Subject: PATCH patch 8.2.4218: illegal memory access with bracketed paste in
- Ex mode
-
-Problem: Illegal memory access with bracketed paste in Ex mode.
-Solution: Reserve space for the trailing NUL.
+Date: Thu, 18 Aug 2022 13:28:31 +0100
+Subject: PATCH patch 9.0.0225: using freed memory with multiple line breaks
+ in expression
 
+Problem: Using freed memory with multiple line breaks in expression.
+Solution: Free eval_tofree later.
 ---
- src/edit.c | 3 ++-
- src/testdir/test_paste.vim | 11 +++++++++++
- 2 files changed, 13 insertions(+), 1 deletion(-)
+ src/eval.c | 102 ++++++++++++++++++-------------
+ src/proto/eval.pro | 4 +-
+ src/testdir/test_vim9_script.vim | 13 ++++
+ src/userfunc.c | 15 -----
+ 4 files changed, 75 insertions(+), 59 deletions(-)
 
-diff --git a/src/edit.c b/src/edit.c
-index c67f67c..3767769 100644
---- a/src/edit.c
-+++ b/src/edit.c
-@@ -4984,7 +4984,8 @@ bracketed_paste(paste_mode_T mode, int drop, garray_T *gap)
- 		 break;
- 
- 		case PASTE_EX:
--		 if (gap != NULL && ga_grow(gap, idx) == OK)
-+	 // add one for the NUL that is going to be appended
-+		 if (gap != NULL && ga_grow(gap, idx + 1) == OK)
- 		 {
- 			mch_memmove((char *)gap->ga_data + gap->ga_len,
- 							 buf, (size_t)idx);
-diff --git a/src/testdir/test_paste.vim b/src/testdir/test_paste.vim
-index c30140f..263f084 100644
---- a/src/testdir/test_paste.vim
-+++ b/src/testdir/test_paste.vim
-@@ -134,3 +134,14 @@ func Test_xrestore()
+diff --git a/src/eval.c b/src/eval.c
+index 42b883e..60daca5 100644
+--- a/src/eval.c
++++ b/src/eval.c
+@@ -353,6 +353,63 @@ eval_to_string_skip(
+ return retval;
+ }
 
- bwipe!
- endfunc
++/*
++ * Initialize "evalarg" for use.
++ */
++ void
++init_evalarg(evalarg_T *evalarg)
++{
++ CLEAR_POINTER(evalarg);
++ ga_init2(&evalarg->eval_tofree_ga, sizeof(char_u *), 20);
++}
++
++/*
++ * If "evalarg->eval_tofree" is not NULL free it later.
++ * Caller is expected to overwrite "evalarg->eval_tofree" next.
++ */
++ static void
++free_eval_tofree_later(evalarg_T *evalarg)
++{
++ if (evalarg->eval_tofree != NULL)
++ {
++	if (ga_grow(&evalarg->eval_tofree_ga, 1) == OK)
++	 ((char_u **)evalarg->eval_tofree_ga.ga_data)
++		evalarg->eval_tofree_ga.ga_len++
++		= evalarg->eval_tofree;
++	else
++	 vim_free(evalarg->eval_tofree);
++ }
++}
 +
-+" bracketed paste in Ex-mode
-+func Test_paste_ex_mode()
-+ unlet! foo
-+ call feedkeys("Qlet foo=\"\<Esc>200~foo\<CR>bar\<Esc>201~\"\<CR>vi\<CR>", 'xt')
-+ call assert_equal("foo\rbar", foo)
++/*
++ * After using "evalarg" filled from "eap": free the memory.
++ */
++ void
++clear_evalarg(evalarg_T *evalarg, exarg_T *eap)
++{
++ if (evalarg != NULL)
++ {
++	if (evalarg->eval_tofree != NULL)
++	{
++	 if (eap != NULL)
++	 {
++		// We may need to keep the original command line, e.g. for
++		// ":let" it has the variable names. But we may also need the
++		// new one, "nextcmd" points into it. Keep both.
++		vim_free(eap->cmdline_tofree);
++		eap->cmdline_tofree = *eap->cmdlinep;
++		*eap->cmdlinep = evalarg->eval_tofree;
++	 }
++	 else
++		vim_free(evalarg->eval_tofree);
++	 evalarg->eval_tofree = NULL;
++	}
 +
++	ga_clear_strings(&evalarg->eval_tofree_ga);
++	VIM_CLEAR(evalarg->eval_tofree_lambda);
++ }
++}
 +
-+ " pasting more than 40 bytes
-+ exe "norm Q\<PasteStart>0000000000000000000000000000000000000000000000000000000000000000000000\<C-C>"
-+endfunc
+ /*
+ * Skip over an expression at "*pp".
+ * Return FAIL for an error, OK otherwise.
+@@ -435,8 +492,8 @@ skip_expr_concatenate(
+ 		// Do not free the first line, the caller can still use it.
+ 		*((char_u **)gap->ga_data) = NULL;
+ 		// Do not free the last line, "arg" points into it, free it
+-		// later.
+-		vim_free(evalarg->eval_tofree);
++		// later. Also free "eval_tofree" later if needed.
++		free_eval_tofree_later(evalarg);
+ 		evalarg->eval_tofree =
+ 				 ((char_u **)gap->ga_data)gap->ga_len - 1;
+ 		((char_u **)gap->ga_data)gap->ga_len - 1 = NULL;
+@@ -2274,7 +2331,7 @@ eval_next_line(char_u *arg, evalarg_T *evalarg)
+ }
+ else if (evalarg->eval_cookie != NULL)
+ {
+-	vim_free(evalarg->eval_tofree);
++	free_eval_tofree_later(evalarg);
+ 	evalarg->eval_tofree = line;
+ }
+ 
+@@ -2301,45 +2358,6 @@ skipwhite_and_linebreak(char_u *arg, evalarg_T *evalarg)
+ return p;
+ }
+ 
+-/*
+- * Initialize "evalarg" for use.
+- */
+- void
+-init_evalarg(evalarg_T *evalarg)
+-{
+- CLEAR_POINTER(evalarg);
+- ga_init2(&evalarg->eval_tofree_ga, sizeof(char_u *), 20);
+-}
+-
+-/*
+- * After using "evalarg" filled from "eap": free the memory.
+- */
+- void
+-clear_evalarg(evalarg_T *evalarg, exarg_T *eap)
+-{
+- if (evalarg != NULL)
+- {
+-	if (evalarg->eval_tofree != NULL)
+-	{
+-	 if (eap != NULL)
+-	 {
+-		// We may need to keep the original command line, e.g. for
+-		// ":let" it has the variable names. But we may also need the
+-		// new one, "nextcmd" points into it. Keep both.
+-		vim_free(eap->cmdline_tofree);
+-		eap->cmdline_tofree = *eap->cmdlinep;
+-		*eap->cmdlinep = evalarg->eval_tofree;
+-	 }
+-	 else
+-		vim_free(evalarg->eval_tofree);
+-	 evalarg->eval_tofree = NULL;
+-	}
+-
+-	ga_clear_strings(&evalarg->eval_tofree_ga);
+-	VIM_CLEAR(evalarg->eval_tofree_lambda);
+- }
+-}
+-
+ /*
+ * The "evaluate" argument: When FALSE, the argument is only parsed but not
+ * executed. The function may return OK, but the rettv will be of type
+diff --git a/src/proto/eval.pro b/src/proto/eval.pro
+index e6cd892..27a13c9 100644
+--- a/src/proto/eval.pro
++++ b/src/proto/eval.pro
+@@ -9,6 +9,8 @@ int eval_expr_valid_arg(typval_T *tv);
+ int eval_expr_typval(typval_T *expr, typval_T *argv, int argc, typval_T *rettv);
+ int eval_expr_to_bool(typval_T *expr, int *error);
+ char_u *eval_to_string_skip(char_u *arg, exarg_T *eap, int skip);
++void init_evalarg(evalarg_T *evalarg);
++void clear_evalarg(evalarg_T *evalarg, exarg_T *eap);
+ int skip_expr(char_u **pp, evalarg_T *evalarg);

_service:tar_scm:backport-CVE-2022-0408.patch -> _service:tar_scm:backport-CVE-2022-2923.patch Changed

@@ -1,92 +1,56 @@
-From 06f15416bb8d5636200a10776f1752c4d6e49f31 Mon Sep 17 00:00:00 2001
+From 6669de1b235843968e88844ca6d3c8dec4b01a9e Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Sat, 29 Jan 2022 10:51:59 +0000
-Subject: PATCH patch 8.2.4247: stack corruption when looking for spell
- suggestions
+Date: Sun, 21 Aug 2022 20:33:47 +0100
+Subject: PATCH patch 9.0.0240: crash when using ":mkspell" with an
+empty
+ .dic file
 
-Problem: Stack corruption when looking for spell suggestions.
-Solution: Prevent the depth increased too much. Add a five second time
-limit to finding suggestions.
+Problem: Crash when using ":mkspell" with an empty .dic file.
+Solution: Check for an empty word tree.
 ---
- src/spellsuggest.c | 17 +++++++++++++++--
- src/testdir/test_spell.vim | 8 ++++++++
- 2 files changed, 23 insertions(+), 2 deletions(-)
+ src/spellfile.c | 4 +++-
+ src/testdir/test_spellfile.vim | 12 ++++++++++++
+ 2 files changed, 15 insertions(+), 1 deletion(-)
 
-diff --git a/src/spellsuggest.c b/src/spellsuggest.c
-index 8615d52..a73e695 100644
---- a/src/spellsuggest.c
-+++ b/src/spellsuggest.c
-@@ -1187,7 +1187,7 @@ suggest_try_change(suginfo_T *su)
+diff --git a/src/spellfile.c b/src/spellfile.c
+index 4a0de52..a4407fa 100644
+--- a/src/spellfile.c
++++ b/src/spellfile.c
+@@ -5585,10 +5585,12 @@ sug_filltree(spellinfo_T *spin, slang_T *slang)
 
- // Check the maximum score, if we go over it we won't try this change.
- #define TRY_DEEPER(su, stack, depth, add) \
--		(stackdepth.ts_score + (add) < su->su_maxscore)
-+	 (depth < MAXWLEN && stackdepth.ts_score + (add) < su->su_maxscore)
+ /*
+ * Go through the whole case-folded tree, soundfold each word and put it
+- * in the trie.
++ * in the trie. Bail out if the tree is empty.
+ */
+ byts = slang->sl_fbyts;
+ idxs = slang->sl_fidxs;
++ if (byts == NULL || idxs == NULL)
++	return FAIL;
 
- /*
- * Try finding suggestions by adding/removing/swapping letters.
-@@ -1259,6 +1259,9 @@ suggest_trie_walk(
- char_u	changenameMAXWLEN80;
- #endif
- int		breakcheckcount = 1000;
-+#ifdef FEAT_RELTIME
-+ proftime_T	time_limit;
-+#endif
- int		compound_ok;
- 
- // Go through the whole case-fold tree, try changes at each node.
-@@ -1303,6 +1306,11 @@ suggest_trie_walk(
- 	 sp->ts_state = STATE_START;
- 	}
- }
-+#ifdef FEAT_RELTIME
-+ // The loop may take an indefinite amount of time. Break out after five
-+ // sectonds. TODO: add an option for the time limit.
-+ profile_setlimit(5000, &time_limit);
-+#endif
- 
- // Loop to find all suggestions. At each round we either:
- // - For the current state try one operation, advance "ts_curi",
-@@ -1337,7 +1345,8 @@ suggest_trie_walk(
- 
- 		// At end of a prefix or at start of prefixtree: check for
- 		// following word.
--		if (bytsarridx == 0 || n == (int)STATE_NOPREFIX)
-+		if (depth < MAXWLEN
-+			 && (bytsarridx == 0 || n == (int)STATE_NOPREFIX))
- 		{
- 		 // Set su->su_badflags to the caps type at this position.
- 		 // Use the caps type until here for the prefix itself.
-@@ -2630,6 +2639,10 @@ suggest_trie_walk(
- 	 {
- 		ui_breakcheck();
- 		breakcheckcount = 1000;
-+#ifdef FEAT_RELTIME
-+		if (profile_passed_limit(&time_limit))
-+		 got_int = TRUE;
-+#endif
- 	 }
- 	}
- }
-diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
-index e435e91..271d034 100644
---- a/src/testdir/test_spell.vim
-+++ b/src/testdir/test_spell.vim
-@@ -427,6 +427,14 @@ func Test_spell_long_word()
- set nospell
+ arridx0 = 0;
+ curi0 = 1;
+diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim
+index 38d1ec0..e81aa65 100644
+--- a/src/testdir/test_spellfile.vim
++++ b/src/testdir/test_spellfile.vim
+@@ -1160,4 +1160,16 @@ func Test_mkspellmem_opt()
+ call assert_fails('set mkspellmem=1000,50,0', 'E474:')
 endfunc
 
-+func Test_spellsuggest_too_deep()
-+ " This was incrementing "depth" over MAXWLEN.
-+ new
-+ norm &#x16;s000G00ý000000000000
-+ sil norm ..vzG................vvzG0 v z=
-+ bwipe!
++" this was using a NULL pointer
++func Test_mkspell_empty_dic()
++ call writefile('1', 'XtestEmpty.dic')
++ call writefile('SOFOFROM abcd', 'SOFOTO ABCD', 'SAL CIA X', 'XtestEmpty.aff')
++ mkspell! XtestEmpty.spl XtestEmpty
++
++ call delete('XtestEmpty.dic')
++ call delete('XtestEmpty.aff')
++ call delete('XtestEmpty.spl')
 +endfunc
 +
- func LoadAffAndDic(aff_contents, dic_contents)
- set enc=latin1
- set spellfile=
++
+ " vim: shiftwidth=2 sts=2 expandtab
 -- 
-1.8.3.1
+2.36.1

_service:tar_scm:backport-CVE-2022-0413.patch -> _service:tar_scm:backport-CVE-2022-2946.patch Changed

@@ -1,85 +1,71 @@
-From 37f47958b8a2a44abc60614271d9537e7f14e51a Mon Sep 17 00:00:00 2001
+From adce965162dd89bf29ee0e5baf53652e7515762c Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Sat, 29 Jan 2022 14:21:51 +0000
-Subject: PATCH patch 8.2.4253: using freed memory when substitute with
- function call
+Date: Mon, 22 Aug 2022 16:35:45 +0100
+Subject: PATCH patch 9.0.0246: using freed memory when 'tagfunc' deletes the
+ buffer
 
-Problem: Using freed memory when substitute uses a recursive function call.
-Solution: Make a copy of the substitute text.
+Problem: Using freed memory when 'tagfunc' deletes the buffer.
+Solution: Make a copy of the tag name.
 ---
- src/ex_cmds.c | 19 +++++++++++++++----
- src/testdir/test_substitute.vim | 16 ++++++++++++++++
- 2 files changed, 31 insertions(+), 4 deletions(-)
+ src/tag.c | 9 ++++++++-
+ src/testdir/test_tagfunc.vim | 12 ++++++++++++
+ 2 files changed, 20 insertions(+), 1 deletion(-)
 
-diff --git a/src/ex_cmds.c b/src/ex_cmds.c
-index cccdf47..aa97b40 100644
---- a/src/ex_cmds.c
-+++ b/src/ex_cmds.c
-@@ -3577,6 +3577,7 @@ do_sub(exarg_T *eap)
- int		save_do_all;		// remember user specified 'g' flag
- int		save_do_ask;		// remember user specified 'c' flag
- char_u	*pat = NULL, *sub = NULL;	// init for GCC
-+ char_u	*sub_copy = NULL;
- int		delimiter;
- int		sublen;
- int		got_quit = FALSE;
-@@ -3866,11 +3867,20 @@ do_sub(exarg_T *eap)
- sub_firstline = NULL;
+diff --git a/src/tag.c b/src/tag.c
+index 8a351cc..02f0818 100644
+--- a/src/tag.c
++++ b/src/tag.c
+@@ -281,6 +281,7 @@ do_tag(
+ char_u	*buf_ffname = curbuf->b_ffname;	 // name to use for
+ 						 // priority computation
+ int		use_tfu = 1;
++ char_u	*tofree = NULL;
 
- /*
-- * ~ in the substitute pattern is replaced with the old pattern.
-- * We do it here once to avoid it to be replaced over and over again.
-- * But don't do it when it starts with "\=", then it's an expression.
-+ * If the substitute pattern starts with "\=" then it's an expression.
-+ * Make a copy, a recursive function may free it.
-+ * Otherwise, '~' in the substitute pattern is replaced with the old
-+ * pattern. We do it here once to avoid it to be replaced over and over
-+ * again.
- */
-- if (!(sub0 == '\\' && sub1 == '='))
-+ if (sub0 == '\\' && sub1 == '=')
-+ {
-+ sub = vim_strsave(sub);
-+ if (sub == NULL)
-+ return;
-+ sub_copy = sub;
-+ }
-+ else
- 	sub = regtilde(sub, p_magic);
+ // remember the matches for the last used tag
+ static int		num_matches = 0;
+@@ -630,7 +631,12 @@ do_tag(
+ 	 * When desired match not found yet, try to find it (and others).
+ 	 */
+ 	if (use_tagstack)
+-	 name = tagstacktagstackidx.tagname;
++	{
++	 // make a copy, the tagstack may change in 'tagfunc'
++	 name = vim_strsave(tagstacktagstackidx.tagname);
++	 vim_free(tofree);
++	 tofree = name;
++	}
+ #if defined(FEAT_QUICKFIX)
+ 	else if (g_do_tagpreview != 0)
+ 	 name = ptag_entry.tagname;
+@@ -922,6 +928,7 @@ end_do_tag:
+ g_do_tagpreview = 0;	// don't do tag preview next time
+ # endif
 
- /*
-@@ -4670,6 +4680,7 @@ outofmem:
- #endif
- 
- vim_regfree(regmatch.regprog);
-+ vim_free(sub_copy);
- 
- // Restore the flag values, they can be used for ":&&".
- subflags.do_all = save_do_all;
-diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
-index c7532fb..3e6bc5c 100644
---- a/src/testdir/test_substitute.vim
-+++ b/src/testdir/test_substitute.vim
-@@ -745,3 +745,19 @@ func Test_sub_beyond_end()
- call assert_equal('#', getline(1))
- bwipe!
++ vim_free(tofree);
+ #ifdef FEAT_CSCOPE
+ return jumped_to_tag;
+ #else
+diff --git a/src/testdir/test_tagfunc.vim b/src/testdir/test_tagfunc.vim
+index 05d8473..9582612 100644
+--- a/src/testdir/test_tagfunc.vim
++++ b/src/testdir/test_tagfunc.vim
+@@ -389,4 +389,16 @@ func Test_tagfunc_callback()
+ %bw!
 endfunc
-+
-+" This was using "old_sub" after it was freed.
-+func Test_using_old_sub()
-+ set compatible maxfuncdepth=10
-+ new
-+ call setline(1, 'some text.')
-+ func Repl()
-+ ~
-+ s/
+ 
++func Test_tagfunc_wipes_buffer()
++ func g:Tag0unc0(t,f,o)
++ bwipe
 + endfunc
-+ silent! s/\%')/\=Repl()
++ set tagfunc=g:Tag0unc0
++ new
++ cal assert_fails('tag 0', 'E987:')
 +
-+ delfunc Repl
-+ bwipe!
-+ set nocompatible
++ delfunc g:Tag0unc0
++ set tagfunc=
 +endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
 -- 
 1.8.3.1

_service:tar_scm:backport-CVE-2022-0417.patch -> _service:tar_scm:backport-CVE-2022-2980.patch Changed

@@ -1,117 +1,172 @@
-From 652dee448618589de5528a9e9a36995803f5557a Mon Sep 17 00:00:00 2001
+From 80525751c5ce9ed82c41d83faf9ef38667bf61b1 Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Fri, 28 Jan 2022 20:47:49 +0000
-Subject: PATCH patch 8.2.4245: ":retab 0" may cause illegal memory access
-
-Problem: ":retab 0" may cause illegal memory access.
-Solution: Limit the value of 'tabstop' to 10000.
+Date: Wed, 24 Aug 2022 19:27:45 +0100
+Subject: PATCH patch 9.0.0259: crash with mouse click when not initialized
 
+Problem: Crash with mouse click when not initialized.
+Solution: Check TabPageIdxs is not NULL.
 ---
- src/indent.c | 4 ++--
- src/option.c | 16 +++++++++-------
- src/testdir/test_options.vim | 2 ++
- src/vim.h | 2 ++
- 4 files changed, 15 insertions(+), 9 deletions(-)
+ src/mouse.c | 107 ++++++++++++++++++++++---------------------
+ src/testdir/test_tabline.vim | 14 ++++++
+ 2 files changed, 69 insertions(+), 52 deletions(-)
 
-diff --git a/src/indent.c b/src/indent.c
-index 7d04373..e8e93b9 100644
---- a/src/indent.c
-+++ b/src/indent.c
-@@ -71,7 +71,7 @@ tabstop_set(char_u *var, int **array)
- 	int n = atoi((char *)cp);
+diff --git a/src/mouse.c b/src/mouse.c
+index c39f614..12895f8 100644
+--- a/src/mouse.c
++++ b/src/mouse.c
+@@ -471,74 +471,77 @@ do_mouse(
 
- 	// Catch negative values, overflow and ridiculous big values.
--	if (n < 0 || n > 9999)
-+	if (n < 0 || n > TABSTOP_MAX)
- 	{
- 	 semsg(_(e_invarg2), cp);
- 	 vim_free(*array);
-@@ -1590,7 +1590,7 @@ ex_retab(exarg_T *eap)
- 	emsg(_(e_positive));
- 	return;
- }
-- if (new_ts < 0 || new_ts > 9999)
-+ if (new_ts < 0 || new_ts > TABSTOP_MAX)
- {
- 	semsg(_(e_invarg2), eap->arg);
- 	return;
-diff --git a/src/option.c b/src/option.c
-index e9598d6..382b01b 100644
---- a/src/option.c
-+++ b/src/option.c
-@@ -3557,6 +3557,11 @@ set_num_option(
- 	errmsg = e_positive;
- 	curbuf->b_p_ts = 8;
- }
-+ else if (curbuf->b_p_ts > TABSTOP_MAX)
-+ {
-+	errmsg = e_invalid_argument;
-+	curbuf->b_p_ts = 8;
-+ }
- if (p_tm < 0)
+ start_visual.lnum = 0;
+ 
+- // Check for clicking in the tab page line.
+- if (mouse_row == 0 && firstwin->w_winrow > 0)
++ if (TabPageIdxs != NULL) // only when initialized
 {
- 	errmsg = e_positive;
-@@ -5758,7 +5763,7 @@ buf_copy_options(buf_T *buf, int flags)
- 	 if (p_vsts && p_vsts != empty_option)
- 		(void)tabstop_set(p_vsts, &buf->b_p_vsts_array);
- 	 else
--		buf->b_p_vsts_array = 0;
-+		buf->b_p_vsts_array = NULL;
- 	 buf->b_p_vsts_nopaste = p_vsts_nopaste
- 				 ? vim_strsave(p_vsts_nopaste) : NULL;
- #endif
-@@ -6583,9 +6588,7 @@ paste_option_changed(void)
- 	 if (buf->b_p_vsts)
- 		free_string_option(buf->b_p_vsts);
- 	 buf->b_p_vsts = empty_option;
--	 if (buf->b_p_vsts_array)
--		vim_free(buf->b_p_vsts_array);
--	 buf->b_p_vsts_array = 0;
-+	 VIM_CLEAR(buf->b_p_vsts_array);
- #endif
- 	}
+-	if (is_drag)
++	// Check for clicking in the tab page line.
++	if (mouse_row == 0 && firstwin->w_winrow > 0)
+ 	{
+-	 if (in_tab_line)
++	 if (is_drag)
+ 	 {
+-		c1 = TabPageIdxsmouse_col;
+-		tabpage_move(c1 <= 0 ? 9999 : c1 < tabpage_index(curtab)
+-								? c1 - 1 : c1);
++		if (in_tab_line)
++		{
++		 c1 = TabPageIdxsmouse_col;
++		 tabpage_move(c1 <= 0 ? 9999 : c1 < tabpage_index(curtab)
++								 ? c1 - 1 : c1);
++		}
++		return FALSE;
+ 	 }
+-	 return FALSE;
+-	}
 
-@@ -6631,12 +6634,11 @@ paste_option_changed(void)
- 		free_string_option(buf->b_p_vsts);
- 	 buf->b_p_vsts = buf->b_p_vsts_nopaste
- 			 ? vim_strsave(buf->b_p_vsts_nopaste) : empty_option;
--	 if (buf->b_p_vsts_array)
--		vim_free(buf->b_p_vsts_array);
-+	 vim_free(buf->b_p_vsts_array);
- 	 if (buf->b_p_vsts && buf->b_p_vsts != empty_option)
- 		(void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
- 	 else
--		buf->b_p_vsts_array = 0;
-+		buf->b_p_vsts_array = NULL;
- #endif
- 	}
+-	// click in a tab selects that tab page
+-	if (is_click
++	 // click in a tab selects that tab page
++	 if (is_click
+ # ifdef FEAT_CMDWIN
+-		&& cmdwin_type == 0
++		 && cmdwin_type == 0
+ # endif
+-		&& mouse_col < Columns)
+-	{
+-	 in_tab_line = TRUE;
+-	 c1 = TabPageIdxsmouse_col;
+-	 if (c1 >= 0)
++		 && mouse_col < Columns)
+ 	 {
+-		if ((mod_mask & MOD_MASK_MULTI_CLICK) == MOD_MASK_2CLICK)
+-		{
+-		 // double click opens new page
+-		 end_visual_mode_keep_button();
+-		 tabpage_new();
+-		 tabpage_move(c1 == 0 ? 9999 : c1 - 1);
+-		}
+-		else
++		in_tab_line = TRUE;
++		c1 = TabPageIdxsmouse_col;
++		if (c1 >= 0)
+ 		{
+-		 // Go to specified tab page, or next one if not clicking
+-		 // on a label.
+-		 goto_tabpage(c1);
+-
+-		 // It's like clicking on the status line of a window.
+-		 if (curwin != old_curwin)
++		 if ((mod_mask & MOD_MASK_MULTI_CLICK) == MOD_MASK_2CLICK)
++		 {
++			// double click opens new page
+ 			end_visual_mode_keep_button();
+-		}
+-	 }
+-	 else
+-	 {
+-		tabpage_T	*tp;
++			tabpage_new();
++			tabpage_move(c1 == 0 ? 9999 : c1 - 1);
++		 }
++		 else
++		 {
++			// Go to specified tab page, or next one if not clicking
++			// on a label.
++			goto_tabpage(c1);
 
-diff --git a/src/testdir/test_options.vim b/src/testdir/test_options.vim
-index 65600ee..d4213c1 100644
---- a/src/testdir/test_options.vim
-+++ b/src/testdir/test_options.vim
-@@ -263,6 +263,8 @@ func Test_set_errors()
- call assert_fails('set shiftwidth=-1', 'E487:')
- call assert_fails('set sidescroll=-1', 'E487:')
- call assert_fails('set tabstop=-1', 'E487:')
-+ call assert_fails('set tabstop=10000', 'E474:')
-+ call assert_fails('set tabstop=5500000000', 'E474:')
- call assert_fails('set textwidth=-1', 'E487:')
- call assert_fails('set timeoutlen=-1', 'E487:')
- call assert_fails('set updatecount=-1', 'E487:')
-diff --git a/src/vim.h b/src/vim.h
-index 68e2de1..cd917a3 100644
---- a/src/vim.h
-+++ b/src/vim.h
-@@ -2031,6 +2031,8 @@ typedef int sock_T;
+-		// Close the current or specified tab page.
+-		if (c1 == -999)
+-		 tp = curtab;
++			// It's like clicking on the status line of a window.
++			if (curwin != old_curwin)

_service:tar_scm:backport-CVE-2022-0443.patch -> _service:tar_scm:backport-CVE-2022-2982.patch Changed

@@ -1,91 +1,73 @@
-From 9b4a80a66544f2782040b641498754bcb5b8d461 Mon Sep 17 00:00:00 2001
+From d6c67629ed05aae436164eec474832daf8ba7420 Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 1 Feb 2022 13:54:17 +0000
-Subject: PATCH patch 8.2.4281: using freed memory with :lopen and :bwipe
+Date: Wed, 24 Aug 2022 20:07:22 +0100
+Subject: PATCH patch 9.0.0260: using freed memory when usinger
+ 'quickfixtextfunc' recursivelyxe
 
-Problem: Using freed memory with :lopen and :bwipe.
-Solution: Do not use a wiped out buffer.
+Problem: Using freed memory when using 'quickfixtextfunc' recursively.
+Solution: Do not allow for recursion.
 ---
- src/buffer.c | 14 ++++++++++----
- src/testdir/test_quickfix.vim | 16 ++++++++++++++++
- 2 files changed, 26 insertions(+), 4 deletions(-)
+ src/quickfix.c | 9 +++++++++
+ src/testdir/test_quickfix.vim | 13 +++++++++++++
+ 2 files changed, 22 insertions(+)
 
-diff --git a/src/buffer.c b/src/buffer.c
-index b4992dd..0f4957d 100644
---- a/src/buffer.c
-+++ b/src/buffer.c
-@@ -1666,6 +1666,7 @@ set_curbuf(buf_T *buf, int action)
- #endif
- bufref_T	newbufref;
- bufref_T	prevbufref;
-+ int		valid;
+diff --git a/src/quickfix.c b/src/quickfix.c
+index c37caa5..5547233 100644
+--- a/src/quickfix.c
++++ b/src/quickfix.c
+@@ -4656,6 +4656,11 @@ call_qftf_func(qf_list_T *qfl, int qf_winid, long start_idx, long end_idx)
+ {
+ callback_T	*cb = &qftf_cb;
+ list_T	*qftf_list = NULL;
++ static int	recursive = FALSE;
++
++ if (recursive)
++	return NULL; // this doesn't work properly recursively
++ recursive = TRUE;
+ 
+ // If 'quickfixtextfunc' is set, then use the user-supplied function to get
+ // the text to display. Use the local value of 'quickfixtextfunc' if it is
+@@ -4670,7 +4675,10 @@ call_qftf_func(qf_list_T *qfl, int qf_winid, long start_idx, long end_idx)
+ 
+ 	// create the dict argument
+ 	if ((d = dict_alloc_lock(VAR_FIXED)) == NULL)
++	{
++	 recursive = FALSE;
+ 	 return NULL;
++	}
+ 	dict_add_number(d, "quickfix", (long)IS_QF_LIST(qfl));
+ 	dict_add_number(d, "winid", (long)qf_winid);
+ 	dict_add_number(d, "id", (long)qfl->qf_id);
+@@ -4693,6 +4701,7 @@ call_qftf_func(qf_list_T *qfl, int qf_winid, long start_idx, long end_idx)
+ 	dict_unref(d);
+ }
+ 
++ recursive = FALSE;
+ return qftf_list;
+ }
 
- setpcmark();
- if (!cmdmod.keepalt)
-@@ -1717,13 +1718,19 @@ set_curbuf(buf_T *buf, int action)
- // An autocommand may have deleted "buf", already entered it (e.g., when
- // it did ":bunload") or aborted the script processing.
- // If curwin->w_buffer is null, enter_buffer() will make it valid again
-- if ((buf_valid(buf) && buf != curbuf
-+ valid = buf_valid(buf);
-+ if ((valid && buf != curbuf
- #ifdef FEAT_EVAL
- 		&& !aborting()
- #endif
- 	) || curwin->w_buffer == NULL)
- {
--	enter_buffer(buf);
-+	// If the buffer is not valid but curwin->w_buffer is NULL we must
-+	// enter some buffer. Using the last one is hopefully OK.
-+	if (!valid)
-+	 enter_buffer(lastbuf);
-+	else
-+	 enter_buffer(buf);
- #ifdef FEAT_SYN_HL
- 	if (old_tw != curbuf->b_p_tw)
- 	 check_colorcolumn(curwin);
-@@ -2236,8 +2243,7 @@ free_buf_options(
- clear_string_option(&buf->b_p_vsts);
- vim_free(buf->b_p_vsts_nopaste);
- buf->b_p_vsts_nopaste = NULL;
-- vim_free(buf->b_p_vsts_array);
-- buf->b_p_vsts_array = NULL;
-+ VIM_CLEAR(buf->b_p_vsts_array);
- clear_string_option(&buf->b_p_vts);
- VIM_CLEAR(buf->b_p_vts_array);
- #endif
 diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
-index f7c73f4..38a5236 100644
+index 182d570..46b2cb6 100644
 --- a/src/testdir/test_quickfix.vim
 +++ b/src/testdir/test_quickfix.vim
-@@ -876,6 +876,7 @@ func Test_locationlist_curwin_was_closed()
- call assert_fails('lrewind', 'E924:')
- 
- augroup! testgroup
-+ delfunc R
- endfunc
- 
- func Test_locationlist_cross_tab_jump()
-@@ -4674,4 +4675,19 @@ func Test_search_in_dirstack()
- call delete('Xtestdir', 'rf')
+@@ -6334,4 +6334,17 @@ func Test_qflist_statusmsg()
+ %bw!
 endfunc
 
-+" Weird sequence of commands that caused entering a wiped-out buffer
-+func Test_lopen_bwipe()
-+ func R()
-+ silent! tab lopen
-+ e x
-+ silent! lfile
++func Test_quickfixtextfunc_recursive()
++ func s:QFTfunc(o)
++ cgete '0'
 + endfunc
++ copen
++ let &quickfixtextfunc = 's:QFTfunc'
++ cex ""
 +
-+ cal R()
-+ cal R()
-+ cal R()
-+ bw!
-+ delfunc R
++ let &quickfixtextfunc = ''
++ cclose
 +endfunc
 +
++
 " vim: shiftwidth=2 sts=2 expandtab
 -- 
-2.27.0
+2.36.1

_service:tar_scm:backport-CVE-2022-0554.patch -> _service:tar_scm:backport-CVE-2022-3016.patch Changed

@@ -1,113 +1,151 @@
-From e3537aec2f8d6470010547af28dcbd83d41461b8 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 8 Feb 2022 15:05:20 +0000
-Subject: PATCH patch 8.2.4327: may end up with no current buffer
+From 6d24a51b94beb1991cddce221f90b455e2d50db7 Mon Sep 17 00:00:00 2001
+From: Yegappan Lakshmanan <yegappan@yahoo.com>
+Date: Sat, 27 Aug 2022 20:59:57 +0100
+Subject: PATCH patch 9.0.0286: using freed memory when location list changed
+ in autocmd
 
-Problem: May end up with no current buffer.
-Solution: When deleting the current buffer to not pick a quickfix buffer as
- the new current buffer
-
-Reference:https://github.com/vim/vim/commit/e3537aec2f8d6470010547af28dcbd83d41461b8
-Conflict:NA
+Problem: Using freed memory when location list changed in autocmd.
+Solution: Return QF_ABORT and handle it. (Yegappan Lakshmanan,
+ closes #10993)
 ---
- src/buffer.c | 26 ++++++++++++++++++++++----
- src/testdir/test_quickfix.vim | 25 +++++++++++++++++++++++++
- 2 files changed, 47 insertions(+), 4 deletions(-)
+ src/quickfix.c | 28 ++++++++++++++++++----------
+ src/testdir/test_quickfix.vim | 17 +++++++++++++++++
+ 2 files changed, 35 insertions(+), 10 deletions(-)
 
-diff --git a/src/buffer.c b/src/buffer.c
-index e5f6a9b..3617c63 100644
---- a/src/buffer.c
-+++ b/src/buffer.c
-@@ -1520,8 +1520,14 @@ do_buffer(
- 		buf = buflist_findnr(curwin->w_jumplistjumpidx.fmark.fnum);
- 		if (buf != NULL)
- 		{
--		 if (buf == curbuf || !buf->b_p_bl)
--			buf = NULL;	// skip current and unlisted bufs
-+		 // Skip current and unlisted bufs. Also skip a quickfix
-+		 // buffer, it might be deleted soon.
-+		 if (buf == curbuf || !buf->b_p_bl
-+#if defined(FEAT_QUICKFIX)
-+			 || bt_quickfix(buf)
-+#endif
-+			 )
-+			buf = NULL;
- 		 else if (buf->b_ml.ml_mfp == NULL)
- 		 {
- 			// skip unloaded buf, but may keep it for later
-@@ -1558,7 +1564,11 @@ do_buffer(
- 		 continue;
- 		}
- 		// in non-help buffer, try to skip help buffers, and vv
--		if (buf->b_help == curbuf->b_help && buf->b_p_bl)
-+		if (buf->b_help == curbuf->b_help && buf->b_p_bl
-+#if defined(FEAT_QUICKFIX)
-+			 && !bt_quickfix(buf)
-+#endif
-+			 )
- 		{
- 		 if (buf->b_ml.ml_mfp != NULL) // found loaded buffer
- 			break;
-@@ -1576,7 +1586,11 @@ do_buffer(
- 	if (buf == NULL)	// No loaded buffer, find listed one
+diff --git a/src/quickfix.c b/src/quickfix.c
+index 6af62e8..78f6880 100644
+--- a/src/quickfix.c
++++ b/src/quickfix.c
+@@ -594,6 +594,7 @@ enum {
+ QF_NOMEM = 3,
+ QF_IGNORE_LINE = 4,
+ QF_MULTISCAN = 5,
++ QF_ABORT = 6
+ };
+ 
+ /*
+@@ -3153,7 +3154,7 @@ qf_jump_to_usable_window(int qf_fnum, int newwin, int *opened_window)
+ /*
+ * Edit the selected file or help file.
+ * Returns OK if successfully edited the file, FAIL on failing to open the
+- * buffer and NOTDONE if the quickfix/location list was freed by an autocmd
++ * buffer and QF_ABORT if the quickfix/location list was freed by an autocmd
+ * when opening the buffer.
+ */
+ static int
+@@ -3199,14 +3200,14 @@ qf_jump_edit_buffer(
 	{
- 	 FOR_ALL_BUFFERS(buf)
--		if (buf->b_p_bl && buf != curbuf)
-+		if (buf->b_p_bl && buf != curbuf
-+#if defined(FEAT_QUICKFIX)
-+			 && !bt_quickfix(buf)
-+#endif
-+		 )
- 		 break;
- 	}
- 	if (buf == NULL)	// Still no buffer, just take one
-@@ -1585,6 +1599,10 @@ do_buffer(
- 		buf = curbuf->b_next;
- 	 else
- 		buf = curbuf->b_prev;
-+#if defined(FEAT_QUICKFIX)
-+	 if (bt_quickfix(buf))
-+		buf = NULL;
-+#endif
+ 	 emsg(_(e_current_window_was_closed));
+ 	 *opened_window = FALSE;
+-	 return NOTDONE;
++	 return QF_ABORT;
 	}
 }
 
+ if (qfl_type == QFLT_QUICKFIX && !qflist_valid(NULL, save_qfid))
+ {
+ 	emsg(_(e_current_quickfix_list_was_changed));
+-	return NOTDONE;
++	return QF_ABORT;
+ }
+ 
+ // Check if the list was changed. The pointers may happen to be identical,
+@@ -3219,7 +3220,7 @@ qf_jump_edit_buffer(
+ 	 emsg(_(e_current_quickfix_list_was_changed));
+ 	else
+ 	 emsg(_(e_current_location_list_was_changed));
+-	return NOTDONE;
++	return QF_ABORT;
+ }
+ 
+ return retval;
+@@ -3317,7 +3318,8 @@ qf_jump_print_msg(
+ * a new window.
+ * Returns OK if successfully jumped or opened a window. Returns FAIL if not
+ * able to jump/open a window. Returns NOTDONE if a file is not associated
+- * with the entry.
++ * with the entry. Returns QF_ABORT if the quickfix/location list was modified
++ * by an autocmd.
+ */
+ static int
+ qf_jump_open_window(
+@@ -3344,7 +3346,7 @@ qf_jump_open_window(
+ 	 emsg(_(e_current_quickfix_list_was_changed));
+ 	else
+ 	 emsg(_(e_current_location_list_was_changed));
+-	return FAIL;
++	return QF_ABORT;
+ }
+ 
+ // If currently in the quickfix window, find another window to show the
+@@ -3368,7 +3370,7 @@ qf_jump_open_window(
+ 	 emsg(_(e_current_quickfix_list_was_changed));
+ 	else
+ 	 emsg(_(e_current_location_list_was_changed));
+-	return FAIL;
++	return QF_ABORT;
+ }
+ 
+ return OK;
+@@ -3379,7 +3381,7 @@ qf_jump_open_window(
+ * particular line/column, adjust the folds and display a message about the
+ * jump.
+ * Returns OK on success and FAIL on failing to open the file/buffer. Returns
+- * NOTDONE if the quickfix/location list is freed by an autocmd when opening
++ * QF_ABORT if the quickfix/location list is freed by an autocmd when opening
+ * the file.
+ */
+ static int
+@@ -3508,14 +3510,20 @@ qf_jump_newwin(qf_info_T	*qi,
+ retval = qf_jump_open_window(qi, qf_ptr, newwin, &opened_window);
+ if (retval == FAIL)
+ 	goto failed;
++ if (retval == QF_ABORT)
++ {
++	qi = NULL;
++	qf_ptr = NULL;
++	goto theend;
++ }
+ if (retval == NOTDONE)
+ 	goto theend;
+ 
+ retval = qf_jump_to_buffer(qi, qf_index, qf_ptr, forceit, prev_winid,
+ 				 &opened_window, old_KeyTyped, print_message);
+- if (retval == NOTDONE)
++ if (retval == QF_ABORT)
+ {
+-	// Quickfix/location list is freed by an autocmd
++	// Quickfix/location list was modified by an autocmd
+ 	qi = NULL;
+ 	qf_ptr = NULL;
+ }
 diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
-index 38a5236..72f3172 100644
+index 762fa8d..31d36ef 100644
 --- a/src/testdir/test_quickfix.vim
 +++ b/src/testdir/test_quickfix.vim
-@@ -325,6 +325,31 @@ func Test_copenHeight_tabline()
- set tabline& showtabline&
+@@ -6363,5 +6363,22 @@ func Test_quickfixtextfunc_recursive()
+ cclose
 endfunc

_service:tar_scm:backport-CVE-2022-0572.patch -> _service:tar_scm:backport-CVE-2022-3037.patch Changed

@@ -1,66 +1,56 @@
-From 6e28703a8e41f775f64e442c5d11ce1ff599aa3f Mon Sep 17 00:00:00 2001
+From 4f1b083be43f351bc107541e7b0c9655a5d2c0bb Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Sat, 12 Feb 2022 15:42:18 +0000
-Subject: PATCH patch 8.2.4359: crash when repeatedly using :retab
+Date: Mon, 29 Aug 2022 20:45:16 +0100
+Subject: PATCH patch 9.0.0322: crash when no errors and 'quickfixtextfunc'
+ is set
 
-Problem: crash when repeatedly using :retab.
-Solution: Bail out when the line is getting too long.
+Problem: Crash when no errors and 'quickfixtextfunc' is set.
+Solution: Do not handle errors if there aren't any.
 ---
- src/indent.c | 5 +++++
- src/testdir/test_retab.vim | 20 ++++++++++++++++++++
- 2 files changed, 25 insertions(+)
+ src/quickfix.c | 2 +-
+ src/testdir/test_quickfix.vim | 16 ++++++++++++++++
+ 2 files changed, 17 insertions(+), 1 deletion(-)
 
-diff --git a/src/indent.c b/src/indent.c
-index e8e93b9..075802c 100644
---- a/src/indent.c
-+++ b/src/indent.c
-@@ -1689,6 +1689,11 @@ ex_retab(exarg_T *eap)
- 	 if (ptrcol == NUL)
- 		break;
- 	 vcol += chartabsize(ptr + col, (colnr_T)vcol);
-+	 if (vcol >= MAXCOL)
-+	 {
-+		emsg(_(e_resulting_text_too_long));
-+		break;
-+	 }
- 	 if (has_mbyte)
- 		col += (*mb_ptr2len)(ptr + col);
- 	 else
-diff --git a/src/testdir/test_retab.vim b/src/testdir/test_retab.vim
-index e7b8946..5376f92 100644
---- a/src/testdir/test_retab.vim
-+++ b/src/testdir/test_retab.vim
-@@ -69,6 +69,8 @@ func Test_retab()
- call assert_equal(" a b c ", Retab('!', 3))
- call assert_equal(" a b c ", Retab('', 5))
- call assert_equal(" a b c ", Retab('!', 5))
-+
-+ set tabstop& expandtab&
- endfunc
+diff --git a/src/quickfix.c b/src/quickfix.c
+index f6851ef..edf262c 100644
+--- a/src/quickfix.c
++++ b/src/quickfix.c
+@@ -4743,7 +4743,7 @@ qf_fill_buffer(qf_list_T *qfl, buf_T *buf, qfline_T *old_last, int qf_winid)
+ }
 
- func Test_retab_error()
-@@ -78,3 +80,21 @@ func Test_retab_error()
- call assert_fails('ret 10000', 'E475:')
- call assert_fails('ret 80000000000000000000', 'E475:')
+ // Check if there is anything to display
+- if (qfl != NULL)
++ if (qfl != NULL && qfl->qf_start != NULL)
+ {
+ 	char_u		dirnameMAXPATHL;
+ 	int		invalid_val = FALSE;
+diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
+index cf803ca..27bed51 100644
+--- a/src/testdir/test_quickfix.vim
++++ b/src/testdir/test_quickfix.vim
+@@ -4090,6 +4090,22 @@ func Xgetlist_empty_tests(cchar)
+ endif
 endfunc
-+
-+func Test_retab_endless()
-+ new
-+ call setline(1, "\t0\t")
-+ let caught = 'no'
-+ try
-+ while 1
-+ set ts=4000
-+ retab 4
-+ endwhile
-+ catch /E1240/
-+ let caught = 'yes'
-+ endtry
-+ bwipe!
-+ set tabstop&
+ 
++func Test_empty_list_quickfixtextfunc()
++ " This was crashing. Can only reproduce by running it in a separate Vim
++ " instance.
++ let lines =<< trim END
++ func s:Func(o)
++ cgetexpr '0'
++ endfunc
++ cope
++ let &quickfixtextfunc = 's:Func'
++ cgetfile ex
++ END
++ call writefile(lines, 'Xquickfixtextfunc')
++ call RunVim(, , '-e -s -S Xquickfixtextfunc -c qa')
++ call delete('Xquickfixtextfunc')
 +endfunc
 +
-+" vim: shiftwidth=2 sts=2 expandtab
+ func Test_getqflist()
+ call Xgetlist_empty_tests('c')
+ call Xgetlist_empty_tests('l')
 -- 
-2.27.0
+2.33.0

_service:tar_scm:backport-CVE-2022-0629.patch -> _service:tar_scm:backport-CVE-2022-3099.patch Changed

_service:tar_scm:backport-CVE-2022-0685.patch -> _service:tar_scm:backport-CVE-2022-3134.patch Changed

@@ -1,85 +1,69 @@
-From 5921aeb5741fc6e84c870d68c7c35b93ad0c9f87 Mon Sep 17 00:00:00 2001
+From ccfde4d028e891a41e3548323c3d47b06fb0b83e Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Sat, 19 Feb 2022 11:20:12 +0000
-Subject: PATCH patch 8.2.4418: crash when using special multi-byte character
+Date: Mon, 5 Sep 2022 19:51:13 +0100
+Subject: PATCH patch 9.0.0389: crash when 'tagfunc' closes the window
 
-Problem: Crash when using special multi-byte character.
-Solution: Don't use isalpha() for an arbitrary character.
+Problem: Crash when 'tagfunc' closes the window.
+Solution: Bail out when the window was closed.
 
-Conflict:
-upstream patches:
-+ call assert_fails('tc űŤŤŤ¦*', 'E344:')
-openEuler patches:
-+ call assert_fails('tc űŤŤŤ¦*', 'E472:')
 ---
- src/charset.c | 6 ++++++
- src/filepath.c | 2 +-
- src/proto/charset.pro | 2 +-
- src/testdir/test_autochdir.vim | 7 +++++++
- 4 files changed, 15 insertions(+), 2 deletions(-)
+ src/errors.h | 2 ++
+ src/tag.c | 10 ++++++++++
+ src/testdir/test_tagfunc.vim | 12 ++++++++++++
+ 3 files changed, 24 insertions(+)
 
-diff --git a/src/charset.c b/src/charset.c
-index a768c17..847a01a 100644
---- a/src/charset.c
-+++ b/src/charset.c
-@@ -1654,6 +1654,12 @@ vim_isupper(int c)
- return isupper(c);
- }
+diff --git a/src/errors.h b/src/errors.h
+index 43a1c9b..bfb4ae8 100644
+--- a/src/errors.h
++++ b/src/errors.h
+@@ -3304,3 +3304,5 @@ EXTERN char e_could_not_check_for_pending_sigalrm_str
+ EXTERN char e_substitute_nesting_too_deep
+ 	INIT(= N_("E1290: substitute nesting too deep"));
+ #endif
++EXTERN char e_window_unexpectedly_close_while_searching_for_tags
++	INIT(= N_("E1299: Window unexpectedly closed while searching for tags"));
+diff --git a/src/tag.c b/src/tag.c
+index 8edb0c7..b4915cb 100644
+--- a/src/tag.c
++++ b/src/tag.c
+@@ -690,6 +690,16 @@ do_tag(
+ 		max_num_matches = MAXCOL; // If less than max_num_matches
+ 					 // found: all matches found.
 
-+ int
-+vim_isalpha(int c)
-+{
-+ return vim_islower(c) || vim_isupper(c);
-+}
++		// A tag function may do anything, which may cause various
++	 // information to become invalid. At least check for the tagstack
++	 // to still be the same.
++	 if (tagstack != curwin->w_tagstack)
++	 {
++		emsg(_(e_window_unexpectedly_close_while_searching_for_tags));
++		FreeWild(new_num_matches, new_matches);
++		break;
++	 }
 +
- int
- vim_toupper(int c)
- {
-diff --git a/src/filepath.c b/src/filepath.c
-index 01d2dcb..c7f0265 100644
---- a/src/filepath.c
-+++ b/src/filepath.c
-@@ -3300,7 +3300,7 @@ unix_expandpath(
- 	else if (path_end >= path + wildoff
- 			 && (vim_strchr((char_u *)"*?{~$", *path_end) != NULL
- 			 || (!p_fic && (flags & EW_ICASE)
--					 && isalpha(PTR2CHAR(path_end)))))
-+					 && vim_isalpha(PTR2CHAR(path_end)))))
- 	 e = p;
- 	if (has_mbyte)
- 	{
-diff --git a/src/proto/charset.pro b/src/proto/charset.pro
-index c582a8c..2a928e3 100644
---- a/src/proto/charset.pro
-+++ b/src/proto/charset.pro
-@@ -47,6 +47,7 @@ int vim_isxdigit(int c);
- int vim_isbdigit(int c);
- int vim_islower(int c);
- int vim_isupper(int c);
-+int vim_isalpha(int c);
- int vim_toupper(int c);
- int vim_tolower(int c);
- char_u *skiptowhite(char_u *p);
-@@ -59,5 +60,4 @@ int hexhex2nr(char_u *p);
- int rem_backslash(char_u *str);
- void backslash_halve(char_u *p);
- char_u *backslash_halve_save(char_u *p);
--void ebcdic2ascii(char_u *buffer, int len);
- /* vim: set ft=c : */
-diff --git a/src/testdir/test_autochdir.vim b/src/testdir/test_autochdir.vim
-index 1473854..99fc9ae 100644
---- a/src/testdir/test_autochdir.vim
-+++ b/src/testdir/test_autochdir.vim
-@@ -24,3 +24,10 @@ func Test_set_filename()
- call chdir(cwd)
- call delete('samples/Xtest')
+ 	 // If there already were some matches for the same name, move them
+ 	 // to the start. Avoids that the order changes when using
+ 	 // ":tnext" and jumping to another file.
+diff --git a/src/testdir/test_tagfunc.vim b/src/testdir/test_tagfunc.vim
+index 9582612..c10a82d 100644
+--- a/src/testdir/test_tagfunc.vim
++++ b/src/testdir/test_tagfunc.vim
+@@ -401,4 +401,16 @@ func Test_tagfunc_wipes_buffer()
+ set tagfunc=
 endfunc
+ 
++func Test_tagfunc_closes_window()
++ split any
++ func MytagfuncClose(pat, flags, info)
++ close
++ return {'name' : 'mytag', 'filename' : 'Xtest', 'cmd' : '1'}
++ endfunc
++ set tagfunc=MytagfuncClose
++ call assert_fails('tag xyz', 'E1299:')
 +
-+func Test_multibyte()
-+ " using an invalid character should not cause a crash
-+ set wic
-+ call assert_fails('tc űŤŤŤ¦*', 'E472:')
-+ set nowic
++ set tagfunc=
 +endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
 -- 
-2.27.0
+2.33.0
+

_service:tar_scm:backport-CVE-2022-0714.patch -> _service:tar_scm:backport-CVE-2022-3153.patch Changed

@@ -1,51 +1,87 @@
-From 4e889f98e95ac05d7c8bd3ee933ab4d47820fdfa Mon Sep 17 00:00:00 2001
+From 1540d334a04d874c2aa9d26b82dbbcd4bc5a78de Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Mon, 21 Feb 2022 19:36:12 +0000
-Subject: PATCH patch 8.2.4436: crash with weird 'vartabstop' value
-
-Problem: Crash with weird 'vartabstop' value.
-Solution: Check for running into the end of the line.
+Date: Wed, 7 Sep 2022 15:20:26 +0100
+Subject: PATCH patch 9.0.0404: crash when passing invalid arguments to
+ assert_fails()
 
+Problem: Crash when passing invalid arguments to assert_fails().
+Solution: Check for NULL string.
 ---
- src/indent.c | 2 ++
- src/testdir/test_vartabs.vim | 14 ++++++++++++++
- 2 files changed, 16 insertions(+)
+ src/testdir/test_assert.vim | 19 +++++++++++++++++--
+ src/testing.c | 9 +++++++++
+ 2 files changed, 26 insertions(+), 2 deletions(-)
 
-diff --git a/src/indent.c b/src/indent.c
-index 075802c..6b8900f 100644
---- a/src/indent.c
-+++ b/src/indent.c
-@@ -1279,6 +1279,8 @@ change_indent(
- 		new_cursor_col += (*mb_ptr2len)(ptr + new_cursor_col);
- 	 else
- 		++new_cursor_col;
-+	 if (ptrnew_cursor_col == NUL)
-+		break;
- 	 vcol += lbr_chartabsize(ptr, ptr + new_cursor_col, (colnr_T)vcol);
- 	}
- 	vcol = last_vcol;
-diff --git a/src/testdir/test_vartabs.vim b/src/testdir/test_vartabs.vim
-index 47844fb..c2919d8 100644
---- a/src/testdir/test_vartabs.vim
-+++ b/src/testdir/test_vartabs.vim
-@@ -378,3 +378,17 @@ func Test_vartabs_reset()
- set all&
- call assert_equal('', &vts)
- endfunc
+diff --git a/src/testdir/test_assert.vim b/src/testdir/test_assert.vim
+index 7c9d090..9d8a018 100644
+--- a/src/testdir/test_assert.vim
++++ b/src/testdir/test_assert.vim
+@@ -278,6 +278,21 @@ func Test_assert_fail_fails()
+ endtry
+ call assert_match("E1222: String or List required for argument 2", exp)
+ 
++ try
++ call assert_equal(0, assert_fails('xxx', #{one: 1}))
++ catch
++ let exp = v:exception
++ endtry
++ call assert_match("E731: Using a Dictionary as a String", exp)
 +
-+func Test_vartabstop_latin1()
-+ let save_encoding = &encoding
-+ new
-+ set encoding=iso8859
-+ silent norm :se &#x1;&#x1b;
-+ set vartabstop=400
-+ norm i00	&#x4;
-+ bwipe!
-+ let &encoding = save_encoding
-+endfunc
++ let exp = ''
++ try
++ call assert_equal(0, assert_fails('xxx', 'E492', #{one: 1}))
++ catch
++ let exp = v:exception
++ endtry
++ call assert_match("E731: Using a Dictionary as a String", exp)
++
+ try
+ call assert_equal(1, assert_fails('xxx', 'E492', '', 'burp'))
+ catch
+@@ -292,8 +307,8 @@ func Test_assert_fail_fails()
+ endtry
+ call assert_match("E1174: String required for argument 5", exp)
+ 
+- call assert_equal(1, assert_fails('c0', '', '\1'))
+- call assert_match("Expected '\\\\\\\\1' but got 'E939: Positive count required: c0': c0", v:errors0)
++ call assert_equal(1, assert_fails('c0', '', '$.$\1'))
++ call assert_match("Expected '\\\\\\\$.\\\\\\\$\\\\\\\\1' but got 'E939: Positive count required: c0': c0", v:errors0)
+ call remove(v:errors, 0)
+ endfunc
+ 
+diff --git a/src/testing.c b/src/testing.c
+index 43b8d20..b4c4ff4 100644
+--- a/src/testing.c
++++ b/src/testing.c
+@@ -616,6 +616,11 @@ f_assert_fails(typval_T *argvars, typval_T *rettv)
+ in_assert_fails = TRUE;
+ 
+ do_cmdline_cmd(cmd);
 +
++ // reset here for any errors reported below
++ trylevel = save_trylevel;
++ suppress_errthrow = FALSE;
 +
-+" vim: shiftwidth=2 sts=2 expandtab
+ if (called_emsg == called_emsg_before)
+ {
+ 	prepare_assert_error(&ga);
+@@ -654,6 +659,8 @@ f_assert_fails(typval_T *argvars, typval_T *rettv)
+ 	 CHECK_LIST_MATERIALIZE(list);
+ 	 tv = &list->lv_first->li_tv;
+ 	 expected = tv_get_string_buf_chk(tv, buf);
++	 if (expected == NULL)
++		goto theend;
+ 	 if (!pattern_match(expected, actual, FALSE))
+ 	 {
+ 		error_found = TRUE;
+@@ -667,6 +674,8 @@ f_assert_fails(typval_T *argvars, typval_T *rettv)
+ 		{
+ 		 tv = &list->lv_u.mat.lv_last->li_tv;
+ 		 expected = tv_get_string_buf_chk(tv, buf);
++		 if (expected == NULL)
++			goto theend;
+ 		 if (!pattern_match(expected, actual, FALSE))
+ 		 {
+ 			error_found = TRUE;
 -- 
 2.27.0

_service:tar_scm:backport-CVE-2022-0729.patch -> _service:tar_scm:backport-CVE-2022-3234.patch Changed

@@ -1,47 +1,78 @@
-From 6456fae9ba8e72c74b2c0c499eaf09974604ff30 Mon Sep 17 00:00:00 2001
+From c249913edc35c0e666d783bfc21595cf9f7d9e0d Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 22 Feb 2022 13:37:31 +0000
-Subject: PATCH patch 8.2.4440: crash with specific regexp pattern and string
-
-Problem: Crash with specific regexp pattern and string.
-Solution: Stop at the start of the string.
+Date: Fri, 16 Sep 2022 22:16:59 +0100
+Subject: PATCH patch 9.0.0483: illegal memory access when replacing in
+ virtualedit mode
 
+Problem: Illegal memory access when replacing in virtualedit mode.
+Solution: Check for replacing NUL after Tab.
 ---
- src/regexp_bt.c | 5 +++++
- src/testdir/test_regexp_utf8.vim | 7 +++++++
- 2 files changed, 12 insertions(+)
+ src/ops.c | 12 ++++++++++--
+ src/testdir/test_virtualedit.vim | 14 ++++++++++++++
+ 2 files changed, 24 insertions(+), 2 deletions(-)
 
-diff --git a/src/regexp_bt.c b/src/regexp_bt.c
-index b71b862..e017ba5 100644
---- a/src/regexp_bt.c
-+++ b/src/regexp_bt.c
-@@ -4431,6 +4431,11 @@ regmatch(
- 			 if (rex.input == rex.line)
- 			 {
- 				// backup to last char of previous line
-+				if (rex.lnum == 0)
-+				{
-+				 status = RA_NOMATCH;
-+				 break;
-+				}
- 				--rex.lnum;
- 				rex.line = reg_getline(rex.lnum);
- 				// Just in case regrepeat() didn't count
-diff --git a/src/testdir/test_regexp_utf8.vim b/src/testdir/test_regexp_utf8.vim
-index 6d0ce59..5d1bd47 100644
---- a/src/testdir/test_regexp_utf8.vim
-+++ b/src/testdir/test_regexp_utf8.vim
-@@ -223,3 +223,10 @@ func Test_match_invalid_byte()
- call delete('Xinvalid')
+diff --git a/src/ops.c b/src/ops.c
+index b930878..33cbd8e 100644
+--- a/src/ops.c
++++ b/src/ops.c
+@@ -1160,6 +1160,8 @@ op_replace(oparg_T *oap, int c)
+ 
+ 	while (LTOREQ_POS(curwin->w_cursor, oap->end))
+ 	{
++	 int done = FALSE;
++
+ 	 n = gchar_cursor();
+ 	 if (n != NUL)
+ 	 {
+@@ -1173,6 +1175,7 @@ op_replace(oparg_T *oap, int c)
+ 		 if (curwin->w_cursor.lnum == oap->end.lnum)
+ 			oap->end.col += new_byte_len - old_byte_len;
+ 		 replace_character(c);
++		 done = TRUE;
+ 		}
+ 		else
+ 		{
+@@ -1191,10 +1194,15 @@ op_replace(oparg_T *oap, int c)
+ 			if (curwin->w_cursor.lnum == oap->end.lnum)
+ 			 getvpos(&oap->end, end_vcol);
+ 		 }
+-		 PBYTE(curwin->w_cursor, c);
++		 // with "coladd" set may move to just after a TAB
++		 if (gchar_cursor() != NUL)
++		 {
++			PBYTE(curwin->w_cursor, c);
++			done = TRUE;
++		 }
+ 		}
+ 	 }
+-	 else if (virtual_op && curwin->w_cursor.lnum == oap->end.lnum)
++	 if (!done && virtual_op && curwin->w_cursor.lnum == oap->end.lnum)
+ 	 {
+ 		int virtcols = oap->end.coladd;
+ 
+diff --git a/src/testdir/test_virtualedit.vim b/src/testdir/test_virtualedit.vim
+index b31f3a2..0031b22 100644
+--- a/src/testdir/test_virtualedit.vim
++++ b/src/testdir/test_virtualedit.vim
+@@ -537,4 +537,18 @@ func Test_global_local_virtualedit()
+ set virtualedit&
 endfunc
 
-+func Test_match_too_complicated()
-+ set regexpengine=1
-+ exe "vsplit \xeb\xdb\x99"
-+ silent! buf \&\zs*\zs*0
++" this was replacing the NUL at the end of the line 
++func Test_virtualedit_replace_after_tab()
++ new
++ s/\v/	0
++ set ve=all
++ let @" = ''
++ sil! norm vPvr0
++ 
++ call assert_equal("\t0", getline(1))
++ set ve&
 + bwipe!
-+ set regexpengine=0
 +endfunc
++
++
+ " vim: shiftwidth=2 sts=2 expandtab
 -- 
 2.27.0

_service:tar_scm:backport-CVE-2022-0943.patch -> _service:tar_scm:backport-CVE-2022-3235.patch Changed

@@ -1,57 +1,75 @@
-From 5c68617d395f9d7b824f68475b24ce3e38d653a3 Mon Sep 17 00:00:00 2001
+From 1c3dd8ddcba63c1af5112e567215b3cec2de11d0 Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Sun, 13 Mar 2022 20:12:25 +0000
-Subject: PATCH patch 8.2.4563: "z=" in Visual mode may go beyond the end of
- the line
+Date: Sat, 17 Sep 2022 19:43:23 +0100
+Subject: PATCH patch 9.0.0490: using freed memory with cmdwin and BufEnter
+ autocmd
 
-Problem: "z=" in Visual mode may go beyond the end of the line.
-Solution: Adjust "badlen".
+Problem: Using freed memory with cmdwin and BufEnter autocmd.
+Solution: Make sure pointer to b_p_iminsert is still valid.
 ---
- src/spellsuggest.c | 4 ++++
- src/testdir/test_spell.vim | 15 +++++++++++++++
- 2 files changed, 19 insertions(+)
+ src/ex_getln.c | 8 ++++++--
+ src/testdir/test_cmdline.vim | 10 ++++++++++
+ 2 files changed, 16 insertions(+), 2 deletions(-)
 
-diff --git a/src/spellsuggest.c b/src/spellsuggest.c
-index cd28798..429e292 100644
---- a/src/spellsuggest.c
-+++ b/src/spellsuggest.c
-@@ -501,6 +501,10 @@ spell_suggest(int count)
- 	 curwin->w_cursor.col = VIsual.col;
- 	++badlen;
- 	end_visual_mode();
-+	// make sure we don't include the NUL at the end of the line
-+	line = ml_get_curline();
-+	if (badlen > STRLEN(line) - curwin->w_cursor.col)
-+	 badlen = STRLEN(line) - curwin->w_cursor.col;
- }
- // Find the start of the badly spelled word.
- else if (spell_move_to(curwin, FORWARD, TRUE, TRUE, NULL) == 0
-diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
-index de49b42..49118a9 100644
---- a/src/testdir/test_spell.vim
-+++ b/src/testdir/test_spell.vim
-@@ -131,6 +131,21 @@ func Test_spellreall()
- bwipe!
+diff --git a/src/ex_getln.c b/src/ex_getln.c
+index 8dc03dc..535bfb5 100644
+--- a/src/ex_getln.c
++++ b/src/ex_getln.c
+@@ -1607,6 +1607,7 @@ getcmdline_int(
+ #endif
+ expand_T	xpc;
+ long	*b_im_ptr = NULL;
++ buf_T	*b_im_ptr_buf = NULL;	// buffer where b_im_ptr is valid
+ cmdline_info_T save_ccline;
+ int		did_save_ccline = FALSE;
+ int		cmdline_type;
+@@ -1703,6 +1704,7 @@ getcmdline_int(
+ 	 b_im_ptr = &curbuf->b_p_iminsert;
+ 	else
+ 	 b_im_ptr = &curbuf->b_p_imsearch;
++	b_im_ptr_buf = curbuf;
+ 	if (*b_im_ptr == B_IMODE_LMAP)
+ 	 State |= MODE_LANGMAP;
+ #ifdef HAVE_INPUT_METHOD
+@@ -2060,7 +2062,8 @@ getcmdline_int(
+ 		goto cmdline_not_changed;
+ 
+ 	case Ctrl_HAT:
+-		cmdline_toggle_langmap(b_im_ptr);
++		cmdline_toggle_langmap(
++				 buf_valid(b_im_ptr_buf) ? b_im_ptr : NULL);
+ 		goto cmdline_not_changed;
+ 
+ //	case '@': only in very old vi
+@@ -2573,7 +2576,8 @@ returncmd:
+ #endif
+ 
+ #ifdef HAVE_INPUT_METHOD
+- if (b_im_ptr != NULL && *b_im_ptr != B_IMODE_LMAP)
++ if (b_im_ptr != NULL && buf_valid(b_im_ptr_buf)
++						 && *b_im_ptr != B_IMODE_LMAP)
+ 	im_save_status(b_im_ptr);
+ im_set_active(FALSE);
+ #endif
+diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
+index 08e2de7..440df96 100644
+--- a/src/testdir/test_cmdline.vim
++++ b/src/testdir/test_cmdline.vim
+@@ -3447,4 +3447,14 @@ func Test_cmdwin_virtual_edit()
+ set ve= cpo-=$
 endfunc
 
-+func Test_spellsuggest_visual_end_of_line()
-+ let enc_save = &encoding
-+ set encoding=iso8859
-+
-+ " This was reading beyond the end of the line.
-+ norm R00000000000
-+ sil norm &#x16;0
-+ sil! norm &#x16;i00000)
-+ sil! norm &#x16;i00000)
-+ call feedkeys("\<CR>")
-+ norm z=
++" This was using a pointer to a freed buffer
++func Test_cmdwin_freed_buffer_ptr()
++ au BufEnter * next 0| file &#xb;
++ edit 0
++ silent! norm q/
 +
-+ let &encoding = enc_save
++ au! BufEnter
++ bwipe!
 +endfunc
 +
- func Test_spellinfo()
- new
- let runtime = substitute($VIMRUNTIME, '\\', '/', 'g')
+ " vim: shiftwidth=2 sts=2 expandtab
 -- 
 2.27.0

_service:tar_scm:backport-CVE-2022-1154.patch -> _service:tar_scm:backport-CVE-2022-3256.patch Changed

@@ -1,59 +1,66 @@
-From b55986c52d4cd88a22d0b0b0e8a79547ba13e1d5 Mon Sep 17 00:00:00 2001
+From 8ecfa2c56b4992c7f067b92488aa9acea5a454ad Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 29 Mar 2022 13:24:58 +0100
-Subject: PATCH patch 8.2.4646: using buffer line after it has been freed
+Date: Wed, 21 Sep 2022 13:07:22 +0100
+Subject: PATCH patch 9.0.0530: using freed memory when autocmd changes mark
 
-Problem: Using buffer line after it has been freed in old regexp engine.
-Solution: After getting mark get the line again.
+Problem: Using freed memory when autocmd changes mark.
+Solution: Copy the mark before editing another buffer.
 ---
- src/regexp_bt.c | 9 +++++++++
- src/testdir/test_regexp_latin.vim | 7 +++++++
- 2 files changed, 16 insertions(+)
+ src/mark.c | 12 +++++++-----
+ src/testdir/test_marks.vim | 13 +++++++++++++
+ 2 files changed, 20 insertions(+), 5 deletions(-)
 
-diff --git a/src/regexp_bt.c b/src/regexp_bt.c
-index e017ba5..ff92576 100644
---- a/src/regexp_bt.c
-+++ b/src/regexp_bt.c
-@@ -3188,8 +3188,17 @@ regmatch(
- 		int	mark = OPERAND(scan)0;
- 		int	cmp = OPERAND(scan)1;
- 		pos_T	*pos;
-+		size_t	col = REG_MULTI ? rex.input - rex.line : 0;
- 
- 		pos = getmark_buf(rex.reg_buf, mark, FALSE);
-+
-+		// Line may have been freed, get it again.
-+		if (REG_MULTI)
-+		{
-+		 rex.line = reg_getline(rex.lnum);
-+		 rex.input = rex.line + col;
-+		}
+diff --git a/src/mark.c b/src/mark.c
+index ade5a10..584db03 100644
+--- a/src/mark.c
++++ b/src/mark.c
+@@ -221,17 +221,19 @@ movemark(int count)
+ 	 fname2fnum(jmp);
+ 	if (jmp->fmark.fnum != curbuf->b_fnum)
+ 	{
+-	 // jump to other file
+-	 if (buflist_findnr(jmp->fmark.fnum) == NULL)
++	 // Make a copy, an autocommand may make "jmp" invalid.
++	 fmark_T fmark = jmp->fmark;
 +
- 		if (pos == NULL		 // mark doesn't exist
- 			|| pos->lnum <= 0 // mark isn't set in reg_buf
- 			|| (pos->lnum == rex.lnum + rex.reg_firstlnum
-diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim
-index 5b1db5a..a242d91 100644
---- a/src/testdir/test_regexp_latin.vim
-+++ b/src/testdir/test_regexp_latin.vim
-@@ -152,10 +152,17 @@ endfunc
++	 // jump to the file with the mark
++	 if (buflist_findnr(fmark.fnum) == NULL)
+ 	 {					 // Skip this one ..
+ 		count += count < 0 ? -1 : 1;
+ 		continue;
+ 	 }
+-	 if (buflist_getfile(jmp->fmark.fnum, jmp->fmark.mark.lnum,
+-							 0, FALSE) == FAIL)
++	 if (buflist_getfile(fmark.fnum, fmark.mark.lnum, 0, FALSE) == FAIL)
+ 		return (pos_T *)NULL;
+ 	 // Set lnum again, autocommands my have changed it
+-	 curwin->w_cursor = jmp->fmark.mark;
++	 curwin->w_cursor = fmark.mark;
+ 	 pos = (pos_T *)-1;
+ 	}
+ 	else
+diff --git a/src/testdir/test_marks.vim b/src/testdir/test_marks.vim
+index 12501a3..20fb304 100644
+--- a/src/testdir/test_marks.vim
++++ b/src/testdir/test_marks.vim
+@@ -305,4 +305,17 @@ func Test_getmarklist()
+ close!
+ endfunc
 
- func Test_using_mark_position()
- " this was using freed memory
-+ " new engine
- new
- norm O0
- call assert_fails("s/\\%')", 'E486:')
- bwipe!
++" This was using freed memory
++func Test_jump_mark_autocmd()
++ next 00
++ edit 0
++ sargument
++ au BufEnter 0 all
++ sil norm &#xf;&#xf;
 +
-+ " old engine
-+ new
-+ norm O0
-+ call assert_fails("s/\\%#=1\\%')", 'E486:')
++ au! BufEnter
 + bwipe!
- endfunc
- 
- func Test_using_invalid_visual_position()
++endfunc
++
++
+ " vim: shiftwidth=2 sts=2 expandtab
 -- 
-1.8.3.1
+2.27.0

_service:tar_scm:backport-CVE-2022-1616.patch -> _service:tar_scm:backport-CVE-2022-3278.patch Changed

@@ -1,57 +1,55 @@
-From d88934406c5375d88f8f1b65331c9f0cab68cc6c Mon Sep 17 00:00:00 2001
+From 69082916c8b5d321545d60b9f5facad0a2dd5a4e Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Fri, 6 May 2022 20:38:47 +0100
-Subject: PATCH patch 8.2.4895: buffer overflow with invalid command with
- composing chars
+Date: Thu, 22 Sep 2022 21:35:19 +0100
+Subject: PATCH patch 9.0.0552: crash when using NUL in buffer that uses
+ :source
 
-Problem: Buffer overflow with invalid command with composing chars.
-Solution: Check that the whole character fits in the buffer.
+Problem: Crash when using NUL in buffer that uses :source.
+Solution: Don't get a next line when skipping over NL.
 ---
- src/ex_docmd.c | 4 +++-
- src/testdir/test_cmdline.vim | 11 +++++++++++
- 2 files changed, 14 insertions(+), 1 deletion(-)
+ src/eval.c | 2 +-
+ src/testdir/test_source.vim | 17 +++++++++++++++++
+ 2 files changed, 18 insertions(+), 1 deletion(-)
 
-diff --git a/src/ex_docmd.c b/src/ex_docmd.c
-index dfcbf37..f142c46 100644
---- a/src/ex_docmd.c
-+++ b/src/ex_docmd.c
-@@ -3092,7 +3092,7 @@ append_command(char_u *cmd)
+diff --git a/src/eval.c b/src/eval.c
+index 60daca5..8df374a 100644
+--- a/src/eval.c
++++ b/src/eval.c
+@@ -2278,7 +2278,7 @@ eval_next_non_blank(char_u *arg, evalarg_T *evalarg, int *getnext)
 
- STRCAT(IObuff, ": ");
- d = IObuff + STRLEN(IObuff);
-- while (*s != NUL && d - IObuff < IOSIZE - 7)
-+ while (*s != NUL && d - IObuff + 5 < IOSIZE)
- {
- 	if (enc_utf8 ? (s0 == 0xc2 && s1 == 0xa0) : *s == 0xa0)
+ 	if (next != NULL)
 	{
-@@ -3100,6 +3100,8 @@ append_command(char_u *cmd)
- 	 STRCPY(d, "<a0>");
- 	 d += 4;
+-	 *getnext = TRUE;
++	 *getnext = *p != NL;
+ 	 return skipwhite(next);
 	}
-+	else if (d - IObuff + (*mb_ptr2len)(s) + 1 >= IOSIZE)
-+	 break;
- 	else
- 	 MB_COPY_CHAR(s, d);
 }
-diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
-index 5297951..41a73d2 100644
---- a/src/testdir/test_cmdline.vim
-+++ b/src/testdir/test_cmdline.vim
-@@ -870,4 +870,15 @@ func Test_cmdwin_cedit()
- delfunc CmdWinType
+diff --git a/src/testdir/test_source.vim b/src/testdir/test_source.vim
+index 4736e93..d6aed57 100644
+--- a/src/testdir/test_source.vim
++++ b/src/testdir/test_source.vim
+@@ -665,5 +665,22 @@ func Test_source_buffer_long_line()
+ call delete('Xtest.vim')
 endfunc
 
-+" this was going over the end of IObuff
-+func Test_report_error_with_composing()
-+ let caught = 'no'
-+ try
-+ exe repeat('0', 987) .. "0\xdd\x80\xdd\x80\xdd\x80\xdd\x80"
-+ catch /E492:/
-+ let caught = 'yes'
-+ endtry
-+ call assert_equal('yes', caught)
++func Test_source_buffer_with_NUL_char()
++ " This was trying to use a line below the buffer.
++ let lines =<< trim END
++ if !exists('g:loaded')
++ let g:loaded = 1
++ source
++ endif
++ END
++ " Can't have a NL in heredoc
++ let lines += "silent! vim9 echo 0 \<NL> ? 'a' : 'b'"
++ call writefile(lines, 'XsourceNul', '')
++ edit XsourceNul
++ source
++
++ bwipe!
 +endfunc
 +
+ 
 " vim: shiftwidth=2 sts=2 expandtab
 -- 
 2.27.0

_service:tar_scm:backport-CVE-2022-1619.patch -> _service:tar_scm:backport-CVE-2022-3296.patch Changed

@@ -1,53 +1,634 @@
-From ef02f16609ff0a26ffc6e20263523424980898fe Mon Sep 17 00:00:00 2001
+From 96b9bf8f74af8abf1e30054f996708db7dc285be Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Sat, 7 May 2022 10:49:10 +0100
-Subject: PATCH patch 8.2.4899: with latin1 encoding CTRL-W might go before
- the cmdline
+Date: Sat, 24 Sep 2022 17:24:12 +0100
+Subject: patch 9.0.0577: buffer underflow with unexpected :finally
 
-Problem: With latin1 encoding CTRL-W might go before the start of the
-command line.
-Solution: Check already being at the start of the command line.
+Problem: Buffer underflow with unexpected :finally.
+Solution: Check CSF_TRY can be found.
 ---
- src/ex_getln.c | 11 +++++++----
- src/testdir/test_cmdline.vim | 3 +++
- 2 files changed, 10 insertions(+), 4 deletions(-)
+ src/ex_eval.c | 523 +++++++++++++++++-----------------
+ src/testdir/test_trycatch.vim | 22 ++
+ 2 files changed, 282 insertions(+), 263 deletions(-)
 
-diff --git a/src/ex_getln.c b/src/ex_getln.c
-index 68b4757..771a9cd 100644
---- a/src/ex_getln.c
-+++ b/src/ex_getln.c
-@@ -1583,10 +1583,13 @@ getcmdline_int(
- 		 {
- 			while (p > ccline.cmdbuff && vim_isspace(p-1))
- 			 --p;
--			i = vim_iswordc(p-1);
--			while (p > ccline.cmdbuff && !vim_isspace(p-1)
--				&& vim_iswordc(p-1) == i)
--			 --p;
-+			if (p > ccline.cmdbuff)
-+			{
-+				i = vim_iswordc(p-1);
-+				while (p > ccline.cmdbuff && !vim_isspace(p-1)
-+					&& vim_iswordc(p-1) == i)
-+			 	 --p;
-+			}
- 		 }
- 		 else
- 			--p;
-diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
-index cbf7986..1ccdbe2 100644
---- a/src/testdir/test_cmdline.vim
-+++ b/src/testdir/test_cmdline.vim
-@@ -476,6 +476,9 @@ func Test_cmdline_remove_char()
- 
- call feedkeys(":abc def\<S-Left>\<C-U>\<C-B>\"\<CR>", 'tx')
- call assert_equal('"def', @:, e)
-+
-+ " This was going before the start in latin1.
-+ call feedkeys(": \<C-W>\<CR>", 'tx')
- endfor
- 
- let &encoding = encoding_save
+diff --git a/src/ex_eval.c b/src/ex_eval.c
+index 5721b766e..77d6e8bb9 100644
+--- a/src/ex_eval.c
++++ b/src/ex_eval.c
+@@ -1935,128 +1935,127 @@ ex_finally(exarg_T *eap)
+ if (cmdmod_error(FALSE))
+ 	return;
+ 
+- if (cstack->cs_trylevel <= 0 || cstack->cs_idx < 0)
++ for (idx = cstack->cs_idx; idx >= 0; --idx)
++	if (cstack->cs_flagsidx & CSF_TRY)
++	 break;
++ if (cstack->cs_trylevel <= 0 || idx < 0)
++ {
+ 	eap->errmsg = _(e_finally_without_try);
+- else
++	return;
++ }
++
++ if (!(cstack->cs_flagscstack->cs_idx & CSF_TRY))
+ {
+-	if (!(cstack->cs_flagscstack->cs_idx & CSF_TRY))
+-	{
+-	 eap->errmsg = get_end_emsg(cstack);
+-	 for (idx = cstack->cs_idx - 1; idx > 0; --idx)
+-		if (cstack->cs_flagsidx & CSF_TRY)
+-		 break;
+-	 // Make this error pending, so that the commands in the following
+-	 // finally clause can be executed. This overrules also a pending
+-	 // ":continue", ":break", ":return", or ":finish".
+-	 pending = CSTP_ERROR;
+-	}
+-	else
+-	 idx = cstack->cs_idx;
++	eap->errmsg = get_end_emsg(cstack);
++	// Make this error pending, so that the commands in the following
++	// finally clause can be executed. This overrules also a pending
++	// ":continue", ":break", ":return", or ":finish".
++	pending = CSTP_ERROR;
++ }
+ 
+-	if (cstack->cs_flagsidx & CSF_FINALLY)
++ if (cstack->cs_flagsidx & CSF_FINALLY)
++ {
++	// Give up for a multiple ":finally" and ignore it.
++	eap->errmsg = _(e_multiple_finally);
++	return;
++ }
++ rewind_conditionals(cstack, idx, CSF_WHILE | CSF_FOR,
++						 &cstack->cs_looplevel);
++
++ /*
++ * Don't do something when the corresponding try block never got active
++ * (because of an inactive surrounding conditional or after an error or
++ * interrupt or throw) or for a ":finally" without ":try" or a multiple
++ * ":finally". After every other error (did_emsg or the conditional
++ * errors detected above) or after an interrupt (got_int) or an
++ * exception (did_throw), the finally clause must be executed.
++ */
++ skip = !(cstack->cs_flagscstack->cs_idx & CSF_TRUE);
++
++ if (!skip)
++ {
++	// When debugging or a breakpoint was encountered, display the
++	// debug prompt (if not already done). The user then knows that the
++	// finally clause is executed.
++	if (dbg_check_skipped(eap))
+ 	{
+-	 // Give up for a multiple ":finally" and ignore it.
+-	 eap->errmsg = _(e_multiple_finally);
+-	 return;
++	 // Handle a ">quit" debug command as if an interrupt had
++	 // occurred before the ":finally". That is, discard the
++	 // original exception and replace it by an interrupt
++	 // exception.
++	 (void)do_intthrow(cstack);
+ 	}
+-	rewind_conditionals(cstack, idx, CSF_WHILE | CSF_FOR,
+-						 &cstack->cs_looplevel);
+ 
+ 	/*
+-	 * Don't do something when the corresponding try block never got active
+-	 * (because of an inactive surrounding conditional or after an error or
+-	 * interrupt or throw) or for a ":finally" without ":try" or a multiple
+-	 * ":finally". After every other error (did_emsg or the conditional
+-	 * errors detected above) or after an interrupt (got_int) or an
+-	 * exception (did_throw), the finally clause must be executed.
++	 * If there is a preceding catch clause and it caught the exception,
++	 * finish the exception now. This happens also after errors except
++	 * when this is a multiple ":finally" or one not within a ":try".
++	 * After an error or interrupt, this also discards a pending
++	 * ":continue", ":break", ":finish", or ":return" from the preceding
++	 * try block or catch clause.
+ 	 */
+-	skip = !(cstack->cs_flagscstack->cs_idx & CSF_TRUE);
++	cleanup_conditionals(cstack, CSF_TRY, FALSE);
+ 
+-	if (!skip)
++	if (cstack->cs_idx >= 0
++			 && (cstack->cs_flagscstack->cs_idx & CSF_TRY))
+ 	{
+-	 // When debugging or a breakpoint was encountered, display the
+-	 // debug prompt (if not already done). The user then knows that the
+-	 // finally clause is executed.
+-	 if (dbg_check_skipped(eap))
+-	 {
+-		// Handle a ">quit" debug command as if an interrupt had
+-		// occurred before the ":finally". That is, discard the
+-		// original exception and replace it by an interrupt
+-		// exception.
+-		(void)do_intthrow(cstack);
+-	 }
+-
+-	 /*
+-	 * If there is a preceding catch clause and it caught the exception,
+-	 * finish the exception now. This happens also after errors except
+-	 * when this is a multiple ":finally" or one not within a ":try".
+-	 * After an error or interrupt, this also discards a pending
+-	 * ":continue", ":break", ":finish", or ":return" from the preceding
+-	 * try block or catch clause.
+-	 */
+-	 cleanup_conditionals(cstack, CSF_TRY, FALSE);
++	 // Variables declared in the previous block can no longer be
++	 // used.
++	 leave_block(cstack);
++	 enter_block(cstack);
++	}
+ 
+-	 if (cstack->cs_idx >= 0
+-			 && (cstack->cs_flagscstack->cs_idx & CSF_TRY))
++	/*
++	 * Make did_emsg, got_int, did_throw pending. If set, they overrule
++	 * a pending ":continue", ":break", ":return", or ":finish". Then
++	 * we have particularly to discard a pending return value (as done
++	 * by the call to cleanup_conditionals() above when did_emsg or
++	 * got_int is set). The pending values are restored by the
++	 * ":endtry", except if there is a new error, interrupt, exception,
++	 * ":continue", ":break", ":return", or ":finish" in the following
++	 * finally clause. A missing ":endwhile", ":endfor" or ":endif"
++	 * detected here is treated as if did_emsg and did_throw had
++	 * already been set, respectively in case that the error is not

_service:tar_scm:backport-CVE-2022-1620.patch -> _service:tar_scm:backport-CVE-2022-3297.patch Changed

@@ -1,45 +1,162 @@
-From 8e4b76da1d7e987d43ca960dfbc372d1c617466f Mon Sep 17 00:00:00 2001
+From 0ff01835a40f549c5c4a550502f62a2ac9ac447c Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Sat, 7 May 2022 11:28:06 +0100
-Subject: PATCH patch 8.2.4901: NULL pointer access when using invalid
- pattern
+Date: Sat, 24 Sep 2022 19:20:30 +0100
+Subject: PATCH patch 9.0.0579: using freed memory when 'tagfunc' wipes out
+ buffer
 
-Problem: NULL pointer access when using invalid pattern.
-Solution: Check for failed regexp program.
+Problem: Using freed memory when 'tagfunc' wipes out buffer that holds
+ 'complete'.
+Solution: Make a copy of the option. Make sure cursor position is valid.
 ---
- src/buffer.c | 2 +-
- src/testdir/test_buffer.vim | 7 +++++++
- 2 files changed, 8 insertions(+), 1 deletion(-)
+ src/insexpand.c | 40 ++++++++++++++++++++++++-------
+ src/move.c | 1 +
+ src/testdir/test_ins_complete.vim | 20 ++++++++++++++--
+ 3 files changed, 50 insertions(+), 11 deletions(-)
 
-diff --git a/src/buffer.c b/src/buffer.c
-index 5801bce..758d920 100644
---- a/src/buffer.c
-+++ b/src/buffer.c
-@@ -2830,7 +2830,7 @@ fname_match(
- 	rmp->rm_ic = p_fic || ignore_case;
- 	if (vim_regexec(rmp, name, (colnr_T)0))
- 	 match = name;
--	else
-+	else if (rmp->regprog != NULL)
- 	{
- 	 // Replace $(HOME) with '~' and try matching again.
- 	 p = home_replace_save(NULL, name);
-diff --git a/src/testdir/test_buffer.vim b/src/testdir/test_buffer.vim
-index dc35bb4..8300f3d 100644
---- a/src/testdir/test_buffer.vim
-+++ b/src/testdir/test_buffer.vim
-@@ -63,4 +63,11 @@ func Test_bunload_with_offset()
- call delete('b4')
+diff --git a/src/insexpand.c b/src/insexpand.c
+index 24308e6..3585ef2 100644
+--- a/src/insexpand.c
++++ b/src/insexpand.c
+@@ -2485,7 +2485,8 @@ ins_compl_next_buf(buf_T *buf, int flag)
+ 
+ if (flag == 'w')		// just windows
+ {
+-	if (buf == curbuf || wp == NULL) // first call for this flag/expansion
++	if (buf == curbuf || !win_valid(wp))
++	 // first call for this flag/expansion or window was closed
+ 	 wp = curwin;
+ 	while ((wp = (wp->w_next != NULL ? wp->w_next : firstwin)) != curwin
+ 		&& wp->w_buffer->b_scanned)
+@@ -3188,9 +3189,10 @@ enum
+ */
+ typedef struct
+ {
+- char_u	*e_cpt;			// current entry in 'complete'
++ char_u	*e_cpt_copy;		// copy of 'complete'
++ char_u	*e_cpt;			// current entry in "e_cpt_copy"
+ buf_T	*ins_buf;		// buffer being scanned
+- pos_T	*cur_match_pos;			// current match position
++ pos_T	*cur_match_pos;		// current match position
+ pos_T	prev_match_pos;		// previous match position
+ int		set_match_pos;		// save first_match_pos/last_match_pos
+ pos_T	first_match_pos;	// first match position
+@@ -3257,7 +3259,8 @@ process_next_cpt_value(
+ 	st->set_match_pos = TRUE;
+ }
+ else if (vim_strchr((char_u *)"buwU", *st->e_cpt) != NULL
+-	 && (st->ins_buf = ins_compl_next_buf(st->ins_buf, *st->e_cpt)) != curbuf)
++	 && (st->ins_buf = ins_compl_next_buf(
++					 st->ins_buf, *st->e_cpt)) != curbuf)
+ {
+ 	// Scan a buffer, but not the current one.
+ 	if (st->ins_buf->b_ml.ml_mfp != NULL) // loaded buffer
+@@ -3756,19 +3759,30 @@ get_next_completion_match(int type, ins_compl_next_state_T *st, pos_T *ini)
+ static int
+ ins_compl_get_exp(pos_T *ini)
+ {
+- static ins_compl_next_state_T st;
++ static ins_compl_next_state_T st;
++ static int			 st_cleared = FALSE;
+ int		i;
+ int		found_new_match;
+ int		type = ctrl_x_mode;
+ 
+ if (!compl_started)
+ {
+-	FOR_ALL_BUFFERS(st.ins_buf)
+-	 st.ins_buf->b_scanned = 0;
++	buf_T *buf;
++
++	FOR_ALL_BUFFERS(buf)
++	 buf->b_scanned = 0;
++	if (!st_cleared)
++	{
++	 CLEAR_FIELD(st);
++	 st_cleared = TRUE;
++	}
+ 	st.found_all = FALSE;
+ 	st.ins_buf = curbuf;
+-	st.e_cpt = (compl_cont_status & CONT_LOCAL)
+-					 ? (char_u *)"." : curbuf->b_p_cpt;
++	vim_free(st.e_cpt_copy);
++	// Make a copy of 'complete', if case the buffer is wiped out.
++	st.e_cpt_copy = vim_strsave((compl_cont_status & CONT_LOCAL)
++					 ? (char_u *)"." : curbuf->b_p_cpt);
++	st.e_cpt = st.e_cpt_copy == NULL ? (char_u *)"" : st.e_cpt_copy;
+ 	st.last_match_pos = st.first_match_pos = *ini;
+ }
+ else if (st.ins_buf != curbuf && !buf_valid(st.ins_buf))
+@@ -4112,6 +4126,7 @@ ins_compl_next(
+ int	 todo = count;
+ int	 advance;
+ int	 started = compl_started;
++ buf_T *orig_curbuf = curbuf;
+ 
+ // When user complete function return -1 for findstart which is next
+ // time of 'always', compl_shown_match become NULL.
+@@ -4144,6 +4159,13 @@ ins_compl_next(
+ 							&num_matches) == -1)
+ 	return -1;
+ 
++ if (curbuf != orig_curbuf)
++ {
++	// In case some completion function switched buffer, don't want to
++	// insert the completion elsewhere.
++	return -1;
++ }
++
+ // Insert the text of the new completion, or the compl_leader.
+ if (compl_no_insert && !started)
+ {
+diff --git a/src/move.c b/src/move.c
+index b061a75..6c654ac 100644
+--- a/src/move.c
++++ b/src/move.c
+@@ -652,6 +652,7 @@ cursor_valid(void)
+ void
+ validate_cursor(void)
+ {
++ check_cursor();
+ check_cursor_moved(curwin);
+ if ((curwin->w_valid & (VALID_WCOL|VALID_WROW)) != (VALID_WCOL|VALID_WROW))
+ 	curs_columns(TRUE);
+diff --git a/src/testdir/test_ins_complete.vim b/src/testdir/test_ins_complete.vim
+index b303993..702a87c 100644
+--- a/src/testdir/test_ins_complete.vim
++++ b/src/testdir/test_ins_complete.vim
+@@ -628,9 +628,8 @@ func Test_pum_with_preview_win()
+ 
+ call writefile(lines, 'Xpreviewscript')
+ let buf = RunVimInTerminal('-S Xpreviewscript', #{rows: 12})
+- call TermWait(buf, 50)
+ call term_sendkeys(buf, "Gi\<C-X>\<C-O>")
+- call TermWait(buf, 100)
++ call TermWait(buf, 200)
+ call term_sendkeys(buf, "\<C-N>")
+ call VerifyScreenDump(buf, 'Test_pum_with_preview_win', {})
+ 
+@@ -2233,4 +2232,21 @@ func Test_ins_complete_end_of_line()
+ bwipe!
 endfunc
 
-+" this was using a NULL pointer after failing to use the pattern
-+func Test_buf_pattern_invalid()
-+ vsplit 0000000
-+ silent! buf 0--\&\zs*\zs*e
++func s:Tagfunc(t,f,o)
++ bwipe!
++ return 
++endfunc
++
++" This was using freed memory, since 'complete' was in a wiped out buffer.
++" Also using a window that was closed.
++func Test_tagfunc_wipes_out_buffer()
++ new
++ set complete=.,t,w,b,u,i
++ se tagfunc=s:Tagfunc
++ sil norm i&#xe;
++
 + bwipe!
 +endfunc
 +
++
 " vim: shiftwidth=2 sts=2 expandtab
 -- 
-1.8.3.1
+2.27.0

_service:tar_scm:backport-CVE-2022-1621.patch -> _service:tar_scm:backport-CVE-2022-3324.patch Changed

@@ -1,85 +1,70 @@
-From 7c824682d2028432ee082703ef0ab399867a089b Mon Sep 17 00:00:00 2001
+From 8279af514ca7e5fd3c31cf13b0864163d1a0bfeb Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Sun, 8 May 2022 22:32:58 +0100
-Subject: PATCH patch 8.2.4919: can add invalid bytes with :spellgood
+Date: Mon, 26 Sep 2022 23:08:22 +0100
+Subject: PATCH patch 9.0.0598: using negative array index with negative
+ width window
 
-Problem: Can add invalid bytes with :spellgood.
-Solution: Check for a valid word string.
+Problem: Using negative array index with negative width window.
+Solution: Make sure the window width does not become negative.
 ---
- src/globals.h | 5 +++++
- src/mbyte.c | 2 +-
- src/spellfile.c | 10 ++++++++++
- src/testdir/test_spellfile.vim | 6 ++++++
- 4 files changed, 22 insertions(+), 1 deletion(-)
+ src/testdir/test_cmdline.vim | 22 ++++++++++++++++++++++
+ src/window.c | 5 ++++-
+ 2 files changed, 26 insertions(+), 1 deletion(-)
 
-diff --git a/src/globals.h b/src/globals.h
-index 7be3bfd..086d04e 100644
---- a/src/globals.h
-+++ b/src/globals.h
-@@ -1745,3 +1745,8 @@ EXTERN int did_repeated_msg INIT(= 0);
- # define REPEATED_MSG_LOOKING	 1
- # define REPEATED_MSG_SAFESTATE	 2
- #endif
-+
-+#ifdef FEAT_SPELL
-+EXTERN char e_illegal_character_in_word
-+ INIT(= N_("E1280: Illegal character in word"));
-+#endif
-diff --git a/src/mbyte.c b/src/mbyte.c
-index 5dd2562..28c5e85 100644
---- a/src/mbyte.c
-+++ b/src/mbyte.c
-@@ -4045,7 +4045,7 @@ theend:
- convert_setup(&vimconv, NULL, NULL);
- }
- 
--#if defined(FEAT_GUI_GTK) || defined(PROTO)
-+#if defined(FEAT_GUI_GTK) || defined(FEAT_SPELL) || defined(PROTO)
- /*
- * Return TRUE if string "s" is a valid utf-8 string.
- * When "end" is NULL stop at the first NUL.
-diff --git a/src/spellfile.c b/src/spellfile.c
-index b9451ec..5171572 100644
---- a/src/spellfile.c
-+++ b/src/spellfile.c
-@@ -4366,6 +4366,10 @@ store_word(
- int		res = OK;
- char_u	*p;
- 
-+ // Avoid adding illegal bytes to the word tree.
-+ if (enc_utf8 && !utf_valid_string(word, NULL))
-+ return FAIL;
-+
- (void)spell_casefold(word, len, foldword, MAXWLEN);
- for (p = pfxlist; res == OK; ++p)
- {
-@@ -6167,6 +6171,12 @@ spell_add_word(
- int		i;
- char_u	*spf;
+diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
+index 440df96..ab3bfdf 100644
+--- a/src/testdir/test_cmdline.vim
++++ b/src/testdir/test_cmdline.vim
+@@ -3457,4 +3457,26 @@ func Test_cmdwin_freed_buffer_ptr()
+ bwipe!
+ endfunc
 
-+ if (enc_utf8 && !utf_valid_string(word, NULL))
-+ {
-+	emsg(_(e_illegal_character_in_word));
-+	return;
-+ }
++" This was resulting in a window with negative width.
++" The test doesn't reproduce the illegal memory access though...
++func Test_cmdwin_split_often()
++ let lines = &lines
++ let columns = &columns
++ set t_WS=
 +
- if (idx == 0)	 // use internal wordlist
- {
- 	if (int_wordlist == NULL)
-diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim
-index 53eca84..1382c02 100644
---- a/src/testdir/test_spellfile.vim
-+++ b/src/testdir/test_spellfile.vim
-@@ -170,3 +170,9 @@ func Test_spell_normal()
- set spellfile=
- bw!
- endfunc
++ try
++ set encoding=iso8859
++ set ruler
++ winsize 0 0
++ noremap 0 &#x17;&#xe;&#x17;H
++ sil norm 0000000q:
++ catch /E36:/
++ endtry
 +
-+" Invalid bytes may cause trouble when creating the word list.
-+func Test_check_for_valid_word()
-+ call assert_fails("spellgood! 0^B\xac", 'E1280:')
++ bwipe!
++ set encoding=utf8
++ let &lines = lines
++ let &columns = columns
 +endfunc
 +
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/window.c b/src/window.c
+index c91ebbc..73060db 100644
+--- a/src/window.c
++++ b/src/window.c
+@@ -2087,6 +2087,8 @@ win_equal_rec(
+ 		if (hnc)	 // add next_curwin size
+ 		{
+ 		 next_curwin_size -= p_wiw - (m - n);
++		 if (next_curwin_size < 0)
++			next_curwin_size = 0;
+ 		 new_size += next_curwin_size;
+ 		 room -= new_size - next_curwin_size;
+ 		}
+@@ -6495,7 +6497,8 @@ scroll_to_fraction(win_T *wp, int prev_height)
+ void
+ win_new_width(win_T *wp, int width)
+ {
+- wp->w_width = width;
++ // Should we give an error if width < 0?
++ wp->w_width = width < 0 ? 0 : width;
+ wp->w_lines_valid = 0;
+ changed_line_abv_curs_win(wp);
+ invalidate_botline_win(wp);
 -- 
-1.8.3.1
+2.27.0

_service:tar_scm:backport-CVE-2022-1629.patch -> _service:tar_scm:backport-CVE-2022-3352.patch Changed

@@ -1,56 +1,79 @@
-From 53a70289c2712808e6d4e88927e03cac01b470dd Mon Sep 17 00:00:00 2001
+From ef976323e770315b5fca544efb6b2faa25674d15 Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Mon, 9 May 2022 13:15:07 +0100
-Subject: PATCH patch 8.2.4925: trailing backslash may cause reading past end
- of line
+Date: Wed, 28 Sep 2022 11:48:30 +0100
+Subject: PATCH patch 9.0.0614: SpellFileMissing autocmd may delete buffer
 
-Problem: Trailing backslash may cause reading past end of line.
-Solution: Check for NUL after backslash.
+Problem: SpellFileMissing autocmd may delete buffer.
+Solution: Disallow deleting the current buffer to avoid using freed memory.
 ---
- src/search.c | 4 ++++
- src/testdir/test_textobjects.vim | 10 +++++++++-
- 2 files changed, 13 insertions(+), 1 deletion(-)
+ src/buffer.c | 7 ++++++-
+ src/spell.c | 6 ++++++
+ src/testdir/test_autocmd.vim | 10 ++++++++++
+ 3 files changed, 22 insertions(+), 1 deletion(-)
 
-diff --git a/src/search.c b/src/search.c
-index 1a5dc1a..75f0c59 100644
---- a/src/search.c
-+++ b/src/search.c
-@@ -4457,7 +4457,11 @@ find_next_quote(
- 	if (c == NUL)
- 	 return -1;
- 	else if (escape != NULL && vim_strchr(escape, c))
-+	{
- 	 ++col;
-+	 if (linecol == NUL)
-+		return -1;
-+	}
- 	else if (c == quotechar)
- 	 break;
- 	if (has_mbyte)
-diff --git a/src/testdir/test_textobjects.vim b/src/testdir/test_textobjects.vim
-index 49fc9c8..3fc0283 100644
---- a/src/testdir/test_textobjects.vim
-+++ b/src/testdir/test_textobjects.vim
-@@ -154,10 +154,18 @@ func Test_string_html_objects()
- call assert_equal('-', getline('.'), e)
+diff --git a/src/buffer.c b/src/buffer.c
+index e775398..a85b2a8 100644
+--- a/src/buffer.c
++++ b/src/buffer.c
+@@ -461,7 +461,12 @@ can_unload_buffer(buf_T *buf)
+ 	 }
+ }
+ if (!can_unload)
+-	semsg(_(e_attempt_to_delete_buffer_that_is_in_use_str), buf->b_fname);
++ {
++	char_u *fname = buf->b_fname != NULL ? buf->b_fname : buf->b_ffname;
++
++	semsg(_(e_attempt_to_delete_buffer_that_is_in_use_str),
++				fname != NULL ? fname : (char_u *)"No Name");
++ }
+ return can_unload;
+ }
+ 
+diff --git a/src/spell.c b/src/spell.c
+index 24abce4..3664425 100644
+--- a/src/spell.c
++++ b/src/spell.c
+@@ -1559,6 +1559,10 @@ spell_load_lang(char_u *lang)
+ sl.sl_slang = NULL;
+ sl.sl_nobreak = FALSE;
 
- set quoteescape&
++ // Disallow deleting the current buffer. Autocommands can do weird things
++ // and cause "lang" to be freed.
++ ++curbuf->b_locked;
 +
-+ " this was going beyond the end of the line
-+ %del
-+ sil! norm &#x16;i"\
-+ sil! norm &#x16;i"\
-+ sil! norm &#x16;i"\
-+ call assert_equal('"\', getline(1))
+ // We may retry when no spell file is found for the language, an
+ // autocommand may load it then.
+ for (round = 1; round <= 2; ++round)
+@@ -1612,6 +1616,8 @@ spell_load_lang(char_u *lang)
+ 	STRCPY(fname_enc + STRLEN(fname_enc) - 3, "add.spl");
+ 	do_in_runtimepath(fname_enc, DIP_ALL, spell_load_cb, &sl);
+ }
 +
-+ bwipe!
- endfor
++ --curbuf->b_locked;
+ }
 
- set enc=utf-8
-- bwipe!
+ /*
+diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
+index e9a59c2..bc74c29 100644
+--- a/src/testdir/test_autocmd.vim
++++ b/src/testdir/test_autocmd.vim
+@@ -2750,6 +2750,16 @@ func Test_FileType_spell()
+ setglobal spellfile=
 endfunc
 
- func Test_empty_html_tag()
++" this was wiping out the current buffer and using freed memory
++func Test_SpellFileMissing_bwipe()
++ next 0
++ au SpellFileMissing 0 bwipe
++ call assert_fails('set spell spelllang=0', 'E937:')
++
++ au! SpellFileMissing
++ bwipe
++endfunc
++
+ " Test closing a window or editing another buffer from a FileChangedRO handler
+ " in a readonly buffer
+ func Test_FileChangedRO_winclose()
 -- 
-1.8.3.1
+2.27.0

_service:tar_scm:backport-CVE-2022-1674.patch -> _service:tar_scm:backport-CVE-2022-3491.patch Changed

_service:tar_scm:backport-CVE-2022-1733.patch -> _service:tar_scm:backport-CVE-2022-3520.patch Changed

@@ -1,44 +1,52 @@
-From 60ae0e71490c97f2871a6344aca61cacf220f813 Mon Sep 17 00:00:00 2001
+From 36343ae0fb7247e060abfd35fb8e4337b33abb4b Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Mon, 16 May 2022 18:06:15 +0100
-Subject: PATCH patch 8.2.4968: reading past end of the line when C-indenting
+Date: Sat, 15 Oct 2022 19:04:05 +0100
+Subject: PATCH patch 9.0.0765: with a Visual block a put command column may
+ go negative
 
-Problem: Reading past end of the line when C-indenting.
-Solution: Check for NUL.
+Problem: With a Visual block a put command column may go negative.
+Solution: Check that the column does not become negative.
 ---
- src/cindent.c | 2 +-
- src/testdir/test_cindent.vim | 7 +++++++
- 2 files changed, 8 insertions(+), 1 deletion(-)
+ src/register.c | 2 ++
+ src/testdir/test_visual.vim | 12 ++++++++++++
+ 2 files changed, 14 insertions(+)
 
-diff --git a/src/cindent.c b/src/cindent.c
-index 28d1558..1b2763f 100644
---- a/src/cindent.c
-+++ b/src/cindent.c
-@@ -91,7 +91,7 @@ skip_string(char_u *p)
- 		while (vim_isdigit(pi - 1)) // '\000'
- 		 ++i;
- 	 }
--	 if (pi == '\'')		 // check for trailing '
-+	 if (pi - 1 != NUL && pi == '\'') // check for trailing '
- 	 {
- 		p += i;
- 		continue;
-diff --git a/src/testdir/test_cindent.vim b/src/testdir/test_cindent.vim
-index 2a87460..3b2200a 100644
---- a/src/testdir/test_cindent.vim
-+++ b/src/testdir/test_cindent.vim
-@@ -5263,4 +5263,11 @@ func Test_find_brace_backwards()
+diff --git a/src/register.c b/src/register.c
+index 30e2001..41089a0 100644
+--- a/src/register.c
++++ b/src/register.c
+@@ -1945,6 +1945,8 @@ do_put(
+ 	// adjust ' mark
+ 	curbuf->b_op_end.lnum = curwin->w_cursor.lnum - 1;
+ 	curbuf->b_op_end.col = bd.textcol + totlen - 1;
++	if (curbuf->b_op_end.col < 0)
++	 curbuf->b_op_end.col = 0;
+ 	curbuf->b_op_end.coladd = 0;
+ 	if (flags & PUT_CURSEND)
+ 	{
+diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
+index e965266..956a3d7 100644
+--- a/src/testdir/test_visual.vim
++++ b/src/testdir/test_visual.vim
+@@ -483,6 +483,18 @@ func Test_visual_block_put()
+ bw!
 endfunc
 
- 
-+" This was reading past the end of the line
-+func Test_cindent_check_funcdecl()
-+ new
-+ sil norm o0&#xf;('\0&#xf;=L
++func Test_visual_block_put_invalid()
++ enew!
++ behave mswin
++ norm yy
++ norm v)P&#x11;s/^/	
++ " this was causing the column to become negative
++ silent norm ggv)&#x16;P
++
 + bwipe!
++ behave xterm
 +endfunc
 +
- " vim: shiftwidth=2 sts=2 expandtab
+ " Visual modes (v V CTRL-V) followed by an operator; count; repeating
+ func Test_visual_mode_op()
+ new
 -- 
-1.8.3.1
+2.27.0

_service:tar_scm:backport-CVE-2022-1735.patch -> _service:tar_scm:backport-CVE-2022-3591.patch Changed

@@ -1,122 +1,62 @@
-From 7ce5b2b590256ce53d6af28c1d203fb3bc1d2d97 Mon Sep 17 00:00:00 2001
+From 8f3c3c6cd044e3b5bf08dbfa3b3f04bb3f711bad Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Mon, 16 May 2022 19:40:59 +0100
-Subject: PATCH patch 8.2.4969: changing text in Visual mode may cause
- invalid memory access
+Date: Tue, 18 Oct 2022 17:05:54 +0100
+Subject: PATCH patch 9.0.0789: dummy buffer ends up in a window
 
-Problem: Changing text in Visual mode may cause invalid memory access.
-Solution: Check the Visual position after making a change.
+Problem: Dummy buffer ends up in a window.
+Solution: Disallow navigating to a dummy buffer.
 ---
- src/change.c | 3 +++
- src/edit.c | 12 ++----------
- src/misc2.c | 25 +++++++++++++++++++++++++
- src/proto/misc2.pro | 1 +
- src/testdir/test_visual.vim | 10 ++++++++++
- 5 files changed, 41 insertions(+), 10 deletions(-)
+ src/buffer.c | 7 +++++++
+ src/testdir/test_autocmd.vim | 20 ++++++++++++++++++++
+ 2 files changed, 27 insertions(+)
 
-diff --git a/src/change.c b/src/change.c
-index f2dfc93..a5ebbdf 100644
---- a/src/change.c
-+++ b/src/change.c
-@@ -523,6 +523,9 @@ changed_common(
+diff --git a/src/buffer.c b/src/buffer.c
+index 0849b7099..5a4825feb 100644
+--- a/src/buffer.c
++++ b/src/buffer.c
+@@ -1332,6 +1332,13 @@ do_buffer_ext(
+ )
+ 	return OK;
 #endif
- }
- 
-+ if (VIsual_active)
-+	check_visual_pos();
-+
- FOR_ALL_TAB_WINDOWS(tp, wp)
- {
- 	if (wp->w_buffer == curbuf)
-diff --git a/src/edit.c b/src/edit.c
-index f77cc05..0dd6b93 100644
---- a/src/edit.c
-+++ b/src/edit.c
-@@ -3101,16 +3101,8 @@ stop_insert(
- 
- 	 // <C-S-Right> may have started Visual mode, adjust the position for
- 	 // deleted characters.
--	 if (VIsual_active && VIsual.lnum == curwin->w_cursor.lnum)
--	 {
--		int len = (int)STRLEN(ml_get_curline());
--
--		if (VIsual.col > len)
--		{
--		 VIsual.col = len;
--		 VIsual.coladd = 0;
--		}
--	 }
-+	 if (VIsual_active)
-+		check_visual_pos();
- 	}
- }
- did_ai = FALSE;
-diff --git a/src/misc2.c b/src/misc2.c
-index 80731f0..51244da 100644
---- a/src/misc2.c
-+++ b/src/misc2.c
-@@ -618,6 +618,31 @@ check_cursor(void)
- check_cursor_col();
- }
- 
-+/*
-+ * Check if VIsual position is valid, correct it if not.
-+ * Can be called when in Visual mode and a change has been made.
-+ */
-+ void
-+check_visual_pos(void)
-+{
-+ if (VIsual.lnum > curbuf->b_ml.ml_line_count)
-+ {
-+	VIsual.lnum = curbuf->b_ml.ml_line_count;
-+	VIsual.col = 0;
-+	VIsual.coladd = 0;
-+ }
-+ else
++ if ((action == DOBUF_GOTO || action == DOBUF_SPLIT)
++						 && (buf->b_flags & BF_DUMMY))
 + {
-+	int len = (int)STRLEN(ml_get(VIsual.lnum));
-+
-+	if (VIsual.col > len)
-+	{
-+	 VIsual.col = len;
-+	 VIsual.coladd = 0;
-+	}
++	// disallow navigating to the dummy buffer
++	semsg(_(e_buffer_nr_does_not_exist), count);
++	return FAIL;
 + }
-+}
-+
- #if defined(FEAT_TEXTOBJ) || defined(PROTO)
- /*
- * Make sure curwin->w_cursor is not on the NUL at the end of the line.
-diff --git a/src/proto/misc2.pro b/src/proto/misc2.pro
-index a52b462..6e6e22d 100644
---- a/src/proto/misc2.pro
-+++ b/src/proto/misc2.pro
-@@ -17,6 +17,7 @@ void check_cursor_lnum(void);
- void check_cursor_col(void);
- void check_cursor_col_win(win_T *win);
- void check_cursor(void);
-+void check_visual_pos(void);
- void adjust_cursor_col(void);
- int leftcol_changed(void);
- void vim_mem_profile_dump(void);
-diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
-index 4f8f056..d21f8f1 100644
---- a/src/testdir/test_visual.vim
-+++ b/src/testdir/test_visual.vim
-@@ -956,3 +956,13 @@ func Test_visual_block_insert_round_off()
- bwipe!
+ 
+ #ifdef FEAT_GUI
+ need_mouse_correct = TRUE;
+diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
+index 0706e7307..6ba1b02df 100644
+--- a/src/testdir/test_autocmd.vim
++++ b/src/testdir/test_autocmd.vim
+@@ -3857,4 +3857,24 @@ func Test_autocmd_delete()
+ call assert_true(autocmd_delete(test_null_dict()))
 endfunc
 
-+func Test_visual_block_with_substitute()
-+ " this was reading beyond the end of the line
-+ new
-+ norm a0)
-+ sil! norm &#x16; O
-+ s/)
-+ sil! norm &#x1d;
-+ bwipe!
++func Test_autocmd_split_dummy()
++ " Autocommand trying to split a window containing a dummy buffer.
++ auto BufReadPre * exe "sbuf " .. expand("<abuf>") 
++ " Avoid the "W11" prompt
++ au FileChangedShell * let v:fcs_choice = 'reload'
++ func Xautocmd_changelist()
++ cal writefile('Xtestfile2:4:4', 'Xerr')
++ edit Xerr
++ lex 'Xtestfile2:4:4'
++ endfunc
++ call Xautocmd_changelist()
++ call assert_fails('call Xautocmd_changelist()', 'E86:')
++
++ au! BufReadPre
++ au! FileChangedShell
++ delfunc Xautocmd_changelist
++ bwipe! Xerr
++ call delete('Xerr')
 +endfunc
 +
+ " vim: shiftwidth=2 sts=2 expandtab
 -- 
-1.8.3.1
+2.27.0

_service:tar_scm:backport-CVE-2022-1771.patch -> _service:tar_scm:backport-CVE-2022-3705.patch Changed

@@ -1,96 +1,72 @@
-From 51f0bfb88a3554ca2dde777d78a59880d1ee37a8 Mon Sep 17 00:00:00 2001
+From d0fab10ed2a86698937e3c3fed2f10bd9bb5e731 Mon Sep 17 00:00:00 2001
 From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 17 May 2022 20:11:02 +0100
-Subject: PATCH patch 8.2.4975: recursive command line loop may cause a crash
- 
-Problem: Recursive command line loop may cause a crash.
-Solution: Limit recursion of getcmdline().
- 
-Reference:https://github.com/vim/vim/commit/51f0bfb88a3554ca2dde777d78a59880d1ee37a8
-Conflict:(1)The src/version.c file is not modified
-(2)add e_command_too_recursive in src/globals.h
+Date: Thu, 20 Oct 2022 16:03:33 +0100
+Subject: PATCH patch 9.0.0805: filetype autocmd may cause freed memory
+ access
+
+Problem: Filetype autocmd may cause freed memory access.
+Solution: Set the quickfix-busy flag while filling the buffer.
 ---
- src/ex_getln.c | 12 ++++++++++++
- src/globals.h | 3 +++
- src/testdir/test_cmdline.vim | 12 ++++++++++++
- 3 files changed, 27 insertions(+)
+ src/quickfix.c | 6 ++++++
+ src/testdir/test_quickfix.vim | 16 ++++++++++++++++
+ 2 files changed, 22 insertions(+)
 
-diff --git a/src/ex_getln.c b/src/ex_getln.c
-index 771a9cd..e935f78 100644
---- a/src/ex_getln.c
-+++ b/src/ex_getln.c
-@@ -791,6 +791,7 @@ getcmdline_int(
- int		indent,		// indent for inside conditionals
- int		init_ccline)	// clear ccline first
- {
-+ static int	depth = 0;	 // call depth
- int		c;
- int		i;
- int		j;
-@@ -820,6 +821,9 @@ getcmdline_int(
- int		did_save_ccline = FALSE;
- int		cmdline_type;
+diff --git a/src/quickfix.c b/src/quickfix.c
+index a90611475ab1..f85fff56f23d 100644
+--- a/src/quickfix.c
++++ b/src/quickfix.c
+@@ -4543,6 +4543,9 @@ qf_update_buffer(qf_info_T *qi, qfline_T *old_last)
+ 	 qf_winid = win->w_id;
+ 	}
 
-+ // one recursion level deeper
-+ ++depth;
++	// autocommands may cause trouble
++	incr_quickfix_busy();
 +
- if (ccline.cmdbuff != NULL)
- {
- 	// Being called recursively. Since ccline is global, we need to save
-@@ -873,6 +877,13 @@ getcmdline_int(
- 	ccline.cmdlen = indent;
- }
- 
-+ if (depth == 50)
-+ {
-+	// Somehow got into a loop recursively calling getcmdline(), bail out.
-+	emsg(_(e_command_too_recursive));
-+	goto theend;
-+ }
+ 	if (old_last == NULL)
+ 	 // set curwin/curbuf to buf and save a few things
+ 	 aucmd_prepbuf(&aco, buf);
+@@ -4564,6 +4567,9 @@ qf_update_buffer(qf_info_T *qi, qfline_T *old_last)
+ 	// when the added lines are not visible.
+ 	if ((win = qf_find_win(qi)) != NULL && old_line_count < win->w_botline)
+ 	 redraw_buf_later(buf, NOT_VALID);
 +
- ExpandInit(&xpc);
- ccline.xpc = &xpc;
++	// always called after incr_quickfix_busy()
++	decr_quickfix_busy();
+ }
+ }
 
-@@ -2425,6 +2436,7 @@ theend:
- {
- 	char_u *p = ccline.cmdbuff;
+diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
+index 2ee754b39690..bcaef5da175c 100644
+--- a/src/testdir/test_quickfix.vim
++++ b/src/testdir/test_quickfix.vim
+@@ -3471,6 +3471,21 @@ func Test_resize_from_copen()
+ endtry
+ endfunc
 
-+	--depth;
- 	if (did_save_ccline)
- 	 restore_cmdline(&save_ccline);
- 	else
-diff --git a/src/globals.h b/src/globals.h
-index 44162d4..e9c88ed 100644
---- a/src/globals.h
-+++ b/src/globals.h
-@@ -1747,3 +1747,6 @@ EXTERN int did_repeated_msg INIT(= 0);
- EXTERN char e_illegal_character_in_word
- INIT(= N_("E1280: Illegal character in word"));
- #endif
++func Test_filetype_autocmd()
++ " this changes the location list while it is in use to fill a buffer
++ lexpr ''
++ lopen
++ augroup FT_loclist
++ au FileType * call setloclist(0, , 'f')
++ augroup END
++ silent! lolder
++ lexpr ''
++
++ augroup FT_loclist
++ au! FileType
++ augroup END
++endfunc
 +
-+EXTERN char e_command_too_recursive
-+	INIT(= N_("E169: Command too recursive"));
-diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
-index 1ccdbe2..b76b7f3 100644
---- a/src/testdir/test_cmdline.vim
-+++ b/src/testdir/test_cmdline.vim
-@@ -903,4 +903,16 @@ func Test_report_error_with_composing()
- call assert_equal('yes', caught)
+ func Test_vimgrep_with_textlock()
+ new
+ 
+@@ -6380,4 +6395,5 @@ func Test_loclist_replace_autocmd()
+ call setloclist(0, , 'f')
 endfunc
 
-+func Test_recursive_register()
-+ let @= = ''
-+ silent! ?&#x1c;e&#x12;/
-+ let caught = 'no'
-+ try
-+ normal /&#x12;/ 
-+ catch /E169:/
-+ let caught = 'yes'
-+ endtry
-+ call assert_equal('yes', caught)
-+endfunc
 +
 " vim: shiftwidth=2 sts=2 expandtab
 -- 
-2.27.0
+2.33.0

_service:tar_scm:backport-CVE-2022-2124.patch -> _service:tar_scm:backport-CVE-2022-4141.patch Changed

@@ -1,35 +1,145 @@
-From e4463991b2c9243ae93462118b6d6f648852bb0c Mon Sep 17 00:00:00 2001
-From: lauk001 <liukuo@kylinos.cn>
-Date: Tue, 21 Jun 2022 13:43:57 +0800
-Subject: PATCH CVE-2022-2124
+From cc762a48d42b579fb7bdec2c614636b830342dd5 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Fri, 25 Nov 2022 13:03:31 +0000
+Subject: PATCH patch 9.0.0947: invalid memory access in substitute with
+ function
 
-Signed-off-by: lauk001 <liukuo@kylinos.cn>
+Problem: Invalid memory access in substitute with function that goes to
+ another file.
+Solution: Check for text locked in CTRL-W gf.
 ---
- src/search.c | 6 ++++++
- 1 file changed, 6 insertions(+)
+ src/normal.c | 33 ++++++++++++++++++++++++---------
+ src/proto/normal.pro | 1 +
+ src/testdir/test_substitute.vim | 19 +++++++++++++++++++
+ src/window.c | 4 +++-
+ 4 files changed, 47 insertions(+), 10 deletions(-)
 
-diff --git a/src/search.c b/src/search.c
-index 75f0c59..87acb33 100644
---- a/src/search.c
-+++ b/src/search.c
-@@ -4589,11 +4589,17 @@ current_quote(
+diff --git a/src/normal.c b/src/normal.c
+index 938ae718efa2..0d1eba759e69 100644
+--- a/src/normal.c
++++ b/src/normal.c
+@@ -192,13 +192,33 @@ check_text_locked(oparg_T *oap)
+ {
+ if (text_locked())
+ {
+-	clearopbeep(oap);
++	if (oap != NULL)
++	 clearopbeep(oap);
+ 	text_locked_msg();
+ 	return TRUE;
+ }
+ return FALSE;
+ }
 
- 	// Find out if we have a quote in the selection.
- 	while (i <= col_end)
-+	{
-+	 // check for going over the end of the line, which can happen if
-+	 // the line was changed after the Visual area was selected.
-+	 if (linei == NUL)
-+		break;
- 	 if (linei++ == quotechar)
- 	 {
- 		selected_quote = TRUE;
- 		break;
- 	 }
-+	}
++/*
++ * If text is locked, "curbuf_lock" or "allbuf_lock" is set:
++ * Give an error message, possibly beep and return TRUE.
++ * "oap" may be NULL.
++ */
++ int
++check_text_or_curbuf_locked(oparg_T *oap)
++{
++ if (check_text_locked(oap))
++	return TRUE;
++ if (curbuf_locked())
++ {
++	if (oap != NULL)
++	 clearop(oap);
++	return TRUE;
++ }
++ return FALSE;
++}
++
+ /*
+ * Handle the count before a normal command and set cap->count0.
+ */
+@@ -816,8 +836,7 @@ normal_cmd(
+ 	goto normal_end;
 }
 
- if (!vis_empty && linecol_start == quotechar)
+- if ((nv_cmdsidx.cmd_flags & NV_NCW)
+-				&& (check_text_locked(oap) || curbuf_locked()))
++ if ((nv_cmdsidx.cmd_flags & NV_NCW) && check_text_or_curbuf_locked(oap))	 
+ 	// this command is not allowed now
+ 	goto normal_end;
+ 
+@@ -4058,13 +4077,9 @@ nv_gotofile(cmdarg_T *cap)
+ char_u	*ptr;
+ linenr_T	lnum = -1;
+ 
+- if (check_text_locked(cap->oap))
+-	return;
+- if (curbuf_locked())
+- {
+-	clearop(cap->oap);
++ if (check_text_or_curbuf_locked(cap->oap))	
+ 	return;
+- }
++
+ #ifdef FEAT_PROP_POPUP
+ if (ERROR_IF_TERM_POPUP_WINDOW)
+ 	return;
+diff --git a/src/proto/normal.pro b/src/proto/normal.pro
+index 106d0e1..eff08df 100644
+--- a/src/proto/normal.pro
++++ b/src/proto/normal.pro
+@@ -1,4 +1,5 @@
+ /* normal.c */
++int check_text_or_curbuf_locked(oparg_T *oap);
+ void normal_cmd(oparg_T *oap, int toplevel);
+ void check_visual_highlight(void);
+ void end_visual_mode(void);
+diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
+index 7e7ccff..73c8c57 100644
+--- a/src/testdir/test_substitute.vim
++++ b/src/testdir/test_substitute.vim
+@@ -1076,6 +1076,25 @@ func Test_sub_edit_scriptfile()
+ bwipe!
+ endfunc
+ 
++" This was editing another file from the expression.
++func Test_sub_expr_goto_other_file()
++ call writefile('', 'Xfileone', 'D')
++ enew!
++ call setline(1, 'a', 'b', 'c', 'd',
++	\ 'Xfileone zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz')
++
++ func g:SplitGotoFile()
++ exe "sil! norm 0\<C-W>gf"
++ return ''
++ endfunc
++
++ $
++ s/\%')/\=g:SplitGotoFile()
++
++ delfunc g:SplitGotoFile
++ bwipe!
++endfunc
++
+ " Test for the 2-letter and 3-letter :substitute commands
+ func Test_substitute_short_cmd()
+ new
+diff --git a/src/window.c b/src/window.c
+index 97cc77035f95..a2bebcaea4df 100644
+--- a/src/window.c
++++ b/src/window.c
+@@ -534,6 +534,8 @@ do_window(
+ case Ctrl_F:
+ wingotofile:
+ 		CHECK_CMDWIN;
++		if (check_text_or_curbuf_locked(NULL))
++		 break;
+ 
+ 		ptr = grab_file_name(Prenum1, &lnum);
+ 		if (ptr != NULL)
+@@ -857,7 +859,7 @@ win_split(int size, int flags)
+ * When "new_wp" is NULL: split the current window in two.
+ * When "new_wp" is not NULL: insert this window at the far
+ * top/left/right/bottom.
+- * return FAIL for failure, OK otherwise
++ * Return FAIL for failure, OK otherwise.
+ */
+ int
+ win_split_ins(
 -- 
 2.33.0
-

_service:tar_scm:backport-CVE-2022-4292.patch Added

@@ -0,0 +1,55 @@
+From c3d27ada14acd02db357f2d16347acc22cb17e93 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Mon, 14 Nov 2022 20:52:14 +0000
+Subject: PATCH patch 9.0.0882: using freed memory after SpellFileMissing
+ autocmd uses bwipe
+
+Problem: Using freed memory after SpellFileMissing autocmd uses bwipe.
+Solution: Bail out if the window no longer exists.
+---
+ src/spell.c | 4 ++--
+ src/testdir/test_spell.vim | 13 +++++++++++++
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/src/spell.c b/src/spell.c
+index 3664425..d204a95 100644
+--- a/src/spell.c
++++ b/src/spell.c
+@@ -2101,8 +2101,8 @@ did_set_spelllang(win_T *wp)
+ 	 {
+ 		spell_load_lang(lang);
+ 		// SpellFileMissing autocommands may do anything, including
+-		// destroying the buffer we are using...
+-		if (!bufref_valid(&bufref))
++		// destroying the buffer we are using or closing the window.
++		if (!bufref_valid(&bufref) || !win_valid_any_tab(wp))
+ 		{
+ 		 ret_msg = N_(e_spellfilemising_autocommand_deleted_buffer);
+ 		 goto theend;
+diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
+index bc948b0..33f0931 100644
+--- a/src/testdir/test_spell.vim
++++ b/src/testdir/test_spell.vim
+@@ -157,6 +157,19 @@ func Test_spell_file_missing()
+ %bwipe!
+ endfunc
+ 
++func Test_spell_file_missing_bwipe()
++ " this was using a window that was wiped out in a SpellFileMissing autocmd
++ set spelllang=xy
++ au SpellFileMissing * n0
++ set spell
++ au SpellFileMissing * bw
++ snext somefile
++
++ au! SpellFileMissing
++ bwipe!
++ set nospell spelllang=en
++endfunc
++
+ func Test_spelldump()
+ " In case the spell file is not found avoid getting the download dialog, we
+ " would get stuck at the prompt.
+-- 
+2.33.0
+

_service:tar_scm:backport-CVE-2022-4293.patch Added

@@ -0,0 +1,55 @@
+From cdef1cefa2a440911c727558562f83ed9b00e16b Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Thu, 20 Oct 2022 14:17:18 +0100
+Subject: PATCH patch 9.0.0804: crash when trying to divide a number by -1
+
+Problem: Crash when trying to divice the largest negative number by -1.
+Solution: Handle this case specifically.
+---
+ src/eval.c | 8 +++++++-
+ src/testdir/test_expr.vim | 6 ++++++
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/src/eval.c b/src/eval.c
+index 1652fcb4ae48..062fab0ac949 100644
+--- a/src/eval.c
++++ b/src/eval.c
+@@ -82,6 +82,12 @@ num_divide(varnumber_T n1, varnumber_T n2, int *failed)
+ 	else
+ 	 result = VARNUM_MAX;
+ }
++ else if (n1 == VARNUM_MIN && n2 == -1)
++ {
++	// specific case: trying to do VARNUM_MIN / -1 results in a positive
++	// number that doesn't fit in varnumber_T and causes an FPE
++	result = VARNUM_MAX;
++ }
+ else
+ 	result = n1 / n2;
+ 
+@@ -5906,7 +5912,7 @@ var2fpos(
+ }
+ 
+ /*
+- * Convert list in "arg" into position "psop" and optional file number "fnump".
++ * Convert list in "arg" into position "posp" and optional file number "fnump".
+ * When "fnump" is NULL there is no file number, only 3 items: lnum, col, off
+ * Note that the column is passed on as-is, the caller may want to decrement
+ * it to use 1 for the first column.
+diff --git a/src/testdir/test_expr.vim b/src/testdir/test_expr.vim
+index b47896340f60..e1fed369b747 100644
+--- a/src/testdir/test_expr.vim
++++ b/src/testdir/test_expr.vim
+@@ -764,6 +764,12 @@ func Test_eval_after_if()
+ call assert_equal('b', s:val)
+ endfunc
+ 
++func Test_divide_by_zero()
++ " only tests that this doesn't crash, the result is not important
++ echo 0 / 0
++ echo 0 / 0 / -1
++endfunc
++
+ " Test for command-line completion of expressions
+ func Test_expr_completion()
+ CheckFeature cmdline_compl

_service:tar_scm:backport-CVE-2022-47024.patch Added

@@ -0,0 +1,34 @@
+From a63ad78ed31e36dbdf3a9cd28071dcdbefce7d19 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Wed, 31 Aug 2022 12:01:54 +0100
+Subject: PATCH patch 9.0.0339: no check if the return value of XChangeGC()
+ is NULL
+
+Problem: No check if the return value of XChangeGC() is NULL.
+Solution: Only use the return value when it is not NULL. (closes #11020)
+---
+ src/gui_x11.c | 10 +++++++---
+ 1 files changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/src/gui_x11.c b/src/gui_x11.c
+index 6e3e903be462..7293ac4900a6 100644
+--- a/src/gui_x11.c
++++ b/src/gui_x11.c
+@@ -2231,10 +2231,14 @@ gui_x11_create_blank_mouse(void)
+ {
+ Pixmap blank_pixmap = XCreatePixmap(gui.dpy, gui.wid, 1, 1, 1);
+ GC gc = XCreateGC(gui.dpy, blank_pixmap, (unsigned long)0, (XGCValues*)0);
+- XDrawPoint(gui.dpy, blank_pixmap, gc, 0, 0);
+- XFreeGC(gui.dpy, gc);
++
++ if (gc != NULL)
++ {
++	XDrawPoint(gui.dpy, blank_pixmap, gc, 0, 0);
++	XFreeGC(gui.dpy, gc);
++ }
+ return XCreatePixmapCursor(gui.dpy, blank_pixmap, blank_pixmap,
+-	 (XColor*)&gui.norm_pixel, (XColor*)&gui.norm_pixel, 0, 0);
++		 (XColor*)&gui.norm_pixel, (XColor*)&gui.norm_pixel, 0, 0);
+ }
+ 
+ /*

_service:tar_scm:backport-CVE-2023-0049.patch Added

@@ -0,0 +1,44 @@
+From 7b17eb4b063a234376c1ec909ee293e42cff290c Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Wed, 4 Jan 2023 14:31:49 +0000
+Subject: PATCH patch 9.0.1143: invalid memory access with bad 'statusline'
+ value
+
+Problem: Invalid memory access with bad 'statusline' value.
+Solution: Avoid going over the NUL at the end.
+---
+ src/buffer.c | 2 ++
+ src/testdir/test_statusline.vim | 7 +++++++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/src/buffer.c b/src/buffer.c
+index 98568987894e..40168226160c 100644
+--- a/src/buffer.c
++++ b/src/buffer.c
+@@ -4576,6 +4576,8 @@ build_stl_str_hl(
+ #endif
+ 	if (vim_strchr(STL_ALL, *s) == NULL)
+ 	{
++	 if (*s == NUL) // can happen with "%0"
++		break;
+ 	 s++;
+ 	 continue;
+ 	}
+diff --git a/src/testdir/test_statusline.vim b/src/testdir/test_statusline.vim
+index a829597655bf..23613bfed37b 100644
+--- a/src/testdir/test_statusline.vim
++++ b/src/testdir/test_statusline.vim
+@@ -436,6 +436,13 @@ func Test_statusline()
+ set splitbelow&
+ endfunc
+ 
++func Test_statusline_trailing_percent_zero()
++ " this was causing illegal memory access
++ set laststatus=2 stl=%!%0
++ call assert_fails('redraw', 'E15: Invalid expression: "%0"')
++ set laststatus& stl&
++endfunc
++
+ func Test_statusline_visual()
+ func CallWordcount()
+ call wordcount()

_service:tar_scm:backport-CVE-2023-0051.patch Added

@@ -0,0 +1,98 @@
+From c32949b0779106ed5710ae3bffc5053e49083ab4 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Wed, 4 Jan 2023 15:56:51 +0000
+Subject: PATCH patch 9.0.1144: reading beyond text
+
+Problem: Reading beyond text.
+Solution: Add strlen_maxlen() and use it.
+---
+ src/message.c | 3 ++-
+ src/proto/strings.pro | 1 +
+ src/strings.c | 15 ++++++++++++++-
+ src/testdir/test_cmdline.vim | 11 +++++++++++
+ 4 files changed, 28 insertions(+), 2 deletions(-)
+
+diff --git a/src/message.c b/src/message.c
+index becb280..c53c44f 100644
+--- a/src/message.c
++++ b/src/message.c
+@@ -2806,7 +2806,8 @@ msg_puts_printf(char_u *str, int maxlen)
+ {
+ 	char_u *tofree = NULL;
+ 
+-	if (maxlen > 0 && STRLEN(p) > (size_t)maxlen)
++	if (maxlen > 0 && vim_strlen_maxlen((char *)p, (size_t)maxlen)
++							 >= (size_t)maxlen)
+ 	{
+ 	 tofree = vim_strnsave(p, (size_t)maxlen);
+ 	 p = tofree;
+diff --git a/src/proto/strings.pro b/src/proto/strings.pro
+index 778ec90..1bd4dcb 100644
+--- a/src/proto/strings.pro
++++ b/src/proto/strings.pro
+@@ -12,6 +12,7 @@ char_u *strlow_save(char_u *orig);
+ void del_trailing_spaces(char_u *ptr);
+ void vim_strncpy(char_u *to, char_u *from, size_t len);
+ void vim_strcat(char_u *to, char_u *from, size_t tosize);
++size_t vim_strlen_maxlen(char *s, size_t maxlen);
+ int vim_stricmp(char *s1, char *s2);
+ int vim_strnicmp(char *s1, char *s2, size_t len);
+ char_u *vim_strchr(char_u *string, int c);
+diff --git a/src/strings.c b/src/strings.c
+index 0313e74..df06c3f 100644
+--- a/src/strings.c
++++ b/src/strings.c
+@@ -525,6 +525,19 @@ vim_strcat(char_u *to, char_u *from, size_t tosize)
+ 	mch_memmove(to + tolen, from, fromlen + 1);
+ }
+ 
++/*
++ * A version of strlen() that has a maximum length.
++ */
++ size_t
++vim_strlen_maxlen(char *s, size_t maxlen)
++{
++ size_t i;
++ for (i = 0; i < maxlen; ++i)
++	if (si == NUL)
++	 break;
++ return i;
++}
++
+ #if (!defined(HAVE_STRCASECMP) && !defined(HAVE_STRICMP)) || defined(PROTO)
+ /*
+ * Compare two strings, ignoring case, using current locale.
+@@ -582,7 +595,7 @@ vim_strnicmp(char *s1, char *s2, size_t len)
+ * 128 to 255 correctly. It also doesn't return a pointer to the NUL at the
+ * end of the string.
+ */
+- char_u *
++ char_u *
+ vim_strchr(char_u *string, int c)
+ {
+ char_u	*p;
+diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
+index ab3bfdf..083f63e 100644
+--- a/src/testdir/test_cmdline.vim
++++ b/src/testdir/test_cmdline.vim
+@@ -574,6 +574,17 @@ func Test_getcompletion()
+ call assert_fails('call getcompletion("abc", )', 'E475:')
+ endfunc
+ 
++func Test_multibyte_expression()
++ " This was using uninitialized memory.
++ let lines =<< trim END
++ set verbose=6
++ norm @=ٷ
++ qall!
++ END
++ call writefile(lines, 'XmultiScript', 'D')
++ call RunVim('', '', '-u NONE -n -e -s -S XmultiScript')
++endfunc
++
+ " Test for getcompletion() with "fuzzy" in 'wildoptions'
+ func Test_getcompletion_wildoptions()
+ let save_wildoptions = &wildoptions
+-- 
+2.33.0
+

_service:tar_scm:backport-CVE-2023-0054.patch Added

@@ -0,0 +1,59 @@
+From 3ac1d97a1d9353490493d30088256360435f7731 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Wed, 4 Jan 2023 17:17:54 +0000
+Subject: PATCH patch 9.0.1145: invalid memory access with recursive
+ substitute expression
+
+Problem: Invalid memory access with recursive substitute expression.
+Solution: Check the return value of vim_regsub().
+---
+ src/eval.c | 5 +++++
+ src/testdir/test_substitute.vim | 16 ++++++++++++++++
+ 2 files changed, 21 insertions(+)
+
+diff --git a/src/eval.c b/src/eval.c
+index 2fbd867ab..9ca805061 100644
+--- a/src/eval.c
++++ b/src/eval.c
+@@ -6969,6 +6969,11 @@ do_string_sub(
+ 	 * - The text after the match.
+ 	 */
+ 	 sublen = vim_regsub(&regmatch, sub, expr, tail, 0, REGSUB_MAGIC);
++	 if (sublen <= 0)
++	 {
++		ga_clear(&ga);
++		break;
++	 }
+ 	 if (ga_grow(&ga, (int)((end - tail) + sublen -
+ 			 (regmatch.endp0 - regmatch.startp0))) == FAIL)
+ 	 {
+diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
+index 251322337..4268aab03 100644
+--- a/src/testdir/test_substitute.vim
++++ b/src/testdir/test_substitute.vim
+@@ -1095,6 +1095,22 @@ func Test_sub_expr_goto_other_file()
+ bwipe!
+ endfunc
+ 
++func Test_recursive_expr_substitute()
++ " this was reading invalid memory
++ let lines =<< trim END
++ func Repl(g, n)
++ s
++ r%:s000
++ endfunc
++ next 0
++ let caught = 0
++ s/\%')/\=Repl(0, 0)
++ qall!
++ END
++ call writefile(lines, 'XexprSubst', 'D')
++ call RunVim(, , '--clean -S XexprSubst')
++endfunc
++
+ " Test for the 2-letter and 3-letter :substitute commands
+ func Test_substitute_short_cmd()
+ new
+-- 
+2.27.0
+

_service:tar_scm:backport-CVE-2023-0288.patch Added

@@ -0,0 +1,44 @@
+From 232bdaaca98c34a99ffadf27bf6ee08be6cc8f6a Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Fri, 13 Jan 2023 14:17:58 +0000
+Subject: PATCH patch 9.0.1189: invalid memory access with folding and using
+ "L"
+
+Problem: Invalid memory access with folding and using "L".
+Solution: Prevent the cursor from moving to line zero.
+---
+ src/normal.c | 3 ++-
+ src/testdir/test_fold.vim | 8 ++++++++
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/src/normal.c b/src/normal.c
+index c319be599ad7..3d9f74dec558 100644
+--- a/src/normal.c
++++ b/src/normal.c
+@@ -3757,7 +3757,8 @@ nv_scroll(cmdarg_T *cap)
+ 		{
+ 		 (void)hasFolding(curwin->w_cursor.lnum,
+ 						&curwin->w_cursor.lnum, NULL);
+-		 --curwin->w_cursor.lnum;
++		 if (curwin->w_cursor.lnum > curwin->w_topline)
++			--curwin->w_cursor.lnum;
+ 		}
+ 	 }
+ 	 else
+diff --git a/src/testdir/test_fold.vim b/src/testdir/test_fold.vim
+index adf9e5207838..f915a661336b 100644
+--- a/src/testdir/test_fold.vim
++++ b/src/testdir/test_fold.vim
+@@ -1547,4 +1547,12 @@ func Test_sort_closed_fold()
+ bw!
+ endfunc
+ 
++func Test_indent_with_L_command()
++ " The "L" command moved the cursor to line zero, causing the text saved for
++ " undo to use line number -1, which caused trouble for undo later.
++ new
++ sil! norm 8R
&#x3;V{zf8=Lu
++ bwipe!
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab

_service:tar_scm:backport-CVE-2023-0433.patch Added

@@ -0,0 +1,40 @@
+From 11977f917506d950b7e0cae558bd9189260b253b Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Sat, 21 Jan 2023 13:09:19 +0000
+Subject: PATCH patch 9.0.1225: reading past the end of a line when
+ formatting text
+
+Problem: Reading past the end of a line when formatting text.
+Solution: Check for not going over the end of the line.
+---
+ src/textformat.c | 10 +++++++++-
+ 1 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/src/textformat.c b/src/textformat.c
+index 6a93890bd2c4..7ebbc8849a45 100644
+--- a/src/textformat.c
++++ b/src/textformat.c
+@@ -540,6 +540,9 @@ same_leader(
+ if (leader1_len == 0)
+ 	return (leader2_len == 0);
+ 
++ char_u *lnum_line = NULL;
++ int	 line_len = 0;
++
+ // If first leader has 'f' flag, the lines can be joined only if the
+ // second line does not have a leader.
+ // If first leader has 'e' flag, the lines can never be joined.
+@@ -555,7 +558,12 @@ same_leader(
+ 		return FALSE;
+ 	 if (*p == COM_START)
+ 	 {
+-		if (*(ml_get(lnum) + leader1_len) == NUL)
++		if (lnum_line == NULL)
++		{
++		 lnum_line = ml_get(lnum);
++		 line_len = (int)STRLEN(lnum_line);
++		}
++		if (line_len <= leader1_len)
+ 		 return FALSE;
+ 		if (leader2_flags == NULL || leader2_len == 0)
+ 		 return FALSE;

_service:tar_scm:backport-CVE-2023-1170.patch Added

@@ -0,0 +1,63 @@
+From 1c73b65229c25e3c1fd8824ba958f7cc4d604f9c Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Fri, 3 Mar 2023 21:11:52 +0000
+Subject: PATCH patch 9.0.1376: accessing invalid memory with put in Visual
+ block mode
+
+Problem: Accessing invalid memory with put in Visual block mode.
+Solution: Adjust the cursor column if needed.
+---
+ src/register.c | 11 ++++++++++-
+ src/testdir/test_put.vim | 11 +++++++++++
+ 2 files changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/src/register.c b/src/register.c
+index 4dc0a68fd7a4..461363be378d 100644
+--- a/src/register.c
++++ b/src/register.c
+@@ -1913,7 +1913,7 @@ do_put(
+ 		ptr += yanklen;
+ 
+ 		// insert block's trailing spaces only if there's text behind
+-		if ((j < count - 1 || !shortline) && spaces)
++		if ((j < count - 1 || !shortline) && spaces > 0)
+ 		{
+ 		 vim_memset(ptr, ' ', (size_t)spaces);
+ 		 ptr += spaces;
+@@ -2274,6 +2274,15 @@ do_put(
+ msgmore(nr_lines);
+ curwin->w_set_curswant = TRUE;
+ 
++ // Make sure the cursor is not after the NUL.
++ int len = (int)STRLEN(ml_get_curline());
++ if (curwin->w_cursor.col > len)
++ {
++	if (cur_ve_flags == VE_ALL)
++	 curwin->w_cursor.coladd = curwin->w_cursor.col - len;
++	curwin->w_cursor.col = len;
++ }
++
+ end:
+ if (cmdmod.cmod_flags & CMOD_LOCKMARKS)
+ {
+diff --git a/src/testdir/test_put.vim b/src/testdir/test_put.vim
+index 66438bd3f69c..a6cea74efb6c 100644
+--- a/src/testdir/test_put.vim
++++ b/src/testdir/test_put.vim
+@@ -231,5 +231,16 @@ func Test_put_visual_mode()
+ set selection&
+ endfunc
+ 
++func Test_put_visual_block_mode()
++ enew
++ exe "norm 0R\<CR>\<C-C>V"
++ sil exe "norm \<C-V>c	\<MiddleDrag>"
++ set ve=all
++ sil norm vz=p
++
++ bwipe!
++ set ve=
++endfunc
++
+ 
+ " vim: shiftwidth=2 sts=2 expandtab

_service:tar_scm:backport-CVE-2023-1175.patch Added

@@ -0,0 +1,47 @@
+From c99cbf8f289bdda5d4a77d7ec415850a520330ba Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Sat, 4 Mar 2023 14:13:10 +0000
+Subject: PATCH patch 9.0.1378: illegal memory access when using virtual
+ editing
+
+Problem: Illegal memory access when using virtual editing.
+Solution: Make sure "startspaces" is not negative.
+---
+ src/register.c | 2 ++
+ src/testdir/test_virtualedit.vim | 10 ++++++++++
+ 2 files changed, 12 insertions(+)
+
+diff --git a/src/register.c b/src/register.c
+index 461363be378d..f3df79cfd642 100644
+--- a/src/register.c
++++ b/src/register.c
+@@ -1247,6 +1247,8 @@ op_yank(oparg_T *oap, int deleting, int mess)
+ 				// double-count it.
+ 				bd.startspaces = (ce - cs + 1)
+ 							 - oap->start.coladd;
++				if (bd.startspaces < 0)
++				 bd.startspaces = 0;
+ 				startcol++;
+ 			 }
+ 			}
+diff --git a/src/testdir/test_virtualedit.vim b/src/testdir/test_virtualedit.vim
+index 71cea427bac1..edaae678609d 100644
+--- a/src/testdir/test_virtualedit.vim
++++ b/src/testdir/test_virtualedit.vim
+@@ -88,6 +88,16 @@ func Test_edit_change()
+ set virtualedit=
+ endfunc
+ 
++func Test_edit_special_char()
++ new
++ se ve=all
++ norm a&#x16;0
++ sil! exe "norm o00000\<Nul>k<a0s"
++
++ bwipe!
++ set virtualedit=
++endfunc
++
+ " Tests for pasting at the beginning, end and middle of a tab character
+ " in virtual edit mode.
+ func Test_paste_in_tab()

_service:tar_scm:backport-CVE-2023-1264.patch Added

@@ -0,0 +1,137 @@
+From 7ac5023a5f1a37baafbe1043645f97ba3443d9f6 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Tue, 7 Mar 2023 21:05:04 +0000
+Subject: PATCH patch 9.0.1392: using NULL pointer with nested :open command
+
+Problem: Using NULL pointer with nested :open command.
+Solution: Check that ccline.cmdbuff is not NULL.
+---
+ src/getchar.c | 17 ++++++++++-------
+ src/testdir/term_util.vim | 5 +++++
+ src/testdir/test_ex_mode.vim | 22 ++++++++++++++++++++++
+ 3 files changed, 37 insertions(+), 7 deletions(-)
+
+diff --git a/src/getchar.c b/src/getchar.c
+index 6645be8a0ebd..dac57eb26c61 100644
+--- a/src/getchar.c
++++ b/src/getchar.c
+@@ -3019,7 +3019,7 @@ check_end_reg_executing(int advance)
+ static int
+ vgetorpeek(int advance)
+ {
+- int		c, c1;
++ int		c;
+ int		timedout = FALSE;	// waited for more than 1 second
+ 					// for mapping to complete
+ int		mapdepth = 0;		// check for recursive mapping
+@@ -3386,7 +3386,7 @@ vgetorpeek(int advance)
+ #ifdef FEAT_CMDL_INFO
+ 		showcmd_idx = 0;
+ #endif
+-		c1 = 0;
++		int showing_partial = FALSE;
+ 		if (typebuf.tb_len > 0 && advance && !exmode_active)
+ 		{
+ 		 if (((State & (MODE_NORMAL | MODE_INSERT))
+@@ -3401,7 +3401,7 @@ vgetorpeek(int advance)
+ 			 edit_putchar(typebuf.tb_buftypebuf.tb_off
+ 						+ typebuf.tb_len - 1, FALSE);
+ 			 setcursor(); // put cursor back where it belongs
+-			 c1 = 1;
++			 showing_partial = TRUE;
+ 			}
+ #ifdef FEAT_CMDL_INFO
+ 			// need to use the col and row from above here
+@@ -3420,8 +3420,10 @@ vgetorpeek(int advance)
+ #endif
+ 		 }
+ 
+-		 // this looks nice when typing a dead character map
++		 // This looks nice when typing a dead character map.
++		 // There is no actual command line for get_number().
+ 		 if ((State & MODE_CMDLINE)
++ && get_cmdline_info()->cmdbuff != NULL
+ #if defined(FEAT_CRYPT) || defined(FEAT_EVAL)
+ 			 && cmdline_star == 0
+ #endif
+@@ -3430,7 +3432,7 @@ vgetorpeek(int advance)
+ 		 {
+ 			putcmdline(typebuf.tb_buftypebuf.tb_off
+ 						+ typebuf.tb_len - 1, FALSE);
+-			c1 = 1;
++			showing_partial = TRUE;
+ 		 }
+ 		}
+ 
+@@ -3466,11 +3468,12 @@ vgetorpeek(int advance)
+ 		if (showcmd_idx != 0)
+ 		 pop_showcmd();
+ #endif
+-		if (c1 == 1)
++ if (showing_partial)	
+ 		{
+ 		 if (State & MODE_INSERT)
+ 			edit_unputchar();
+-		 if (State & MODE_CMDLINE)
++		 if ((State & MODE_CMDLINE)
++					&& get_cmdline_info()->cmdbuff != NULL)
+ 			unputcmdline();
+ 		 else
+ 			setcursor();	// put cursor back where it belongs
+diff --git a/src/testdir/term_util.vim b/src/testdir/term_util.vim
+index 0f0373184505..88e2b33d083b 100644
+--- a/src/testdir/term_util.vim
++++ b/src/testdir/term_util.vim
+@@ -55,6 +55,7 @@ endfunc
+ " "cols" - width of the terminal window (max. 78)
+ " "statusoff" - number of lines the status is offset from default
+ " "wait_for_ruler" - if zero then don't wait for ruler to show
++" "no_clean" - if non-zero then remove "--clean" from the command
+ func RunVimInTerminal(arguments, options)
+ " If Vim doesn't exit a swap file remains, causing other tests to fail.
+ " Remove it here.
+@@ -91,6 +92,10 @@ func RunVimInTerminal(arguments, options)
+ 
+ let cmd = GetVimCommandCleanTerm() .. reset_u7 .. a:arguments
+ 
++ if get(a:options, 'no_clean', 0)
++ let cmd = substitute(cmd, '--clean', '', '')
++ endif
++
+ let options = #{curwin: 1}
+ if &termwinsize == ''
+ let options.term_rows = rows
+diff --git a/src/testdir/test_ex_mode.vim b/src/testdir/test_ex_mode.vim
+index a6602227638a..d03ec8f2d81d 100644
+--- a/src/testdir/test_ex_mode.vim
++++ b/src/testdir/test_ex_mode.vim
+@@ -134,6 +134,28 @@ func Test_open_command_flush_line()
+ bwipe!
+ endfunc
+ 
++" FIXME: this doesn't fail without the fix but hangs
++func Skip_Test_open_command_state()
++ " Tricky script that failed because State was not set properly
++ let lines =<< trim END
++ !ls 
++ 0scìi
++ so! Xsourced
++ set t_û0=0
++ v/-/o
++ END
++ call writefile(lines, 'XopenScript', '')
++
++ let sourced = "!f\u0083\x02\<Esc>z=0"
++ call writefile(sourced, 'Xsourced', 'b')
++
++ CheckRunVimInTerminal
++ let buf = RunVimInTerminal('-u NONE -i NONE -n -m -X -Z -e -s -S XopenScript -c qa!', #{rows: 6, wait_for_ruler: 0, no_clean: 1})
++ sleep 3
++
++ call StopVimInTerminal(buf)
++endfunc
++
+ " Test for :g/pat/visual to run vi commands in Ex mode
+ " This used to hang Vim before 8.2.0274.
+ func Test_Ex_global()
+

_service:tar_scm:backport-CVE-2023-2426.patch Added

@@ -0,0 +1,133 @@
+From caf642c25de526229264cab9425e7c9979f3509b Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Sat, 29 Apr 2023 21:38:04 +0100
+Subject: PATCH patch 9.0.1499: using uninitialized memory with fuzzy
+ matching
+
+Problem: Using uninitialized memory with fuzzy matching.
+Solution: Initialize the arrays used to store match positions.
+---
+ src/quickfix.c | 5 ++++-
+ src/search.c | 17 +++++++----------
+ src/testdir/test_matchfuzzy.vim | 27 +++++++++++++++++++++++++++
+ 3 files changed, 38 insertions(+), 11 deletions(-)
+
+diff --git a/src/quickfix.c b/src/quickfix.c
+index 13292e2f7515..553ad457880a 100644
+--- a/src/quickfix.c
++++ b/src/quickfix.c
+@@ -6005,6 +6005,8 @@ vgr_match_buflines(
+ long	lnum;
+ colnr_T	col;
+ int		pat_len = (int)STRLEN(spat);
++ if (pat_len > MAX_FUZZY_MATCHES)
++	pat_len = MAX_FUZZY_MATCHES;
+ 
+ for (lnum = 1; lnum <= buf->b_ml.ml_line_count && *tomatch > 0; ++lnum)
+ {
+@@ -6013,7 +6015,7 @@ vgr_match_buflines(
+ 	{
+ 	 // Regular expression match
+ 	 while (vim_regexec_multi(regmatch, curwin, buf, lnum,
+-			col, NULL) > 0)
++								col, NULL) > 0)
+ 	 {
+ 		// Pass the buffer number so that it gets used even for a
+ 		// dummy buffer, unless duplicate_name is set, then the
+@@ -6059,6 +6061,7 @@ vgr_match_buflines(
+ 	 int_u sz = ARRAY_LENGTH(matches);
+ 
+ 	 // Fuzzy string match
++	 CLEAR_FIELD(matches);
+ 	 while (fuzzy_match(str + col, spat, FALSE, &score, matches, sz) > 0)
+ 	 {
+ 		// Pass the buffer number so that it gets used even for a
+diff --git a/src/search.c b/src/search.c
+index 74ca8fefb2c5..5e3857078031 100644
+--- a/src/search.c
++++ b/src/search.c
+@@ -4407,14 +4407,14 @@ fuzzy_match_recursive(
+ 	// Found match
+ 	if (vim_tolower(c1) == vim_tolower(c2))
+ 	{
+-	 int_u	recursiveMatchesMAX_FUZZY_MATCHES;
+-	 int		recursiveScore = 0;
+-	 char_u	*next_char;
+-
+ 	 // Supplied matches buffer was too short
+ 	 if (nextMatch >= maxMatches)
+ 		return 0;
+ 
++	 int		recursiveScore = 0;
++	 int_u	recursiveMatchesMAX_FUZZY_MATCHES;
++	 CLEAR_FIELD(recursiveMatches);
++
+ 	 // "Copy-on-Write" srcMatches into matches
+ 	 if (first_match && srcMatches)
+ 	 {
+@@ -4423,10 +4423,7 @@ fuzzy_match_recursive(
+ 	 }
+ 
+ 	 // Recursive call that "skips" this match
+-	 if (has_mbyte)
+-		next_char = str + (*mb_ptr2len)(str);
+-	 else
+-		next_char = str + 1;
++	 char_u *next_char = str + (has_mbyte ? (*mb_ptr2len)(str) : 1);
+ 	 if (fuzzy_match_recursive(fuzpat, next_char, strIdx + 1,
+ 			&recursiveScore, strBegin, strLen, matches,
+ 			recursiveMatches,
+@@ -4491,8 +4488,8 @@ fuzzy_match_recursive(
+ * Uses char_u for match indices. Therefore patterns are limited to
+ * MAX_FUZZY_MATCHES characters.
+ *
+- * Returns TRUE if 'pat_arg' matches 'str'. Also returns the match score in
+- * 'outScore' and the matching character positions in 'matches'.
++ * Returns TRUE if "pat_arg" matches "str". Also returns the match score in
++ * "outScore" and the matching character positions in "matches".
+ */
+ int
+ fuzzy_match(
+diff --git a/src/testdir/test_matchfuzzy.vim b/src/testdir/test_matchfuzzy.vim
+index 502d136ccf2a..43eca8ff08af 100644
+--- a/src/testdir/test_matchfuzzy.vim
++++ b/src/testdir/test_matchfuzzy.vim
+@@ -2,6 +2,7 @@
+ 
+ source shared.vim
+ source check.vim
++source term_util.vim
+ 
+ " Test for matchfuzzy()
+ func Test_matchfuzzy()
+@@ -253,4 +254,30 @@ func Test_matchfuzzy_limit()
+ call assert_equal({'id': 5, 'val': 'crayon'}, l->matchfuzzy('c', #{key: 'val', limit: 1}))
+ endfunc
+ 
++" This was using uninitialized memory
++func Test_matchfuzzy_initialized()
++ CheckRunVimInTerminal
++
++ " This can take a very long time (esp. when using valgrind). Run in a
++ " separate Vim instance and kill it after two seconds. We only check for
++ " memory errors.
++ let lines =<< trim END
++ lvimgrep ss fg*
++ END
++ call writefile(lines, 'XTest_matchfuzzy', 'D')
++
++ let buf = RunVimInTerminal('-u NONE -X -Z', {})
++ call term_sendkeys(buf, ":source XTest_matchfuzzy\n")
++ call TermWait(buf, 2000)
++
++ let job = term_getjob(buf)
++ if job_status(job) == "run"
++ call job_stop(job, "int")
++ call TermWait(buf, 50)
++ endif
++
++ " clean up
++ call StopVimInTerminal(buf)
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab

_service:tar_scm:backport-CVE-2023-2609.patch Added

@@ -0,0 +1,54 @@
+From d1ae8366aff286d41e7f5bc513cc0a1af5130aad Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Tue, 9 May 2023 17:09:30 +0100
+Subject: PATCH patch 9.0.1531: crash when register contents ends up being
+ invalid
+
+Problem: Crash when register contents ends up being invalid.
+Solution: Check "y_array" is not NULL.
+---
+ src/register.c | 2 +-
+ src/testdir/test_registers.vim | 17 +++++++++++++++++
+ 2 files changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/src/register.c b/src/register.c
+index f3df79cfd642..e481d843c249 100644
+--- a/src/register.c
++++ b/src/register.c
+@@ -300,7 +300,7 @@ get_register(
+ 	if (copy)
+ 	{
+ 	 // If we run out of memory some or all of the lines are empty.
+-	 if (reg->y_size == 0)
++	 if (reg->y_size == 0 || y_current->y_array == NULL)
+ 		reg->y_array = NULL;
+ 	 else
+ 		reg->y_array = ALLOC_MULT(char_u *, reg->y_size);
+diff --git a/src/testdir/test_registers.vim b/src/testdir/test_registers.vim
+index e966932478d8..33ea0f4bd3e6 100644
+--- a/src/testdir/test_registers.vim
++++ b/src/testdir/test_registers.vim
+@@ -798,6 +798,23 @@ func Test_end_reg_executing()
+ bwipe!
+ endfunc
+ 
++" This was causing a crash because y_append was ending up being NULL
++func Test_zero_y_append()
++ " Run in a separate Vim instance because changing 'encoding' may cause
++ " trouble for later tests.
++ let lines =<< trim END
++ d
++ silent ?n
++ next <sfile>
++ so
++ sil! norm 0VPS&#x3;&#x11;P
++ set enc=latin1
++  
++ END
++ call writefile(lines, 'XTest_zero_y_append', 'D')
++ call RunVim(, , '-u NONE -i NONE -e -s -S XTest_zero_y_append -c qa\!')
++endfunc
++
+ " Make sure that y_append is correctly reset
+ " and the previous register is working as expected
+ func Test_register_y_append_reset()

_service:tar_scm:backport-CVE-2023-2610.patch Added

@@ -0,0 +1,97 @@
+From ab9a2d884b3a4abe319606ea95a5a6d6b01cd73a Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Tue, 9 May 2023 21:15:30 +0100
+Subject: PATCH patch 9.0.1532: crash when expanding "~" in substitute causes
+ very long text
+
+Problem: Crash when expanding "~" in substitute causes very long text.
+Solution: Limit the text length to MAXCOL.
+---
+ src/regexp.c | 30 +++++++++++++++++++-----------
+ src/testdir/test_substitute.vim | 14 ++++++++++++++
+ 2 files changed, 33 insertions(+), 11 deletions(-)
+
+diff --git a/src/regexp.c b/src/regexp.c
+index 33b36d11a8be..0e6c746df819 100644
+--- a/src/regexp.c
++++ b/src/regexp.c
+@@ -1723,10 +1723,7 @@ do_Lower(int *d, int c)
+ regtilde(char_u *source, int magic)
+ {
+ char_u	*newsub = source;
+- char_u	*tmpsub;
+ char_u	*p;
+- int		len;
+- int		prevlen;
+ 
+ for (p = newsub; *p; ++p)
+ {
+@@ -1735,24 +1732,35 @@ regtilde(char_u *source, int magic)
+ 	 if (reg_prev_sub != NULL)
+ 	 {
+ 		// length = len(newsub) - 1 + len(prev_sub) + 1
+-		prevlen = (int)STRLEN(reg_prev_sub);
+-		tmpsub = alloc(STRLEN(newsub) + prevlen);
++		// Avoid making the text longer than MAXCOL, it will cause
++		// trouble at some point.
++		size_t	prevsublen = STRLEN(reg_prev_sub);
++		size_t newsublen = STRLEN(newsub);
++		if (prevsublen > MAXCOL || newsublen > MAXCOL
++					 || newsublen + prevsublen > MAXCOL)
++		{
++		 emsg(_(e_resulting_text_too_long));
++		 break;
++		}
++
++		char_u *tmpsub = alloc(newsublen + prevsublen);
+ 		if (tmpsub != NULL)
+ 		{
+ 		 // copy prefix
+-		 len = (int)(p - newsub);	// not including ~
+-		 mch_memmove(tmpsub, newsub, (size_t)len);
++		 size_t prefixlen = p - newsub;	// not including ~
++		 mch_memmove(tmpsub, newsub, prefixlen);
+ 		 // interpret tilde
+-		 mch_memmove(tmpsub + len, reg_prev_sub, (size_t)prevlen);
++		 mch_memmove(tmpsub + prefixlen, reg_prev_sub,
++							 prevsublen);
+ 		 // copy postfix
+ 		 if (!magic)
+ 			++p;			// back off backslash
+-		 STRCPY(tmpsub + len + prevlen, p + 1);
++		 STRCPY(tmpsub + prefixlen + prevsublen, p + 1);
+ 
+-		 if (newsub != source)	// already allocated newsub
++		 if (newsub != source)	// allocated newsub before
+ 			vim_free(newsub);
+ 		 newsub = tmpsub;
+-		 p = newsub + len + prevlen;
++		 p = newsub + prefixlen + prevsublen;
+ 		}
+ 	 }
+ 	 else if (magic)
+diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
+index 7491b6163dc8..32e2f2785479 100644
+--- a/src/testdir/test_substitute.vim
++++ b/src/testdir/test_substitute.vim
+@@ -1394,6 +1394,20 @@ func Test_substitute_short_cmd()
+ bw!
+ endfunc
+ 
++" Check handling expanding "~" resulting in extremely long text.
++func Test_substitute_tilde_too_long()
++ enew!
++
++ s/.*/ixxx
++ s//~~~~~~~~~AAAAAAA@(
++
++ " Either fails with "out of memory" or "text too long".
++ " This can take a long time.
++ call assert_fails('sil! norm &&&&&&&&&', 'E1240:\|E342:')
++
++ bwipe!
++endfunc
++
+ " This should be done last to reveal a memory leak when vim_regsub_both() is
+ " called to evaluate an expression but it is not used in a second call.
+ func Test_z_substitute_expr_leak()

_service:tar_scm:backport-Configure-does-not-recognize-gcc-10.0-and-later.patch Deleted

@@ -1,49 +0,0 @@
-From 7077892a7918845a00ce8d7833b43cc6cbed2081 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Wed, 5 Feb 2020 20:44:24 +0100
-Subject: PATCH patch 8.2.0213: configure does not recognize gcc 10.0 and
- later
-
-Problem: Configure does not recognize gcc 10.0 and later.
-Solution: Adjust the pattern matching the version number. (Sergei
- Trofimovich, closes #5580)
----
- src/auto/configure | 2 +-
- src/configure.ac | 4 ++--
- 3 files changed, 5 insertions(+), 3 deletions(-)
-
-diff --git a/src/auto/configure b/src/auto/configure
-index 1b5094e972b2..59f3e68d63cf 100755
---- a/src/auto/configure
-+++ b/src/auto/configure
-@@ -14762,7 +14762,7 @@ DEPEND_CFLAGS_FILTER=
- if test "$GCC" = yes; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GCC 3 or later" >&5
- $as_echo_n "checking for GCC 3 or later... " >&6; }
-- gccmajor=`echo "$gccversion" | sed -e 's/^$1-9$\..*$/\1/g'`
-+ gccmajor=`echo "$gccversion" | sed -e 's/^$0-9\+$\..*$/\1/g'`
- if test "$gccmajor" -gt "2"; then
- DEPEND_CFLAGS_FILTER="| sed 's+-I */+-isystem /+g'"
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-diff --git a/src/configure.ac b/src/configure.ac
-index a098da82ec84..bf10eac5511b 100644
---- a/src/configure.ac
-+++ b/src/configure.ac
-@@ -2195,7 +2195,7 @@ else
- fi
- 
- dnl On my HPUX system the X include dir is found, but the lib dir not.
-- dnl This is a desparate try to fix this.
-+ dnl This is a desperate try to fix this.
- 
- if test -d "$x_includes" && test ! -d "$x_libraries"; then
- x_libraries=`echo "$x_includes" | sed s/include/lib/`
-@@ -4447,7 +4447,7 @@ dnl the number before the version number.
- DEPEND_CFLAGS_FILTER=
- if test "$GCC" = yes; then
- AC_MSG_CHECKING(for GCC 3 or later)
-- gccmajor=`echo "$gccversion" | sed -e 's/^$1-9$\..*$/\1/g'`
-+ gccmajor=`echo "$gccversion" | sed -e 's/^$0-9\+$\..*$/\1/g'`
- if test "$gccmajor" -gt "2"; then
- DEPEND_CFLAGS_FILTER="| sed 's+-I */+-isystem /+g'"
- AC_MSG_RESULT(yes)

_service:tar_scm:backport-PyEval_InitThreads-is-deprecated-in-Python-3.9.patch Deleted

@@ -1,90 +0,0 @@
-From efc0d94afc48a03b07955e91315e7e67945cd079 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sun, 11 Oct 2020 18:05:02 +0200
-Subject: PATCH patch 8.2.1834: PyEval_InitThreads() is deprecated in Python
- 3.9
-
-Problem: PyEval_InitThreads() is deprecated in Python 3.9.
-Solution: Do not call PyEval_InitThreads in Python 3.9 and later. (Ken
-Takata, closes #7113) Avoid warnings for functions.
----
- src/if_py_both.h | 8 ++++----
- src/if_python3.c | 21 +++++++++++----------
- 2 files changed, 15 insertions(+), 14 deletions(-)
-
-diff --git a/src/if_py_both.h b/src/if_py_both.h
-index 0763c65..63f4329 100644
---- a/src/if_py_both.h
-+++ b/src/if_py_both.h
-@@ -306,7 +306,7 @@ ObjectDir(PyObject *self, char **attributes)
- // Output buffer management
- 
- // Function to write a line, points to either msg() or emsg().
--typedef void (*writefn)(char_u *);
-+typedef int (*writefn)(char *);
- 
- static PyTypeObject OutputType;
- 
-@@ -358,8 +358,8 @@ PythonIO_Flush(void)
- {
- if (old_fn != NULL && io_ga.ga_len > 0)
- {
--	((char_u *)io_ga.ga_data)io_ga.ga_len = NUL;
--	old_fn((char_u *)io_ga.ga_data);
-+	((char *)io_ga.ga_data)io_ga.ga_len = NUL;
-+	old_fn((char *)io_ga.ga_data);
- }
- io_ga.ga_len = 0;
- }
-@@ -389,7 +389,7 @@ writer(writefn fn, char_u *str, PyInt n)
- 
- 	mch_memmove(((char *)io_ga.ga_data) + io_ga.ga_len, str, (size_t)len);
- 	((char *)io_ga.ga_data)io_ga.ga_len + len = NUL;
--	fn((char_u *)io_ga.ga_data);
-+	fn((char *)io_ga.ga_data);
- 	str = ptr + 1;
- 	n -= len + 1;
- 	io_ga.ga_len = 0;
-diff --git a/src/if_python3.c b/src/if_python3.c
-index 45dc308..7c9e140 100644
---- a/src/if_python3.c
-+++ b/src/if_python3.c
-@@ -958,11 +958,10 @@ Python3_Init(void)
- 
- 	Py_Initialize();
- 
--	// Initialise threads, and below save the state using
--	// PyEval_SaveThread. Without the call to PyEval_SaveThread, thread
--	// specific state (such as the system trace hook), will be lost
--	// between invocations of Python code.
-+#if PY_VERSION_HEX < 0x03090000
-+	// Initialise threads. This is deprecated since Python 3.9.
- 	PyEval_InitThreads();
-+#endif
- #ifdef DYNAMIC_PYTHON3
- 	get_py3_exceptions();
- #endif
-@@ -980,12 +979,14 @@ Python3_Init(void)
- 	// sys.path.
- 	PyRun_SimpleString("import vim; import sys; sys.path = list(filter(lambda x: not x.endswith('must>not&exist'), sys.path))");
- 
--	// lock is created and acquired in PyEval_InitThreads() and thread
--	// state is created in Py_Initialize()
--	// there _PyGILState_NoteThreadState() also sets gilcounter to 1
--	// (python must have threads enabled!)
--	// so the following does both: unlock GIL and save thread state in TLS
--	// without deleting thread state
-+	// Without the call to PyEval_SaveThread, thread specific state (such
-+	// as the system trace hook), will be lost between invocations of
-+	// Python code.
-+	// GIL may have been created and acquired in PyEval_InitThreads() and
-+	// thread state is created in Py_Initialize(); there
-+	// _PyGILState_NoteThreadState() also sets gilcounter to 1 (python must
-+	// have threads enabled!), so the following does both: unlock GIL and
-+	// save thread state in TLS without deleting thread state
- 	PyEval_SaveThread();
- 
- 	py3initialised = 1;
--- 
-1.8.3.1
-

_service:tar_scm:backport-Python-3.9-does-not-define-_Py_DEC_REFTOTAL.patch Deleted

_service:tar_scm:backport-Ruby-missing-function-prototype.patch Deleted

_service:tar_scm:backport-add-the-arglist_locked-flag.patch Deleted

@@ -1,173 +0,0 @@
-From 5ed58c7b700fcb9fd03c418300145b616f4bdcdd Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 28 Jan 2021 14:24:55 +0100
-Subject: PATCH patch 8.2.2421: double free when using autocommand with
- "argdel"
-Conflict:NA
-Reference:https://github.com/vim/vim/commit/5ed58c7b700fcb9fd03c418300145b616f4bdcdd
- 
-Problem: Double free when using autocommand with "argdel". (Houyunsong)
-Solution: Add the arglist_locked flag.
-
----
- src/arglist.c | 47 +++++++++++++++++++++++++++++-------
- src/testdir/test_autocmd.vim | 6 +++++
- 2 files changed, 44 insertions(+), 9 deletions(-)
-
-diff --git a/src/arglist.c b/src/arglist.c
-index cab74f8..68befa4 100644
---- a/src/arglist.c
-+++ b/src/arglist.c
-@@ -17,12 +17,29 @@
- #define AL_ADD	2
- #define AL_DEL	3
- 
-+// This flag is set whenever the argument list is being changed and calling a
-+// function that might trigger an autocommand.
-+static int arglist_locked = FALSE;
-+
-+ static int
-+check_arglist_locked(void)
-+{
-+ if (arglist_locked)
-+ {
-+	emsg(_(e_cannot_change_arglist_recursively));
-+	return FAIL;
-+ }
-+ return OK;
-+}
-+
- /*
- * Clear an argument list: free all file names and reset it to zero entries.
- */
- void
- alist_clear(alist_T *al)
- {
-+ if (check_arglist_locked() == FAIL)
-+	return;
- while (--al->al_ga.ga_len >= 0)
- 	vim_free(AARGLIST(al)al->al_ga.ga_len.ae_fname);
- ga_clear(&al->al_ga);
-@@ -126,14 +143,9 @@ alist_set(
- int		fnum_len)
- {
- int		i;
-- static int recursive = 0;
- 
-- if (recursive)
-- {
--	emsg(_(e_au_recursive));
-+ if (check_arglist_locked() == FAIL)
- 	return;
-- }
-- ++recursive;
- 
- alist_clear(al);
- if (ga_grow(&al->al_ga, count) == OK)
-@@ -152,7 +164,11 @@ alist_set(
- 	 // May set buffer name of a buffer previously used for the
- 	 // argument list, so that it's re-used by alist_add.
- 	 if (fnum_list != NULL && i < fnum_len)
-+	 {
-+		arglist_locked = TRUE;
- 		buf_set_name(fnum_listi, filesi);
-+		arglist_locked = FALSE;
-+	 }
- 
- 	 alist_add(al, filesi, use_curbuf ? 2 : 1);
- 	 ui_breakcheck();
-@@ -163,8 +179,6 @@ alist_set(
- 	FreeWild(count, files);
- if (al == &global_alist)
- 	arg_had_last = FALSE;
--
-- --recursive;
- }
- 
- /*
-@@ -179,6 +193,10 @@ alist_add(
- {
- if (fname == NULL)		// don't add NULL file names
- 	return;
-+ if (check_arglist_locked() == FAIL)
-+	return;
-+ arglist_locked = TRUE;
-+
- #ifdef BACKSLASH_IN_FILENAME
- slash_adjust(fname);
- #endif
-@@ -187,6 +205,8 @@ alist_add(
- 	AARGLIST(al)al->al_ga.ga_len.ae_fnum =
- 	 buflist_add(fname, BLN_LISTED | (set_fnum == 2 ? BLN_CURBUF : 0));
- ++al->al_ga.ga_len;
-+
-+ arglist_locked = FALSE;
- }
- 
- #if defined(BACKSLASH_IN_FILENAME) || defined(PROTO)
-@@ -334,7 +354,8 @@ alist_add_list(
- int		i;
- int		old_argcount = ARGCOUNT;
- 
-- if (ga_grow(&ALIST(curwin)->al_ga, count) == OK)
-+ if (check_arglist_locked() != FAIL
-+	 && ga_grow(&ALIST(curwin)->al_ga, count) == OK)
- {
- 	if (after < 0)
- 	 after = 0;
-@@ -343,6 +364,7 @@ alist_add_list(
- 	if (after < ARGCOUNT)
- 	 mch_memmove(&(ARGLISTafter + count), &(ARGLISTafter),
- 				 (ARGCOUNT - after) * sizeof(aentry_T));
-+	arglist_locked = TRUE;
- 	for (i = 0; i < count; ++i)
- 	{
- 	 int flags = BLN_LISTED | (will_edit ? BLN_CURBUF : 0);
-@@ -350,6 +372,7 @@ alist_add_list(
- 	 ARGLISTafter + i.ae_fname = filesi;
- 	 ARGLISTafter + i.ae_fnum = buflist_add(filesi, flags);
- 	}
-+	arglist_locked = FALSE;
- 	ALIST(curwin)->al_ga.ga_len += count;
- 	if (old_argcount > 0 && curwin->w_arg_idx >= after)
- 	 curwin->w_arg_idx += count;
-@@ -382,6 +405,9 @@ do_arglist(
- int		match;
- int		arg_escaped = TRUE;
- 
-+ if (check_arglist_locked() == FAIL)
-+	return FAIL;
-+
- // Set default argument for ":argadd" command.
- if (what == AL_ADD && *str == NUL)
- {
-@@ -776,6 +802,9 @@ ex_argdelete(exarg_T *eap)
- int		i;
- int		n;
- 
-+ if (check_arglist_locked() == FAIL)
-+	return;
-+
- if (eap->addr_count > 0 || *eap->arg == NUL)
- {
- 	// ":argdel" works like ":argdel"
-diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
-index ab02402..4fa3b51 100755
---- a/src/testdir/test_autocmd.vim
-+++ b/src/testdir/test_autocmd.vim
-@@ -147,6 +147,12 @@ func Test_autocmd_bufunload_with_tabnext()
- quit
- endfunc
- 
-+func Test_argdelete_in_next()
-+ au BufNew,BufEnter,BufLeave,BufWinEnter * argdel
-+ call assert_fails('next a b', 'E1156:')
-+ au! BufNew,BufEnter,BufLeave,BufWinEnter *
-+endfunc
-+
- func Test_autocmd_bufwinleave_with_tabfirst()
- tabedit
- augroup sample
--- 
-2.27.0
-

_service:tar_scm:backport-build-failure-with-Perl5.32.patch Deleted

@@ -1,50 +0,0 @@
-From f5433fbfe4324fd443664fb924116b5ed675bef5 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sun, 21 Jun 2020 20:06:54 +0200
-Subject: PATCH patch 8.2.1031: build failure with Perl5.32
-
-Problem: Build failure with Perl5.32.
-Solution: Define a few more functions. (Felix Yan, closes #6310)
----
- src/if_perl.xs | 19 +++++++++++++++++++
- 1 file changed, 19 insertions(+)
-
-diff --git a/src/if_perl.xs b/src/if_perl.xs
-index 099d386..5adccce 100644
---- a/src/if_perl.xs
-+++ b/src/if_perl.xs
-@@ -651,6 +651,11 @@ S_SvREFCNT_dec(pTHX_ SV *sv)
- }
- # endif
-
-+/* perl-5.32 needs Perl_SvREFCNT_dec */
-+# if (PERL_REVISION == 5) && (PERL_VERSION >= 32)
-+# define Perl_SvREFCNT_dec S_SvREFCNT_dec
-+# endif
-+
- /* perl-5.26 also needs S_TOPMARK and S_POPMARK. */
- # if (PERL_REVISION == 5) && (PERL_VERSION >= 26)
- PERL_STATIC_INLINE I32
-@@ -675,6 +680,20 @@ S_POPMARK(pTHX)
- }
- # endif
-
-+/* perl-5.32 needs Perl_POPMARK */
-+# if (PERL_REVISION == 5) && (PERL_VERSION >= 32)
-+# define Perl_POPMARK S_POPMARK
-+
-+/* perl-5.32 needs Perl_SvTRUE */
-+PERL_STATIC_INLINE bool
-+Perl_SvTRUE(pTHX_ SV *sv) {
-+ if (!LIKELY(sv))
-+ return FALSE;
-+ SvGETMAGIC(sv);
-+ return SvTRUE_nomg_NN(sv);
-+}
-+# endif
-+
- /*
- * Make all runtime-links of perl.
- *
---
-2.27.0
\ No newline at end of file

_service:tar_scm:backport-build-failure-with-Ruby-3.0-and-32-bits.patch Deleted

_service:tar_scm:backport-build-failure-with-some-Ruby-versions.patch Deleted

@@ -1,294 +0,0 @@
-From dace9f785fca6cc802b2fb7f11a5ee4fab896432 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Mon, 28 Dec 2020 15:07:45 +0100
-Subject: PATCH patch 8.2.2235: build failure with some Ruby versions
-
-Problem: Build failure with some Ruby versions.
-Solution: Adjust the code for Ruby 3.0. (Ozaki Kiichi, closes #7564)
----
- src/if_ruby.c | 143 ++++++++++++++++++++++++++++++++++++----------------------
- 1 file changed, 89 insertions(+), 54 deletions(-)
-
-diff --git a/src/if_ruby.c b/src/if_ruby.c
-index 906a902..d21a655 100644
---- a/src/if_ruby.c
-+++ b/src/if_ruby.c
-@@ -32,8 +32,9 @@
- # define RUBYEXTERN extern
- #endif
- 
--#if defined(DYNAMIC_RUBY) && RUBY_VERSION >= 24
--# define USE_RUBY_INTEGER
-+// suggested by Ariya Mizutani
-+#if (_MSC_VER == 1200)
-+# undef _WIN32_WINNT
- #endif
- 
- #ifdef DYNAMIC_RUBY
-@@ -42,6 +43,10 @@
- * definition. This function use these variables. But we want function to
- * use dll_* variables.
- */
-+# if RUBY_VERSION >= 24
-+# define USE_RUBY_INTEGER
-+# endif
-+
- # define rb_cFalseClass		(*dll_rb_cFalseClass)
- # define rb_cFixnum		(*dll_rb_cFixnum)
- # if defined(USE_RUBY_INTEGER)
-@@ -54,6 +59,7 @@
- # define rb_cString		(*dll_rb_cString)
- # define rb_cSymbol		(*dll_rb_cSymbol)
- # define rb_cTrueClass		(*dll_rb_cTrueClass)
-+
- # if RUBY_VERSION >= 18
- /*
- * On ver 1.8, all Ruby functions are exported with "__declspec(dllimport)"
-@@ -64,40 +70,41 @@
- # define RUBY_EXPORT
- # endif
- 
--#endif // ifdef DYNAMIC_RUBY
--
--// suggested by Ariya Mizutani
--#if (_MSC_VER == 1200)
--# undef _WIN32_WINNT
--#endif
--
--#if defined(DYNAMIC_RUBY) && RUBY_VERSION >= 19
-+# if RUBY_VERSION >= 19
- // Ruby 1.9 defines a number of static functions which use rb_num2long and
- // rb_int2big
--# define rb_num2long rb_num2long_stub
--# define rb_int2big rb_int2big_stub
--#endif
-+# define rb_num2long rb_num2long_stub
-+# define rb_int2big rb_int2big_stub
- 
--#if defined(DYNAMIC_RUBY) && RUBY_VERSION >= 19 \
--	&& VIM_SIZEOF_INT < VIM_SIZEOF_LONG
-+# if RUBY_VERSION >= 30 || VIM_SIZEOF_INT < VIM_SIZEOF_LONG
- // Ruby 1.9 defines a number of static functions which use rb_fix2int and
- // rb_num2int if VIM_SIZEOF_INT < VIM_SIZEOF_LONG (64bit)
--# define rb_fix2int rb_fix2int_stub
--# define rb_num2int rb_num2int_stub
--#endif
-+# define rb_fix2int rb_fix2int_stub
-+# define rb_num2int rb_num2int_stub
-+# endif
-+# endif
- 
--#if defined(DYNAMIC_RUBY) && RUBY_VERSION == 21
-+# if RUBY_VERSION == 21
- // Ruby 2.1 adds new GC called RGenGC and RARRAY_PTR uses
- // rb_gc_writebarrier_unprotect_promoted if USE_RGENGC
--# define rb_gc_writebarrier_unprotect_promoted rb_gc_writebarrier_unprotect_promoted_stub
--#endif
--#if defined(DYNAMIC_RUBY) && RUBY_VERSION >= 22
--# define rb_gc_writebarrier_unprotect rb_gc_writebarrier_unprotect_stub
--#endif
-+# define rb_gc_writebarrier_unprotect_promoted rb_gc_writebarrier_unprotect_promoted_stub
-+# endif
- 
--#if defined(DYNAMIC_RUBY) && RUBY_VERSION >= 26
--# define rb_ary_detransient rb_ary_detransient_stub
--#endif
-+# if RUBY_VERSION >= 22
-+# define rb_gc_writebarrier_unprotect rb_gc_writebarrier_unprotect_stub
-+# endif
-+
-+# if RUBY_VERSION >= 26
-+# define rb_ary_detransient rb_ary_detransient_stub
-+# endif
-+
-+# if RUBY_VERSION >= 30
-+# define rb_check_type rb_check_type_stub
-+# define rb_num2uint rb_num2uint_stub
-+# define ruby_malloc_size_overflow ruby_malloc_size_overflow_stub
-+# endif
-+
-+#endif // ifdef DYNAMIC_RUBY
- 
- #include <ruby.h>
- #if RUBY_VERSION >= 19
-@@ -212,7 +219,9 @@ static int ruby_convert_to_vim_value(VALUE val, typval_T *rettv);
- # define rb_assoc_new			dll_rb_assoc_new
- # define rb_cObject			(*dll_rb_cObject)
- # define rb_class_new_instance		dll_rb_class_new_instance
--# define rb_check_type			dll_rb_check_type
-+# if RUBY_VERSION < 30
-+# define rb_check_type			dll_rb_check_type
-+# endif
- # ifdef USE_TYPEDDATA
- # define rb_check_typeddata		dll_rb_check_typeddata
- # endif
-@@ -263,7 +272,9 @@ static int ruby_convert_to_vim_value(VALUE val, typval_T *rettv);
- # define rb_fix2int			dll_rb_fix2int
- # define rb_num2int			dll_rb_num2int
- # endif
--# define rb_num2uint			dll_rb_num2uint
-+# if RUBY_VERSION < 30
-+# define rb_num2uint			dll_rb_num2uint
-+# endif
- # endif
- # define rb_num2dbl			dll_rb_num2dbl
- # define rb_lastline_get			dll_rb_lastline_get
-@@ -481,7 +492,7 @@ static rb_encoding* (*dll_rb_enc_find) (const char*);
- static VALUE (*dll_rb_enc_str_new) (const char*, long, rb_encoding*);
- static VALUE (*dll_rb_sprintf) (const char*, ...);
- static VALUE (*dll_rb_require) (const char*);
--static void* (*ruby_options)(int, char**);
-+static void* (*dll_ruby_options)(int, char**);
- # endif
- 
- # if defined(USE_RGENGC) && USE_RGENGC
-@@ -492,32 +503,38 @@ static void (*dll_rb_gc_writebarrier_unprotect)(VALUE obj);
- # endif
- # endif
- 
-+# if RUBY_VERSION >= 30
-+NORETURN(static void (*dll_ruby_malloc_size_overflow)(size_t, size_t));
-+# endif
-+
- # if RUBY_VERSION >= 26
- void rb_ary_detransient_stub(VALUE x);
- # endif
- 
--# if (RUBY_VERSION >= 19) && !defined(PROTO)
--# if RUBY_VERSION >= 22
-+// Do not generate a prototype here, VALUE isn't always defined.
-+# ifndef PROTO
-+# if RUBY_VERSION >= 19
-+# if RUBY_VERSION >= 22
- long
- rb_num2long_stub(VALUE x)
--# else
-+# else
- SIGNED_VALUE
- rb_num2long_stub(VALUE x)
--# endif
-+# endif
- {
- return dll_rb_num2long(x);
- }
--# if RUBY_VERSION >= 26
-+# if RUBY_VERSION >= 26
- VALUE
- rb_int2big_stub(intptr_t x)
--# else
-+# else
- VALUE
- rb_int2big_stub(SIGNED_VALUE x)
--# endif
-+# endif
- {
- return dll_rb_int2big(x);
- }
--# if (RUBY_VERSION >= 19) && (VIM_SIZEOF_INT < VIM_SIZEOF_LONG)
-+# if VIM_SIZEOF_INT < VIM_SIZEOF_LONG
- long
- rb_fix2int_stub(VALUE x)
- {
-@@ -528,50 +545,65 @@ rb_num2int_stub(VALUE x)
- {
- return dll_rb_num2int(x);
- }
--# endif
--# if RUBY_VERSION >= 20
-+# endif
-+# if RUBY_VERSION >= 20

_service:tar_scm:backport-build-problem-with-Ruby-2.7.patch Deleted

@@ -1,121 +0,0 @@
-From d5a986f460019a924627d79350552f446505cffb Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sun, 6 Dec 2020 21:11:31 +0100
-Subject: PATCH patch 8.2.2104: build problem with Ruby 2.7
-
-Problem: Build problem with Ruby 2.7.
-Solution: Adjust function declarations. (Ozaki Kiichi, closes #7430)
----
- src/auto/configure | 3 +--
- src/configure.ac | 3 +--
- src/if_ruby.c | 28 ++++++++++++++++++++--------
- 3 files changed, 22 insertions(+), 12 deletions(-)
-
-diff --git a/src/auto/configure b/src/auto/configure
-index c50f4bc..9a0c1e6 100755
---- a/src/auto/configure
-+++ b/src/auto/configure
-@@ -7590,8 +7590,7 @@ $as_echo "$rubyhdrdir" >&6; }
- 	librubyarg=`$vi_cv_path_ruby -r rbconfig -e "print $ruby_rbconfig.expand($ruby_rbconfig::CONFIG'LIBRUBYARG')"`
- 	librubya=`$vi_cv_path_ruby -r rbconfig -e "print $ruby_rbconfig.expand($ruby_rbconfig::CONFIG'LIBRUBY_A')"`
- 	rubylibdir=`$vi_cv_path_ruby -r rbconfig -e "print $ruby_rbconfig.expand($ruby_rbconfig::CONFIG'libdir')"`
--	if test -f "$rubylibdir/$librubya"; then
--	 librubyarg="$librubyarg"
-+	if test -f "$rubylibdir/$librubya" || expr "$librubyarg" : "-lruby"; then
- 	 RUBY_LIBS="$RUBY_LIBS -L$rubylibdir"
- 	elif test "$librubyarg" = "libruby.a"; then
- 	 	 librubyarg="-lruby"
-diff --git a/src/configure.ac b/src/configure.ac
-index f0e8371..e796d0e 100644
---- a/src/configure.ac
-+++ b/src/configure.ac
-@@ -1932,8 +1932,7 @@ if test "$enable_rubyinterp" = "yes" -o "$enable_rubyinterp" = "dynamic"; then
- 	librubyarg=`$vi_cv_path_ruby -r rbconfig -e "print $ruby_rbconfig.expand($ruby_rbconfig::CONFIG'LIBRUBYARG')"`
- 	librubya=`$vi_cv_path_ruby -r rbconfig -e "print $ruby_rbconfig.expand($ruby_rbconfig::CONFIG'LIBRUBY_A')"`
- 	rubylibdir=`$vi_cv_path_ruby -r rbconfig -e "print $ruby_rbconfig.expand($ruby_rbconfig::CONFIG'libdir')"`
--	if test -f "$rubylibdir/$librubya"; then
--	 librubyarg="$librubyarg"
-+	if test -f "$rubylibdir/$librubya" || expr "$librubyarg" : "-lruby"; then
- 	 RUBY_LIBS="$RUBY_LIBS -L$rubylibdir"
- 	elif test "$librubyarg" = "libruby.a"; then
- 	 dnl required on Mac OS 10.3 where libruby.a doesn't exist
-diff --git a/src/if_ruby.c b/src/if_ruby.c
-index 68d5582..d0f8acf 100644
---- a/src/if_ruby.c
-+++ b/src/if_ruby.c
-@@ -1296,13 +1296,19 @@ vim_blob(VALUE self UNUSED, VALUE str)
- }
- 
- static VALUE
--buffer_s_current(void)
-+buffer_s_current(VALUE self UNUSED)
- {
- return buffer_new(curbuf);
- }
- 
- static VALUE
--buffer_s_count(void)
-+buffer_s_current_getter(ID id UNUSED, VALUE *x UNUSED)
-+{
-+ return buffer_new(curbuf);
-+}
-+
-+ static VALUE
-+buffer_s_count(VALUE self UNUSED)
- {
- buf_T *b;
- int n = 0;
-@@ -1562,7 +1568,13 @@ get_win(VALUE obj)
- }
- 
- static VALUE
--window_s_current(void)
-+window_s_current(VALUE self UNUSED)
-+{
-+ return window_new(curwin);
-+}
-+
-+ static VALUE
-+window_s_current_getter(ID id UNUSED, VALUE *x UNUSED)
- {
- return window_new(curwin);
- }
-@@ -1572,7 +1584,7 @@ window_s_current(void)
- * SegPhault - 03/07/05
- */
- static VALUE
--line_s_current(void)
-+line_s_current(VALUE self UNUSED)
- {
- return get_buffer_line(curbuf, curwin->w_cursor.lnum);
- }
-@@ -1584,13 +1596,13 @@ set_current_line(VALUE self UNUSED, VALUE str)
- }
- 
- static VALUE
--current_line_number(void)
-+current_line_number(VALUE self UNUSED)
- {
- return INT2FIX((int)curwin->w_cursor.lnum);
- }
- 
- static VALUE
--window_s_count(void)
-+window_s_count(VALUE self UNUSED)
- {
- win_T	*w;
- int n = 0;
-@@ -1790,8 +1802,8 @@ ruby_vim_init(void)
- rb_define_method(cVimWindow, "cursor", window_cursor, 0);
- rb_define_method(cVimWindow, "cursor=", window_set_cursor, 1);
- 
-- rb_define_virtual_variable("$curbuf", buffer_s_current, 0);
-- rb_define_virtual_variable("$curwin", window_s_current, 0);
-+ rb_define_virtual_variable("$curbuf", buffer_s_current_getter, 0);
-+ rb_define_virtual_variable("$curwin", window_s_current_getter, 0);
- }
- 
- void
--- 
-2.13.7
-

_service:tar_scm:backport-cannot-build-with-Perl-5.34.patch Deleted

@@ -1,61 +0,0 @@
-From 543467136f001708f4c63376ac5d18adde82db30 Mon Sep 17 00:00:00 2001
-From: ichizok <gclient.gaap@gmail.com>
-Date: Thu, 27 May 2021 18:05:14 +0200
-Subject: PATCH patch 8.2.2891: cannot build with Perl 5.34
-
-Problem: Cannot build with Perl 5.34.
-Solution: Add Perl_SvTRUE_common(). (Ozaki Kiichi, closes #8266,
- closes #8250)
----
- src/if_perl.xs | 31 ++++++++++++++++++++++++++++++-
- 1 file changed, 30 insertions(+), 1 deletion(-)
-
-diff --git a/src/if_perl.xs b/src/if_perl.xs
-index 99fc3cb..39daa8e 100644
---- a/src/if_perl.xs
-+++ b/src/if_perl.xs
-@@ -692,12 +692,41 @@ S_POPMARK(pTHX)
- /* perl-5.32 needs Perl_POPMARK */
- # if (PERL_REVISION == 5) && (PERL_VERSION >= 32)
- # define Perl_POPMARK S_POPMARK
-+# endif
-+
-+/* perl-5.34 needs Perl_SvTRUE_common; used in SvTRUE_nomg_NN */
-+# if (PERL_REVISION == 5) && (PERL_VERSION >= 34)
-+PERL_STATIC_INLINE bool
-+Perl_SvTRUE_common(pTHX_ SV * sv, const bool sv_2bool_is_fallback)
-+{
-+ if (UNLIKELY(SvIMMORTAL_INTERP(sv)))
-+ return SvIMMORTAL_TRUE(sv);
-+
-+ if (! SvOK(sv))
-+ return FALSE;
-+
-+ if (SvPOK(sv))
-+ return SvPVXtrue(sv);
-+
-+ if (SvIOK(sv))
-+ return SvIVX(sv) != 0; /* casts to bool */
-+
-+ if (SvROK(sv) && !(SvOBJECT(SvRV(sv)) && HvAMAGIC(SvSTASH(SvRV(sv)))))
-+ return TRUE;
-+
-+ if (sv_2bool_is_fallback)
-+ return sv_2bool_nomg(sv);
-+
-+ return isGV_with_GP(sv);
-+}
-+# endif
-
- /* perl-5.32 needs Perl_SvTRUE */
-+# if (PERL_REVISION == 5) && (PERL_VERSION >= 32)
- PERL_STATIC_INLINE bool
- Perl_SvTRUE(pTHX_ SV *sv) {
- if (!LIKELY(sv))
-- return FALSE;
-+ return FALSE;
- SvGETMAGIC(sv);
- return SvTRUE_nomg_NN(sv);
- }
---
-2.27.0
\ No newline at end of file

_service:tar_scm:backport-cannot-build-with-Strawberry-Perl-5.32.0.patch Deleted

@@ -1,48 +0,0 @@
-From 895a7a472d2eb4413e63cdad3213cb1ef1633458 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 10 Sep 2020 21:36:11 +0200
-Subject: PATCH patch 8.2.1655: cannot build with Strawberry Perl 5.32.0
-
-Problem: Cannot build with Strawberry Perl 5.32.0.
-Solution: Use Perl_sv_2pvbyte_flags. (closes #6921)
----
- src/if_perl.xs | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/src/if_perl.xs b/src/if_perl.xs
-index 2049509..9f59d39 100644
---- a/src/if_perl.xs
-+++ b/src/if_perl.xs
-@@ -236,6 +236,9 @@ typedef int perl_key;
- # else
- # define Perl_sv_2pv dll_Perl_sv_2pv
- # endif
-+# if (PERL_REVISION == 5) && (PERL_VERSION >= 32)
-+# define Perl_sv_2pvbyte_flags dll_Perl_sv_2pvbyte_flags
-+# endif
- # define Perl_sv_2pvbyte dll_Perl_sv_2pvbyte
- # define Perl_sv_bless dll_Perl_sv_bless
- # if (PERL_REVISION == 5) && (PERL_VERSION >= 8)
-@@ -390,6 +393,9 @@ static char* (*Perl_sv_2pv_nolen)(pTHX_ SV*);
- static char* (*Perl_sv_2pv)(pTHX_ SV*, STRLEN*);
- # endif
- static char* (*Perl_sv_2pvbyte)(pTHX_ SV*, STRLEN*);
-+# if (PERL_REVISION == 5) && (PERL_VERSION >= 32)
-+static char* (*Perl_sv_2pvbyte_flags)(pTHX_ SV*, STRLEN*, I32);
-+# endif
- static SV* (*Perl_sv_bless)(pTHX_ SV*, HV*);
- # if (PERL_REVISION == 5) && (PERL_VERSION >= 8)
- static void (*Perl_sv_catpvn_flags)(pTHX_ SV* , const char*, STRLEN, I32);
-@@ -546,6 +552,9 @@ static struct {
- {"Perl_sv_2pv", (PERL_PROC*)&Perl_sv_2pv},
- # endif
- {"Perl_sv_2pvbyte", (PERL_PROC*)&Perl_sv_2pvbyte},
-+# if (PERL_REVISION == 5) && (PERL_VERSION >= 32)
-+ {"Perl_sv_2pvbyte_flags", (PERL_PROC*)&Perl_sv_2pvbyte_flags},
-+# endif
- # ifdef PERL589_OR_LATER
- {"Perl_sv_2iv_flags", (PERL_PROC*)&Perl_sv_2iv_flags},
- {"Perl_newXS_flags", (PERL_PROC*)&Perl_newXS_flags},
--- 
-2.13.7
-

_service:tar_scm:backport-command-line-editing-not-sufficiently-tested.patch Deleted

@@ -1,187 +0,0 @@
-From 59cb041d0a56d8555857da7e063ec61504ee1fa7 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Wed, 18 Dec 2019 22:26:31 +0100
-Subject: PATCH patch 8.2.0023: command line editing not sufficiently tested
-Problem: Command line editing not sufficiently tested.
-Solution: Add more tests. (Dominique Pelle, closes #5374)
-
-Reference:https://github.com/vim/vim/commit/59cb041d0a56d8555857da7e063ec61504ee1fa7
----
- src/testdir/Make_all.mak | 1 +
- src/testdir/test_alot.vim | 1 +
- src/testdir/test_cmdline.vim | 56 +++++++++++++++++++++++++++++++++-----------
- src/testdir/test_ex_mode.vim | 54 ++++++++++++++++++++++++++++++++++++
- 4 files changed, 98 insertions(+), 14 deletions(-)
- create mode 100644 src/testdir/test_ex_mode.vim
-
-diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
-index 665bcc7..05e7a2c 100644
---- a/src/testdir/Make_all.mak
-+++ b/src/testdir/Make_all.mak
-@@ -102,6 +102,7 @@ NEW_TESTS = \
- 	test_ex_equal \
- 	test_ex_undo \
- 	test_ex_z \
-+	test_ex_mode \
- 	test_excmd \
- 	test_exec_while_if \
- 	test_execute_func \
-diff --git a/src/testdir/test_alot.vim b/src/testdir/test_alot.vim
-index 894ec58..25241b2 100644
---- a/src/testdir/test_alot.vim
-+++ b/src/testdir/test_alot.vim
-@@ -13,6 +13,7 @@ source test_delete.vim
- source test_ex_equal.vim
- source test_ex_undo.vim
- source test_ex_z.vim
-+source test_ex_mode.vim
- source test_execute_func.vim
- source test_expand.vim
- source test_expand_dllpath.vim
-diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
-index 5297951..837ef63 100644
---- a/src/testdir/test_cmdline.vim
-+++ b/src/testdir/test_cmdline.vim
-@@ -419,7 +419,7 @@ func Test_expand_star_star()
- call delete('a', 'rf')
- endfunc
- 
--func Test_paste_in_cmdline()
-+func Test_cmdline_paste()
- let @a = "def"
- call feedkeys(":abc \<C-R>a ghi\<C-B>\"\<CR>", 'tx')
- call assert_equal('"abc def ghi', @:)
-@@ -459,18 +459,37 @@ func Test_paste_in_cmdline()
- bwipe!
- endfunc
- 
--func Test_remove_char_in_cmdline()
-- call feedkeys(":abc def\<S-Left>\<Del>\<C-B>\"\<CR>", 'tx')
-- call assert_equal('"abc ef', @:)
-+func Test_cmdline_remove_char()
-+ let encoding_save = &encoding
-+
-+ for e in 'utf8', 'latin1'
-+ exe 'set encoding=' . e
-+
-+ call feedkeys(":abc def\<S-Left>\<Del>\<C-B>\"\<CR>", 'tx')
-+ call assert_equal('"abc ef', @:, e)
-+
-+ call feedkeys(":abc def\<S-Left>\<BS>\<C-B>\"\<CR>", 'tx')
-+ call assert_equal('"abcdef', @:)
-+
-+ call feedkeys(":abc def ghi\<S-Left>\<C-W>\<C-B>\"\<CR>", 'tx')
-+ call assert_equal('"abc ghi', @:, e)
- 
-- call feedkeys(":abc def\<S-Left>\<BS>\<C-B>\"\<CR>", 'tx')
-- call assert_equal('"abcdef', @:)
-+ call feedkeys(":abc def\<S-Left>\<C-U>\<C-B>\"\<CR>", 'tx')
-+ call assert_equal('"def', @:, e)
-+ endfor
-+
-+ let &encoding = encoding_save
-+endfunc
- 
-- call feedkeys(":abc def ghi\<S-Left>\<C-W>\<C-B>\"\<CR>", 'tx')
-- call assert_equal('"abc ghi', @:)
-+func Test_cmdline_keymap_ctrl_hat()
-+ if !has('keymap')
-+ return
-+ endif
- 
-- call feedkeys(":abc def\<S-Left>\<C-U>\<C-B>\"\<CR>", 'tx')
-- call assert_equal('"def', @:)
-+ set keymap=esperanto
-+ call feedkeys(":\"Jxauxdo \<C-^>Jxauxdo \<C-^>Jxauxdo\<CR>", 'tx')
-+ call assert_equal('"Jxauxdo Ĵaŭdo Jxauxdo', @:)
-+ set keymap=
- endfunc
- 
- func Test_illegal_address1()
-@@ -741,20 +760,20 @@ func Test_cmdline_overstrike()
- 
- " Test overstrike in the middle of the command line.
- call feedkeys(":\"01234\<home>\<right>\<right>ab\<right>\<insert>cd\<enter>", 'xt')
-- call assert_equal('"0ab1cd4', @:)
-+ call assert_equal('"0ab1cd4', @:, e)
- 
- " Test overstrike going beyond end of command line.
- call feedkeys(":\"01234\<home>\<right>\<right>ab\<right>\<insert>cdefgh\<enter>", 'xt')
-- call assert_equal('"0ab1cdefgh', @:)
-+ call assert_equal('"0ab1cdefgh', @:, e)
- 
- " Test toggling insert/overstrike a few times.
- call feedkeys(":\"01234\<home>\<right>ab\<right>\<insert>cd\<right>\<insert>ef\<enter>", 'xt')
-- call assert_equal('"ab0cd3ef4', @:)
-+ call assert_equal('"ab0cd3ef4', @:, e)
- endfor
- 
- " Test overstrike with multi-byte characters.
- call feedkeys(":\"テキストエディタ\<home>\<right>\<right>ab\<right>\<insert>cd\<enter>", 'xt')
-- call assert_equal('"テabキcdエディタ', @:)
-+ call assert_equal('"テabキcdエディタ', @:, e)
- 
- let &encoding = encoding_save
- endfunc
-diff --git a/src/testdir/test_ex_mode.vim b/src/testdir/test_ex_mode.vim
-new file mode 100644
-index 0000000..00a35a3
---- /dev/null
-+++ b/src/testdir/test_ex_mode.vim
-@@ -0,0 +1,54 @@
-+" Test editing line in Ex mode (see :help Q and :help gQ).
-+
-+" Helper function to test editing line in Q Ex mode
-+func Ex_Q(cmd)
-+ " Is there a simpler way to test editing Ex line?
-+ call feedkeys("Q"
-+ \ .. "let s:test_ex =<< END\<CR>"
-+ \ .. a:cmd .. "\<CR>"
-+ \ .. "END\<CR>"
-+ \ .. "visual\<CR>", 'tx')
-+ return s:test_ex0
-+endfunc
-+
-+" Helper function to test editing line in gQ Ex mode
-+func Ex_gQ(cmd)
-+ call feedkeys("gQ" .. a:cmd .. "\<C-b>\"\<CR>", 'tx')
-+ let ret = @:1: " Remove leading quote.
-+ call feedkeys("visual\<CR>", 'tx')
-+ return ret
-+endfunc
-+
-+" Helper function to test editing line with both Q and gQ Ex mode.
-+func Ex(cmd)
-+ return Ex_Q(a:cmd), Ex_gQ(a:cmd)
-+endfunc
-+
-+" Test editing line in Ex mode (both Q and gQ)
-+func Test_ex_mode()
-+ let encoding_save = &encoding
-+ set sw=2
-+
-+ for e in 'utf8', 'latin1'
-+ exe 'set encoding=' . e
-+
-+ call assert_equal('bar', 'bar', Ex("foo bar\<C-u>bar"), e)
-+ call assert_equal("1\<C-u>2", "1\<C-u>2", Ex("1\<C-v>\<C-u>2"), e)
-+ call assert_equal("1\<C-b>2\<C-e>3", '213', Ex("1\<C-b>2\<C-e>3"), e)
-+ call assert_equal('0123', '2013', Ex("01\<Home>2\<End>3"), e)
-+ call assert_equal('0123', '0213', Ex("01\<Left>2\<Right>3"), e)
-+ call assert_equal('01234', '0342', Ex("012\<Left>\<Left>\<Insert>3\<Insert>4"), e)
-+ call assert_equal("foo bar\<C-w>", 'foo ', Ex("foo bar\<C-w>"), e)
-+ call assert_equal('foo', 'foo', Ex("fooba\<Del>\<Del>"), e)
-+ call assert_equal("foo\tbar", 'foobar', Ex("foo\<Tab>bar"), e)
-+ call assert_equal("abbrev\t", 'abbreviate', Ex("abbrev\<Tab>"), e)
-+ call assert_equal(' 1', "1\<C-t>\<C-t>", Ex("1\<C-t>\<C-t>"), e)
-+ call assert_equal(' 1', "1\<C-t>\<C-t>", Ex("1\<C-t>\<C-t>\<C-d>"), e)
-+ call assert_equal(' foo', ' foo', Ex(" foo\<C-d>"), e)
-+ call assert_equal('foo', ' foo0', Ex(" foo0\<C-d>"), e)
-+ call assert_equal('foo', ' foo^', Ex(" foo^\<C-d>"), e)
-+ endfor
-+
-+ set sw&
-+ let &encoding = encoding_save
-+endfunc
--- 
-2.27.0

_service:tar_scm:backport-compilation-error-with-Ruby-3.0.patch Deleted

@@ -1,57 +0,0 @@
-From 9d20daffc296b9eb901fb14bdd83620ea55d440a Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Mon, 1 Feb 2021 19:31:47 +0100
-Subject: PATCH patch 8.2.2448: compilation error with Ruby 3.0
-
-Problem: Compilation error with Ruby 3.0.
-Solution: Adjust #ifdefs and declaration. (Ken Takata, closes #7761)
----
- src/if_ruby.c | 10 +++++++---
- 1 file changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/src/if_ruby.c b/src/if_ruby.c
-index d21a655..6522d07 100644
---- a/src/if_ruby.c
-+++ b/src/if_ruby.c
-@@ -416,7 +416,7 @@ static VALUE (*dll_rb_hash_new) (void);
- static VALUE (*dll_rb_inspect) (VALUE);
- static VALUE (*dll_rb_int2inum) (long);
- static ID (*dll_rb_intern) (const char*);
--# if VIM_SIZEOF_INT < VIM_SIZEOF_LONG // 64 bits only
-+# if RUBY_VERSION >= 30 || VIM_SIZEOF_INT < VIM_SIZEOF_LONG
- static long (*dll_rb_fix2int) (VALUE);
- static long (*dll_rb_num2int) (VALUE);
- static unsigned long (*dll_rb_num2uint) (VALUE);
-@@ -504,7 +504,11 @@ static void (*dll_rb_gc_writebarrier_unprotect)(VALUE obj);
- # endif
- 
- # if RUBY_VERSION >= 30
-+# ifdef _MSC_VER
-+static void (*dll_ruby_malloc_size_overflow)(size_t, size_t);
-+# else
- NORETURN(static void (*dll_ruby_malloc_size_overflow)(size_t, size_t));
-+# endif
- # endif
- 
- # if RUBY_VERSION >= 26
-@@ -534,7 +538,7 @@ rb_int2big_stub(SIGNED_VALUE x)
- {
- return dll_rb_int2big(x);
- }
--# if VIM_SIZEOF_INT < VIM_SIZEOF_LONG
-+# if RUBY_VERSION >= 30 || VIM_SIZEOF_INT < VIM_SIZEOF_LONG
- long
- rb_fix2int_stub(VALUE x)
- {
-@@ -673,7 +677,7 @@ static struct
- {"rb_inspect", (RUBY_PROC*)&dll_rb_inspect},
- {"rb_int2inum", (RUBY_PROC*)&dll_rb_int2inum},
- {"rb_intern", (RUBY_PROC*)&dll_rb_intern},
--# if VIM_SIZEOF_INT < VIM_SIZEOF_LONG // 64 bits only
-+# if RUBY_VERSION >= 30 || VIM_SIZEOF_INT < VIM_SIZEOF_LONG
- {"rb_fix2int", (RUBY_PROC*)&dll_rb_fix2int},
- {"rb_num2int", (RUBY_PROC*)&dll_rb_num2int},
- {"rb_num2uint", (RUBY_PROC*)&dll_rb_num2uint},
--- 
-2.13.7
-

_service:tar_scm:backport-configure-cannot-detect-Python-3.10.patch Deleted

@@ -1,38 +0,0 @@
-From 23c0192166760b0d73bd39252ca72e3cfe596f6e Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Fri, 21 May 2021 11:43:58 +0200
-Subject: PATCH patch 8.2.2876: configure cannot detect Python 3.10
-
-Problem: Configure cannot detect Python 3.10.
-Solution: Use sys.version_info. (closes #8233)
----
- src/auto/configure | 2 +-
- src/configure.ac | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/auto/configure b/src/auto/configure
-index 0b423a65775..5702a217188 100755
---- a/src/auto/configure
-+++ b/src/auto/configure
-@@ -6673,7 +6673,7 @@ if ${vi_cv_var_python3_version+:} false; then :
- $as_echo_n "(cached) " >&6
- else
- vi_cv_var_python3_version=`
-- ${vi_cv_path_python3} -c 'import sys; print(sys.version:3)'`
-+ ${vi_cv_path_python3} -c 'import sys; print("{}.{}".format(sys.version_info.major, sys.version_info.minor))'`
- 
- fi
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $vi_cv_var_python3_version" >&5
-diff --git a/src/configure.ac b/src/configure.ac
-index cc8d61f7f8b..2db04496ff1 100644
---- a/src/configure.ac
-+++ b/src/configure.ac
-@@ -1436,7 +1436,7 @@ if test "$enable_python3interp" = "yes" -o "$enable_python3interp" = "dynamic";
- dnl -- get its version number
- AC_CACHE_CHECK(Python version,vi_cv_var_python3_version,
- vi_cv_var_python3_version=`
-- ${vi_cv_path_python3} -c 'import sys; print(sys.version:3)'`
-+ ${vi_cv_path_python3} -c 'import sys; print("{}.{}".format(sys.version_info.major, sys.version_info.minor))'`
- )
- 
- dnl -- it must be at least version 3

_service:tar_scm:backport-crash-when-pasting-too-many-times.patch Deleted

@@ -1,67 +0,0 @@
-From eeed1c7ae090c17f4df51cf97b2a9e4d8b4f4dc7 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sun, 10 Oct 2021 12:35:17 +0100
-Subject: PATCH patch 8.2.3492: crash when pasting too many times
-
-Problem: Crash when pasting too many times.
-Solution: Limit the size to what fits in an int. (closes #8962)
-
----
- src/globals.h | 1 +
- src/register.c | 11 +++++++++--
- src/testdir/test_put.vim | 8 ++++++++
- 3 files changed, 18 insertions(+), 2 deletions(-)
-
-diff --git a/src/globals.h b/src/globals.h
-index fee8c7f..7be3bfd 100644
---- a/src/globals.h
-+++ b/src/globals.h
-@@ -1659,6 +1659,7 @@ EXTERN char e_menuothermode	INIT(= N_("E328: Menu only exists in another mode"
- #endif
- EXTERN char e_invalwindow	INIT(= N_("E957: Invalid window number"));
- EXTERN char e_listarg		INIT(= N_("E686: Argument of %s must be a List"));
-+EXTERN char e_resulting_text_too_long		INIT(= N_("E1240: Resulting text too long"));
- 
- #ifdef FEAT_GUI_MAC
- EXTERN short disallow_gui	INIT(= FALSE);
-diff --git a/src/register.c b/src/register.c
-index 24e4b99..bab27fe 100644
---- a/src/register.c
-+++ b/src/register.c
-@@ -1908,8 +1908,15 @@ do_put(
- 	 }
- 
- 	 do {
--		totlen = count * yanklen;
--		if (totlen > 0)
-+		long multlen = count * yanklen;
-+
-+		totlen = multlen;
-+		if (totlen != multlen)
-+		{
-+		 emsg(_(e_resulting_text_too_long));
-+		 break;
-+		}
-+		else if (totlen > 0)
- 		{
- 		 oldp = ml_get(lnum);
- 		 if (VIsual_active && col > (int)STRLEN(oldp))
-diff --git a/src/testdir/test_put.vim b/src/testdir/test_put.vim
-index f5037dc..42bb7e6 100644
---- a/src/testdir/test_put.vim
-+++ b/src/testdir/test_put.vim
-@@ -122,3 +122,11 @@ func Test_put_above_first_line()
- call assert_equal('text', getline(1))
- bwipe!
- endfunc
-+
-+func Test_very_larg_count()
-+ new
-+ let @" = 'x'
-+ call assert_fails('norm 44444444444444p', 'E1240:')
-+ bwipe!
-+endfunc
-+
--- 
-2.27.0
-

_service:tar_scm:backport-find-test-fails.patch Deleted

_service:tar_scm:backport-fix-arglist-test-fails.patch Deleted

@@ -1,50 +0,0 @@
-From 679140c56bbabf12a199d94f584b1b9dfc9809fd Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Fri, 24 Dec 2021 18:58:46 +0000
-Subject: PATCH patch 8.2.3885: arglist test fails
-Conflict:Abridged some of the notes
-Reference:https://github.com/vim/vim/commit/679140c56bbabf12a199d94f584b1b9dfc9809fd
-
-Problem: Arglist test fails.
-Solution: Adjust for locking the arglist for ":all".
-
----
- src/testdir/test_arglist.vim | 13 ++++++-------
- 1 file changed, 6 insertions(+), 7 deletions(-)
-
-diff --git a/src/testdir/test_arglist.vim b/src/testdir/test_arglist.vim
-index 7ebe8a2..e5a5e89 100644
---- a/src/testdir/test_arglist.vim
-+++ b/src/testdir/test_arglist.vim
-@@ -470,15 +470,14 @@ func Test_arglist_autocmd()
- new
- " redefine arglist; go to Xxx1
- next! Xxx1 Xxx2 Xxx3
-- " open window for all args
-- all
-+ " open window for all args; Reading Xxx2 will try to change the arglist and
-+ " that will fail
-+ call assert_fails("all", "E1156:")
- call assert_equal('test file Xxx1', getline(1))
- wincmd w
-- wincmd w
-- call assert_equal('test file Xxx1', getline(1))
-- " should now be in Xxx2
-- rewind
- call assert_equal('test file Xxx2', getline(1))
-+ wincmd w
-+ call assert_equal('test file Xxx3', getline(1))
- 
- autocmd! BufReadPost Xxx2
- enew! | only
-@@ -515,6 +514,6 @@ endfunc
- func Test_clear_arglist_in_all()
- n 0 00 000 0000 00000 000000
- au! * 0 n 0
-- all
-+ call assert_fails("all", "E1156")
- au! *
- endfunc
--- 
-2.27.0
-

_service:tar_scm:backport-fix-giving-the-error-0-more-files-to-edit.patch Deleted

@@ -1,94 +0,0 @@
-From 7b22117c4ecf383b6f35acef041773a83ec28220 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Mon, 17 Aug 2020 19:34:10 +0200
-Subject: PATCH patch 8.2.1472: ":argdel" does not work like ":.argdel" as
- documented
-Conflict:NA
-Reference:https://github.com/vim/vim/commit/7b22117c4ecf383b6f35acef041773a83ec28220
-
-Problem: ":argdel" does not work like ":.argdel" as documented. (Alexey
- Demin)
-Solution: Make ":argdel" work like ":.argdel". (closes #6727)
- Also fix giving the error "0 more files to edit".
-
----
- src/arglist.c | 18 +++++++++++++-----
- src/ex_docmd.c | 2 +-
- src/testdir/test_arglist.vim | 10 ++++++++--
- 3 files changed, 22 insertions(+), 8 deletions(-)
-
-diff --git a/src/arglist.c b/src/arglist.c
-index b1a6a0b..cab74f8 100644
---- a/src/arglist.c
-+++ b/src/arglist.c
-@@ -776,10 +776,20 @@ ex_argdelete(exarg_T *eap)
- int		i;
- int		n;
- 
-- if (eap->addr_count > 0)
-+ if (eap->addr_count > 0 || *eap->arg == NUL)
- {
--	// ":1,4argdel": Delete all arguments in the range.
--	if (eap->line2 > ARGCOUNT)
-+	// ":argdel" works like ":argdel"
-+	if (eap->addr_count == 0)
-+	{
-+	 if (curwin->w_arg_idx >= ARGCOUNT)
-+	 {
-+		emsg(_("E610: No argument to delete"));
-+		return;
-+	 }
-+	 eap->line1 = eap->line2 = curwin->w_arg_idx + 1;
-+	}
-+	else if (eap->line2 > ARGCOUNT)
-+	 // ":1,4argdel": Delete all arguments in the range.
- 	 eap->line2 = ARGCOUNT;
- 	n = eap->line2 - eap->line1 + 1;
- 	if (*eap->arg != NUL)
-@@ -808,8 +818,6 @@ ex_argdelete(exarg_T *eap)
- 		curwin->w_arg_idx = ARGCOUNT - 1;
- 	}
- }
-- else if (*eap->arg == NUL)
--	emsg(_(e_argreq));
- else
- 	do_arglist(eap->arg, AL_DEL, 0, FALSE);
- #ifdef FEAT_TITLE
-diff --git a/src/ex_docmd.c b/src/ex_docmd.c
-index cb6b64a..dfcbf37 100644
---- a/src/ex_docmd.c
-+++ b/src/ex_docmd.c
-@@ -4719,7 +4719,7 @@ check_more(
- int	 n = ARGCOUNT - curwin->w_arg_idx - 1;
- 
- if (!forceit && only_one_window()
--	 && ARGCOUNT > 1 && !arg_had_last && n >= 0 && quitmore == 0)
-+	 && ARGCOUNT > 1 && !arg_had_last && n > 0 && quitmore == 0)
- {
- 	if (message)
- 	{
-diff --git a/src/testdir/test_arglist.vim b/src/testdir/test_arglist.vim
-index c486b18..3e1e175 100644
---- a/src/testdir/test_arglist.vim
-+++ b/src/testdir/test_arglist.vim
-@@ -416,9 +416,15 @@ func Test_argdelete()
- last
- argdelete %
- call assert_equal('b', argv())
-- call assert_fails('argdelete', 'E471:')
-+ call assert_fails('argdelete', 'E610:')
- call assert_fails('1,100argdelete', 'E16:')
-- %argd
-+
-+ call Reset_arglist()
-+ args a b c d
-+ next
-+ argdel
-+ call Assert_argc('a', 'c', 'd')
-+ %argdel
- endfunc
- 
- func Test_argdelete_completion()
--- 
-2.27.0
-

_service:tar_scm:backport-html-text-objects-are-not-fully-tested.patch Deleted

@@ -1,164 +0,0 @@
-From af631f61bc42d0dddafe1bc0c06872cf3aaeb239 Mon Sep 17 00:00:00 2001
-From: Dominique Pelle <dominique.pelle@gmail.com>
-Date: Fri, 3 Sep 2021 16:50:16 +0200
-Subject: PATCH patch 8.2.3398: html text objects are not fully tested
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Problem: Html text objects are not fully tested.
-Solution: Add tests for dbcs encoding and different number of backslashes.
-(Dominique Pellé, closes #8831)
----
- src/testdir/test_textobjects.vim | 135 ++++++++++++++++++++-------------------
- 1 file changed, 70 insertions(+), 65 deletions(-)
-
-diff --git a/src/testdir/test_textobjects.vim b/src/testdir/test_textobjects.vim
-index 042c534..49fc9c8 100644
---- a/src/testdir/test_textobjects.vim
-+++ b/src/testdir/test_textobjects.vim
-@@ -88,71 +88,76 @@ endfunc
- 
- " Tests for string and html text objects
- func Test_string_html_objects()
-- enew!
--
-- let t = '"wo\"rd\\" foo'
-- put =t
-- normal! da"
-- call assert_equal('foo', getline('.'))
--
-- let t = "'foo' 'bar' 'piep'"
-- put =t
-- normal! 0va'a'rx
-- call assert_equal("xxxxxxxxxxxx'piep'", getline('.'))
--
-- let t = "bla bla `quote` blah"
-- put =t
-- normal! 02f`da`
-- call assert_equal("bla bla blah", getline('.'))
--
-- let t = 'out " in "noXno"'
-- put =t
-- normal! 0fXdi"
-- call assert_equal('out " in ""', getline('.'))
--
-- let t = "\"'\" 'blah' rep 'buh'"
-- put =t
-- normal! 03f'vi'ry
-- call assert_equal("\"'\" 'blah'yyyyy'buh'", getline('.'))
--
-- set quoteescape=+*-
-- let t = "bla `s*`d-`+++`l**` b`la"
-- put =t
-- normal! di`
-- call assert_equal("bla `` b`la", getline('.'))
--
-- let t = 'voo "nah" sdf " asdf" sdf " sdf" sd'
-- put =t
-- normal! $F"va"oha"i"rz
-- call assert_equal('voo "zzzzzzzzzzzzzzzzzzzzzzzzzzzzsd', getline('.'))
--
-- let t = "-asdfXasdfasdf-"
-- put =t
-- normal! fXdit
-- call assert_equal('-asdfasdf-', getline('.'))
--
-- let t = "-asdXasdfasdf-"
-- put =t
-- normal! 0fXdit
-- call assert_equal('--', getline('.'))
--
-- let t = "-asdfXasdfasdf-"
-- put =t
-- normal! fXdat
-- call assert_equal('-asdfasdf-', getline('.'))
--
-- let t = "-asdXasdfasdf-"
-- put =t
-- normal! 0fXdat
-- call assert_equal('--', getline('.'))
--
-- let t = "-\ninnertext object\n"
-- put =t
-- normal! dit
-- call assert_equal('-', getline('.'))
--
-- set quoteescape&
-- enew!
-+ for e in 'utf-8', 'latin1', 'cp932'
-+ enew!
-+ exe 'set enc=' .. e
-+
-+ let t = '"wo\"rd\\" foo'
-+ put =t
-+ normal! da"
-+ call assert_equal('foo', getline('.'), e)
-+
-+ let t = "'foo' 'bar' 'piep'"
-+ put =t
-+ normal! 0va'a'rx
-+ call assert_equal("xxxxxxxxxxxx'piep'", getline('.'), e)
-+
-+ let t = "bla bla `quote` blah"
-+ put =t
-+ normal! 02f`da`
-+ call assert_equal("bla bla blah", getline('.'), e)
-+
-+ let t = 'out " in "noXno"'
-+ put =t
-+ normal! 0fXdi"
-+ call assert_equal('out " in ""', getline('.'), e)
-+
-+ let t = "\"'\" 'blah' rep 'buh'"
-+ put =t
-+ normal! 03f'vi'ry
-+ call assert_equal("\"'\" 'blah'yyyyy'buh'", getline('.'), e)
-+
-+ set quoteescape=+*-
-+ let t = "bla `s*`d-`+++`l**` b`la"
-+ put =t
-+ normal! di`
-+ call assert_equal("bla `` b`la", getline('.'), e)
-+
-+ let t = 'voo "nah" sdf " asdf" sdf " sdf" sd'
-+ put =t
-+ normal! $F"va"oha"i"rz
-+ call assert_equal('voo "zzzzzzzzzzzzzzzzzzzzzzzzzzzzsd', getline('.'), e)
-+
-+ let t = "-asdfXasdfasdf-"
-+ put =t
-+ normal! fXdit
-+ call assert_equal('-asdfasdf-', getline('.'), e)
-+
-+ let t = "-asdXasdfasdf-"
-+ put =t
-+ normal! 0fXdit
-+ call assert_equal('--', getline('.'), e)
-+
-+ let t = "-asdfXasdfasdf-"
-+ put =t
-+ normal! fXdat
-+ call assert_equal('-asdfasdf-', getline('.'), e)
-+
-+ let t = "-asdXasdfasdf-"
-+ put =t
-+ normal! 0fXdat
-+ call assert_equal('--', getline('.'), e)
-+
-+ let t = "-\ninnertext object\n"
-+ put =t
-+ normal! dit
-+ call assert_equal('-', getline('.'), e)
-+
-+ set quoteescape&
-+ endfor
-+
-+ set enc=utf-8
-+ bwipe!
- endfunc
- 
- func Test_empty_html_tag()
--- 
-1.8.3.1
-

_service:tar_scm:backport-insufficient-code-coverage-for-ex_docmd.c_functions.patch Deleted

@@ -1,109 +0,0 @@
-From 9f6277bdde97b7767ded43a0b5a2023eb601b3b7 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 11 Feb 2020 22:04:02 +0100
-Subject: PATCH patch 8.2.0243: insufficient code coverage for ex_docmd.c
- functions
-
-Problem: Insufficient code coverage for ex_docmd.c functions.
-Solution: Add more tests. (Yegappan Lakshmanan, closes #5618)
----
- src/testdir/Make_all.mak | 2 ++
- src/testdir/test_buffer.vim | 66 +++++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 68 insertions(+)
- create mode 100644 src/testdir/test_buffer.vim
-
-diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
-index 05e7a2c..e608b92 100644
---- a/src/testdir/Make_all.mak
-+++ b/src/testdir/Make_all.mak
-@@ -65,6 +65,7 @@ NEW_TESTS = \
- 	test_blob \
- 	test_blockedit \
- 	test_breakindent \
-+	test_buffer \
- 	test_bufline \
- 	test_bufwintabinfo \
- 	test_cd \
-@@ -307,6 +308,7 @@ NEW_TESTS_RES = \
- 	test_blob.res \
- 	test_blockedit.res \
- 	test_breakindent.res \
-+ test_buffer.res \
- 	test_bufwintabinfo.res \
- 	test_cdo.res \
- 	test_changelist.res \
-diff --git a/src/testdir/test_buffer.vim b/src/testdir/test_buffer.vim
-new file mode 100644
-index 0000000..dc35bb4
---- /dev/null
-+++ b/src/testdir/test_buffer.vim
-@@ -0,0 +1,66 @@
-+" Tests for Vim buffer
-+
-+" Test for the :bunload command with an offset
-+func Test_bunload_with_offset()
-+ %bwipe!
-+ call writefile('B1', 'b1')
-+ call writefile('B2', 'b2')
-+ call writefile('B3', 'b3')
-+ call writefile('B4', 'b4')
-+
-+ " Load four buffers. Unload the second and third buffers and then
-+ " execute .+3bunload to unload the last buffer.
-+ edit b1
-+ new b2
-+ new b3
-+ new b4
-+
-+ bunload b2
-+ bunload b3
-+ exe bufwinnr('b1') . 'wincmd w'
-+ .+3bunload
-+ call assert_equal(0, getbufinfo('b4')0.loaded)
-+ call assert_equal('b1',
-+ \ fnamemodify(getbufinfo({'bufloaded' : 1})0.name, ':t'))
-+
-+ " Load four buffers. Unload the third and fourth buffers. Execute .+3bunload
-+ " and check whether the second buffer is unloaded.
-+ ball
-+ bunload b3
-+ bunload b4
-+ exe bufwinnr('b1') . 'wincmd w'
-+ .+3bunload
-+ call assert_equal(0, getbufinfo('b2')0.loaded)
-+ call assert_equal('b1',
-+ \ fnamemodify(getbufinfo({'bufloaded' : 1})0.name, ':t'))
-+
-+ " Load four buffers. Unload the second and third buffers and from the last
-+ " buffer execute .-3bunload to unload the first buffer.
-+ ball
-+ bunload b2
-+ bunload b3
-+ exe bufwinnr('b4') . 'wincmd w'
-+ .-3bunload
-+ call assert_equal(0, getbufinfo('b1')0.loaded)
-+ call assert_equal('b4',
-+ \ fnamemodify(getbufinfo({'bufloaded' : 1})0.name, ':t'))
-+
-+ " Load four buffers. Unload the first and second buffers. Execute .-3bunload
-+ " from the last buffer and check whether the third buffer is unloaded.
-+ ball
-+ bunload b1
-+ bunload b2
-+ exe bufwinnr('b4') . 'wincmd w'
-+ .-3bunload
-+ call assert_equal(0, getbufinfo('b3')0.loaded)
-+ call assert_equal('b4',
-+ \ fnamemodify(getbufinfo({'bufloaded' : 1})0.name, ':t'))
-+
-+ %bwipe!
-+ call delete('b1')
-+ call delete('b2')
-+ call delete('b3')
-+ call delete('b4')
-+endfunc
-+
-+" vim: shiftwidth=2 sts=2 expandtab
--- 
-1.8.3.1
-

_service:tar_scm:backport-invalid-argument-errmsg.patch Deleted

@@ -1,27 +0,0 @@
-From 436b5adc9770a2568209dd5ab1f98bd1afc91898 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Fri, 31 Dec 2021 22:49:24 +0000
-Subject: PATCH patch 8.2.3961: error messages are spread out
-
-Problem: Error messages are spread out.
-Solution: Move more errors to errors.h.
-
----
- src/globals.h | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/globals.h b/src/globals.h
-index 75092b7..45d9111 100644
---- a/src/globals.h
-+++ b/src/globals.h
-@@ -1453,6 +1453,7 @@ EXTERN char e_abort		INIT(= N_("E470: Command aborted"));
- EXTERN char e_argreq	INIT(= N_("E471: Argument required"));
- EXTERN char e_cannot_change_arglist_recursively INIT(= N_("E1156: Cannot change the argument list recursively"));
- EXTERN char e_backslash	INIT(= N_("E10: \\ should be followed by /, ? or &"));
-+EXTERN char e_invalid_argument	INIT(= N_("E474: Invalid argument"));
- #ifdef FEAT_CMDWIN
- EXTERN char e_cmdwin	INIT(= N_("E11: Invalid in command-line window; <CR> executes, CTRL-C quits"));
- #endif
--- 
-2.27.0
-

_service:tar_scm:backport-linker-errors-when-building-with-dynamic-Python-3.9.patch Deleted

@@ -1,136 +0,0 @@
-From ee1b93169d21896e5401a54a5189c9465abb7bc9 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 16 Jul 2020 22:15:53 +0200
-Subject: PATCH patch 8.2.1225: linker errors when building with dynamic
- Python 3.9
-
-Problem: Linker errors when building with dynamic Python 3.9.
-Solution: Add #defined items. (closes #6461)
----
- src/if_python3.c | 40 +++++++++++++++++++++++++++++++++++++---
- 1 file changed, 37 insertions(+), 3 deletions(-)
-
-diff --git a/src/if_python3.c b/src/if_python3.c
-index 68da288..45dc308 100644
---- a/src/if_python3.c
-+++ b/src/if_python3.c
-@@ -203,6 +203,9 @@ typedef PySliceObject PySliceObject_T;
- # define PySys_GetObject py3_PySys_GetObject
- # define PySys_SetArgv py3_PySys_SetArgv
- # define PyType_Ready py3_PyType_Ready
-+# if PY_VERSION_HEX >= 0x030900b0
-+# define PyType_GetFlags py3_PyType_GetFlags
-+# endif
- #undef Py_BuildValue
- # define Py_BuildValue py3_Py_BuildValue
- # define Py_SetPythonHome py3_Py_SetPythonHome
-@@ -233,6 +236,9 @@ typedef PySliceObject PySliceObject_T;
- # define PyBytes_FromString py3_PyBytes_FromString
- # undef PyBytes_FromStringAndSize
- # define PyBytes_FromStringAndSize py3_PyBytes_FromStringAndSize
-+# if defined(Py_DEBUG) || PY_VERSION_HEX >= 0x030900b0
-+# define _Py_Dealloc py3__Py_Dealloc
-+# endif
- # define PyFloat_FromDouble py3_PyFloat_FromDouble
- # define PyFloat_AsDouble py3_PyFloat_AsDouble
- # define PyObject_GenericGetAttr py3_PyObject_GenericGetAttr
-@@ -247,7 +253,6 @@ typedef PySliceObject PySliceObject_T;
- # ifdef Py_DEBUG
- # define _Py_NegativeRefcount py3__Py_NegativeRefcount
- # define _Py_RefTotal (*py3__Py_RefTotal)
--# define _Py_Dealloc py3__Py_Dealloc
- # define PyModule_Create2TraceRefs py3_PyModule_Create2TraceRefs
- # else
- # define PyModule_Create2 py3_PyModule_Create2
-@@ -287,6 +292,10 @@ typedef PySliceObject PySliceObject_T;
- # define PyObject_NEW(type, typeobj) \
- ( (type *) PyObject_Init( \
- 	(PyObject *) _PyObject_DebugMalloc( _PyObject_SIZE(typeobj) ), (typeobj)) )
-+# elif PY_VERSION_HEX >= 0x030900b0
-+# undef PyObject_NEW
-+# define PyObject_NEW(type, typeobj) \
-+	((type *)py3__PyObject_New(typeobj))
- # endif
- 
- /*
-@@ -352,6 +361,9 @@ static PyObject* (*py3_PyObject_Repr)(PyObject *);
- static PyObject* (*py3_PyObject_GetItem)(PyObject *, PyObject *);
- static int (*py3_PyObject_IsTrue)(PyObject *);
- static PyObject* (*py3_Py_BuildValue)(char *, ...);
-+# if PY_VERSION_HEX >= 0x030900b0
-+static int (*py3_PyType_GetFlags)(PyTypeObject *o);
-+# endif
- static int (*py3_PyType_Ready)(PyTypeObject *type);
- static int (*py3_PyDict_SetItemString)(PyObject *dp, char *key, PyObject *item);
- static PyObject* (*py3_PyUnicode_FromString)(const char *u);
-@@ -396,6 +408,12 @@ static char* (*py3_PyBytes_AsString)(PyObject *bytes);
- static int (*py3_PyBytes_AsStringAndSize)(PyObject *bytes, char **buffer, Py_ssize_t *length);
- static PyObject* (*py3_PyBytes_FromString)(char *str);
- static PyObject* (*py3_PyBytes_FromStringAndSize)(char *str, Py_ssize_t length);
-+# if defined(Py_DEBUG) || PY_VERSION_HEX >= 0x030900b0
-+static void (*py3__Py_Dealloc)(PyObject *obj);
-+# endif
-+# if PY_VERSION_HEX >= 0x030900b0
-+static PyObject* (*py3__PyObject_New)(PyTypeObject *);
-+# endif
- static PyObject* (*py3_PyFloat_FromDouble)(double num);
- static double (*py3_PyFloat_AsDouble)(PyObject *);
- static PyObject* (*py3_PyObject_GenericGetAttr)(PyObject *obj, PyObject *name);
-@@ -414,7 +432,6 @@ static void* (*py3_PyCapsule_GetPointer)(PyObject *, char *);
- # ifdef Py_DEBUG
- static void (*py3__Py_NegativeRefcount)(const char *fname, int lineno, PyObject *op);
- static Py_ssize_t* py3__Py_RefTotal;
--static void (*py3__Py_Dealloc)(PyObject *obj);
- static PyObject* (*py3_PyModule_Create2TraceRefs)(struct PyModuleDef* module, int module_api_version);
- # else
- static PyObject* (*py3_PyModule_Create2)(struct PyModuleDef* module, int module_api_version);
-@@ -525,6 +542,9 @@ static struct
- {"PyObject_IsTrue", (PYTHON_PROC*)&py3_PyObject_IsTrue},
- {"PyLong_FromLong", (PYTHON_PROC*)&py3_PyLong_FromLong},
- {"PyDict_New", (PYTHON_PROC*)&py3_PyDict_New},
-+# if PY_VERSION_HEX >= 0x030900b0
-+ {"PyType_GetFlags", (PYTHON_PROC*)&py3_PyType_GetFlags},
-+# endif
- {"PyType_Ready", (PYTHON_PROC*)&py3_PyType_Ready},
- {"PyDict_SetItemString", (PYTHON_PROC*)&py3_PyDict_SetItemString},
- {"PyLong_AsLong", (PYTHON_PROC*)&py3_PyLong_AsLong},
-@@ -562,6 +582,12 @@ static struct
- {"PyBytes_AsStringAndSize", (PYTHON_PROC*)&py3_PyBytes_AsStringAndSize},
- {"PyBytes_FromString", (PYTHON_PROC*)&py3_PyBytes_FromString},
- {"PyBytes_FromStringAndSize", (PYTHON_PROC*)&py3_PyBytes_FromStringAndSize},
-+# if defined(Py_DEBUG) || PY_VERSION_HEX >= 0x030900b0
-+ {"_Py_Dealloc", (PYTHON_PROC*)&py3__Py_Dealloc},
-+# endif
-+# if PY_VERSION_HEX >= 0x030900b0
-+ {"_PyObject_New", (PYTHON_PROC*)&py3__PyObject_New},
-+# endif
- {"PyFloat_FromDouble", (PYTHON_PROC*)&py3_PyFloat_FromDouble},
- {"PyFloat_AsDouble", (PYTHON_PROC*)&py3_PyFloat_AsDouble},
- {"PyObject_GenericGetAttr", (PYTHON_PROC*)&py3_PyObject_GenericGetAttr},
-@@ -578,7 +604,6 @@ static struct
- # ifdef Py_DEBUG
- {"_Py_NegativeRefcount", (PYTHON_PROC*)&py3__Py_NegativeRefcount},
- {"_Py_RefTotal", (PYTHON_PROC*)&py3__Py_RefTotal},
-- {"_Py_Dealloc", (PYTHON_PROC*)&py3__Py_Dealloc},
- {"PyModule_Create2TraceRefs", (PYTHON_PROC*)&py3_PyModule_Create2TraceRefs},
- # else
- {"PyModule_Create2", (PYTHON_PROC*)&py3_PyModule_Create2},
-@@ -634,6 +659,15 @@ py3__Py_XDECREF(PyObject *op)
- # define Py_XDECREF(op) py3__Py_XDECREF(_PyObject_CAST(op))
- # endif
- 
-+# if PY_VERSION_HEX >= 0x030900b0
-+ static inline int
-+py3_PyType_HasFeature(PyTypeObject *type, unsigned long feature)
-+{
-+ return ((PyType_GetFlags(type) & feature) != 0);
-+}
-+# define PyType_HasFeature(t,f) py3_PyType_HasFeature(t,f)
-+# endif
-+
- /*
- * Free python.dll
- */
--- 
-1.8.3.1
-

_service:tar_scm:backport-linker-errors-with-dynamic-Python-3.10.patch Deleted

@@ -1,65 +0,0 @@
-From 90478f35a8c78e2e10a4b4a8f135998dc04c91fa Mon Sep 17 00:00:00 2001
-From: Zdenek Dohnal <zdohnal@redhat.com>
-Date: Mon, 14 Jun 2021 15:08:30 +0200
-Subject: PATCH patch 8.2.2995: linker errors with dynamic Python 3.10
-
-Problem: Linker errors with dynamic Python 3.10.
-Solution: Add a couple of library entries. (Zdenek Dohnal, closes #8381,
-closes #8356)
----
- src/if_python3.c | 18 ++++++++++++++++++
- 1 file changed, 18 insertions(+)
-
-diff --git a/src/if_python3.c b/src/if_python3.c
-index 7c9e140..72c9e9b 100644
---- a/src/if_python3.c
-+++ b/src/if_python3.c
-@@ -181,6 +181,9 @@ typedef PySliceObject PySliceObject_T;
- # ifndef PyMapping_Keys
- # define PyMapping_Keys py3_PyMapping_Keys
- # endif
-+# if PY_VERSION_HEX >= 0x030a00b2
-+# define PyIter_Check py3_PyIter_Check
-+# endif
- # define PyIter_Next py3_PyIter_Next
- # define PyObject_GetIter py3_PyObject_GetIter
- # define PyObject_Repr py3_PyObject_Repr
-@@ -355,6 +358,9 @@ static PyObject* (*py3_PyDict_GetItemString)(PyObject *, const char *);
- static int (*py3_PyDict_Next)(PyObject *, Py_ssize_t *, PyObject **, PyObject **);
- static PyObject* (*py3_PyLong_FromLong)(long);
- static PyObject* (*py3_PyDict_New)(void);
-+# if PY_VERSION_HEX >= 0x030a00b2
-+static int (*py3_PyIter_Check)(PyObject *o);
-+# endif
- static PyObject* (*py3_PyIter_Next)(PyObject *);
- static PyObject* (*py3_PyObject_GetIter)(PyObject *);
- static PyObject* (*py3_PyObject_Repr)(PyObject *);
-@@ -535,6 +541,9 @@ static struct
- {"PyDict_Next", (PYTHON_PROC*)&py3_PyDict_Next},
- {"PyMapping_Check", (PYTHON_PROC*)&py3_PyMapping_Check},
- {"PyMapping_Keys", (PYTHON_PROC*)&py3_PyMapping_Keys},
-+# if PY_VERSION_HEX >= 0x030a00b2
-+ {"PyIter_Check", (PYTHON_PROC*)&py3_PyIter_Check},
-+# endif
- {"PyIter_Next", (PYTHON_PROC*)&py3_PyIter_Next},
- {"PyObject_GetIter", (PYTHON_PROC*)&py3_PyObject_GetIter},
- {"PyObject_Repr", (PYTHON_PROC*)&py3_PyObject_Repr},
-@@ -668,6 +677,15 @@ py3_PyType_HasFeature(PyTypeObject *type, unsigned long feature)
- # define PyType_HasFeature(t,f) py3_PyType_HasFeature(t,f)
- # endif
- 
-+# if PY_VERSION_HEX >= 0x030a00b2
-+ static inline int
-+py3__PyObject_TypeCheck(PyObject *ob, PyTypeObject *type)
-+{
-+ return Py_IS_TYPE(ob, type) || PyType_IsSubtype(Py_TYPE(ob), type);
-+}
-+# define _PyObject_TypeCheck(o,t) py3__PyObject_TypeCheck(o,t)
-+# endif
-+
- /*
- * Free python.dll
- */
--- 
-1.8.3.1
-

_service:tar_scm:backport-macros-for-Ruby-are-too-complicated.patch Deleted

@@ -1,642 +0,0 @@
-From 41a4141ecb36cd871c6e87f6fbc12fa81653b6be Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Tue, 7 Jan 2020 21:32:19 +0100
-Subject: PATCH patch 8.2.0100: macros for Ruby are too complicated
-
-Problem: Macros for Ruby are too complicated.
-Solution: Do not use DYNAMIC_RUBY_VER, use RUBY_VERSION. (Ken Takata,
- closes #5452)
----
- src/Make_cyg_ming.mak | 3 -
- src/Make_mvc.mak | 5 +-
- src/auto/configure | 2 +-
- src/configure.ac | 2 +-
- src/if_ruby.c | 164 +++++++++++++++++++++---------------------
- 5 files changed, 86 insertions(+), 90 deletions(-)
-
-diff --git a/src/Make_cyg_ming.mak b/src/Make_cyg_ming.mak
-index 3c878cbfb..f9c795bfe 100644
---- a/src/Make_cyg_ming.mak
-+++ b/src/Make_cyg_ming.mak
-@@ -569,11 +569,8 @@ ifdef RUBY
- CFLAGS += -DFEAT_RUBY $(RUBYINC)
- ifeq (yes, $(DYNAMIC_RUBY))
- CFLAGS += -DDYNAMIC_RUBY -DDYNAMIC_RUBY_DLL=\"$(RUBY_INSTALL_NAME).dll\"
--CFLAGS += -DDYNAMIC_RUBY_VER=$(RUBY_VER)
- endif
-- ifeq (no, $(DYNAMIC_RUBY))
- CFLAGS += -DRUBY_VERSION=$(RUBY_VER)
-- endif
- ifneq ($(findstring w64-mingw32,$(CC)),)
- # A workaround for MinGW-w64
- CFLAGS += -DHAVE_STRUCT_TIMESPEC -DHAVE_STRUCT_TIMEZONE
-diff --git a/src/Make_mvc.mak b/src/Make_mvc.mak
-index 8694f7496..eb7129614 100644
---- a/src/Make_mvc.mak
-+++ b/src/Make_mvc.mak
-@@ -1193,10 +1193,11 @@ RUBY_LIB = $(RUBY)\lib\$(RUBY_INSTALL_NAME).lib
- # Do we want to load Ruby dynamically?
- ! if "$(DYNAMIC_RUBY)" == "yes"
- ! message Ruby DLL will be loaded dynamically
--CFLAGS = $(CFLAGS) -DDYNAMIC_RUBY -DDYNAMIC_RUBY_VER=$(RUBY_VER) \
--		-DDYNAMIC_RUBY_DLL=\"$(RUBY_INSTALL_NAME).dll\" 
-+CFLAGS = $(CFLAGS) -DDYNAMIC_RUBY \
-+		-DDYNAMIC_RUBY_DLL=\"$(RUBY_INSTALL_NAME).dll\"
- ! undef RUBY_LIB
- ! endif
-+CFLAGS = $(CFLAGS) -DRUBY_VERSION=$(RUBY_VER)
- !endif # RUBY
- 
- #
-diff --git a/src/auto/configure b/src/auto/configure
-index 993049573..1b5094e97 100755
---- a/src/auto/configure
-+++ b/src/auto/configure
-@@ -7622,7 +7622,7 @@ $as_echo "$rubyhdrdir" >&6; }
- 	 fi
- 	 $as_echo "#define DYNAMIC_RUBY 1" >>confdefs.h
- 
--	 RUBY_CFLAGS="-DDYNAMIC_RUBY_DLL=\\\"$libruby_soname\\\" -DDYNAMIC_RUBY_VER=$rubyversion $RUBY_CFLAGS"
-+	 RUBY_CFLAGS="-DDYNAMIC_RUBY_DLL=\\\"$libruby_soname\\\" $RUBY_CFLAGS"
- 	 RUBY_LIBS=
- 	fi
- else
-diff --git a/src/configure.ac b/src/configure.ac
-index d440a465c..a098da82e 100644
---- a/src/configure.ac
-+++ b/src/configure.ac
-@@ -1966,7 +1966,7 @@ if test "$enable_rubyinterp" = "yes" -o "$enable_rubyinterp" = "dynamic"; then
- 	 libruby_soname=`$vi_cv_path_ruby -r rbconfig -e "puts $ruby_rbconfig::CONFIG'LIBRUBY_SO'"`
- 	 fi
- 	 AC_DEFINE(DYNAMIC_RUBY)
--	 RUBY_CFLAGS="-DDYNAMIC_RUBY_DLL=\\\"$libruby_soname\\\" -DDYNAMIC_RUBY_VER=$rubyversion $RUBY_CFLAGS"
-+	 RUBY_CFLAGS="-DDYNAMIC_RUBY_DLL=\\\"$libruby_soname\\\" $RUBY_CFLAGS"
- 	 RUBY_LIBS=
- 	fi
- else
-diff --git a/src/if_ruby.c b/src/if_ruby.c
-index 00783c8d7..68d55821f 100644
---- a/src/if_ruby.c
-+++ b/src/if_ruby.c
-@@ -20,7 +20,7 @@
- #include <string.h>
- 
- #ifdef _WIN32
--# if !defined(DYNAMIC_RUBY_VER) || (DYNAMIC_RUBY_VER < 18)
-+# if !defined(DYNAMIC_RUBY) || (RUBY_VERSION < 18)
- # define NT
- # endif
- # ifndef DYNAMIC_RUBY
-@@ -32,7 +32,7 @@
- # define RUBYEXTERN extern
- #endif
- 
--#if defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER >= 24
-+#if defined(DYNAMIC_RUBY) && RUBY_VERSION >= 24
- # define USE_RUBY_INTEGER
- #endif
- 
-@@ -47,14 +47,14 @@
- # if defined(USE_RUBY_INTEGER)
- # define rb_cInteger		(*dll_rb_cInteger)
- # endif
--# if defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER >= 20
-+# if RUBY_VERSION >= 20
- # define rb_cFloat		(*dll_rb_cFloat)
- # endif
- # define rb_cNilClass		(*dll_rb_cNilClass)
- # define rb_cString		(*dll_rb_cString)
- # define rb_cSymbol		(*dll_rb_cSymbol)
- # define rb_cTrueClass		(*dll_rb_cTrueClass)
--# if defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER >= 18
-+# if RUBY_VERSION >= 18
- /*
- * On ver 1.8, all Ruby functions are exported with "__declspec(dllimport)"
- * in ruby.h. But it causes trouble for these variables, because it is
-@@ -71,29 +71,14 @@
- # undef _WIN32_WINNT
- #endif
- 
--#if (defined(RUBY_VERSION) && RUBY_VERSION >= 19) \
-- || (defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER >= 19)
--# define RUBY19_OR_LATER 1
--#endif
--
--#if (defined(RUBY_VERSION) && RUBY_VERSION >= 20) \
-- || (defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER >= 20)
--# define RUBY20_OR_LATER 1
--#endif
--
--#if (defined(RUBY_VERSION) && RUBY_VERSION >= 21) \
-- || (defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER >= 21)
--# define RUBY21_OR_LATER 1
--#endif
--
--#if defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER >= 19
-+#if defined(DYNAMIC_RUBY) && RUBY_VERSION >= 19
- // Ruby 1.9 defines a number of static functions which use rb_num2long and
- // rb_int2big
- # define rb_num2long rb_num2long_stub
- # define rb_int2big rb_int2big_stub
- #endif
- 
--#if defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER >= 19 \
-+#if defined(DYNAMIC_RUBY) && RUBY_VERSION >= 19 \
- 	&& VIM_SIZEOF_INT < VIM_SIZEOF_LONG
- // Ruby 1.9 defines a number of static functions which use rb_fix2int and
- // rb_num2int if VIM_SIZEOF_INT < VIM_SIZEOF_LONG (64bit)
-@@ -101,24 +86,24 @@
- # define rb_num2int rb_num2int_stub
- #endif
- 
--#if defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER == 21
-+#if defined(DYNAMIC_RUBY) && RUBY_VERSION == 21
- // Ruby 2.1 adds new GC called RGenGC and RARRAY_PTR uses
- // rb_gc_writebarrier_unprotect_promoted if USE_RGENGC
- # define rb_gc_writebarrier_unprotect_promoted rb_gc_writebarrier_unprotect_promoted_stub
- #endif
--#if defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER >= 22
-+#if defined(DYNAMIC_RUBY) && RUBY_VERSION >= 22
- # define rb_gc_writebarrier_unprotect rb_gc_writebarrier_unprotect_stub
- #endif
- 
--#if defined(DYNAMIC_RUBY_VER) && DYNAMIC_RUBY_VER >= 26
-+#if defined(DYNAMIC_RUBY) && RUBY_VERSION >= 26
- # define rb_ary_detransient rb_ary_detransient_stub
- #endif
- 
- #include <ruby.h>
--#ifdef RUBY19_OR_LATER
-+#if RUBY_VERSION >= 19
- # include <ruby/encoding.h>
- #endif
--#ifndef RUBY19_OR_LATER
-+#if RUBY_VERSION <= 18
- # include <st.h> // for ST_STOP and ST_CONTINUE
- #endif
- 
-@@ -139,7 +124,7 @@
- * The old Data_XXX macro family was deprecated on Ruby 2.2.
- * Use TypedData_XXX if available.
- */
--#if defined(TypedData_Wrap_Struct) && defined(RUBY20_OR_LATER)
-+#if defined(TypedData_Wrap_Struct) && (RUBY_VERSION >= 20)
- # define USE_TYPEDDATA	1
- #endif
- 
-@@ -210,7 +195,7 @@ static void ruby_io_init(void);
- static void ruby_vim_init(void);
- static int ruby_convert_to_vim_value(VALUE val, typval_T *rettv);
- 
--#if defined(RUBY19_OR_LATER) || defined(RUBY_INIT_STACK)
-+#if (RUBY_VERSION >= 19) || defined(RUBY_INIT_STACK)
- # if defined(__ia64) && !defined(ruby_init_stack)
- # define ruby_init_stack(addr) ruby_init_stack((addr), rb_ia64_bsp())
- # endif
-@@ -233,7 +218,7 @@ static int ruby_convert_to_vim_value(VALUE val, typval_T *rettv);
- # endif
- # define rb_class_path			dll_rb_class_path
- # ifdef USE_TYPEDDATA

_service:tar_scm:backport-memory-leak-for-retab-with-invalid-argument.patch Deleted

@@ -1,66 +0,0 @@
-From 2ddb89f8a94425cda1e5491efc80c1ccccb6e08e Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sat, 4 Sep 2021 21:20:41 +0200
-Subject: PATCH patch 8.2.3403: memory leak for :retab with invalid argument
-
-Problem: Memory leak for :retab with invalid argument.
-Solution: Free the memory. Make error messages consistent.
----
- src/indent.c | 13 +++++++++++--
- src/version.c | 2 ++
- 2 files changed, 13 insertions(+), 2 deletions(-)
-
-diff --git a/src/indent.c b/src/indent.c
-index 7e196c2..7d04373 100644
---- a/src/indent.c
-+++ b/src/indent.c
-@@ -70,9 +70,12 @@ tabstop_set(char_u *var, int **array)
- {
- 	int n = atoi((char *)cp);
- 
-+	// Catch negative values, overflow and ridiculous big values.
- 	if (n < 0 || n > 9999)
- 	{
- 	 semsg(_(e_invarg2), cp);
-+	 vim_free(*array);
-+	 *array = NULL;
- 	 return FAIL;
- 	}
- 	(*array)t++ = n;
-@@ -1580,12 +1583,18 @@ ex_retab(exarg_T *eap)
- else
- 	new_ts_str = vim_strnsave(new_ts_str, eap->arg - new_ts_str);
- #else
-- new_ts = getdigits(&(eap->arg));
-- if (new_ts < 0)
-+ ptr = eap->arg;
-+ new_ts = getdigits(&ptr);
-+ if (new_ts < 0 && *eap->arg == '-')
- {
- 	emsg(_(e_positive));
- 	return;
- }
-+ if (new_ts < 0 || new_ts > 9999)
-+ {
-+	semsg(_(e_invarg2), eap->arg);
-+	return;
-+ }
- if (new_ts == 0)
- 	new_ts = curbuf->b_p_ts;
- #endif
-diff --git a/src/version.c b/src/version.c
-index 8912f62..f8e4561 100644
---- a/src/version.c
-+++ b/src/version.c
-@@ -743,6 +743,8 @@ static char *(features) =
- static int included_patches =
- { /* Add new patch number below this line */
- /**/
-+ 3403,
-+/**/
- 3402,
- /**/
- 0
--- 
-1.8.3.1
-

_service:tar_scm:backport-missing-error-message.patch Deleted

@@ -1,29 +0,0 @@
-From 61015162ba834541c42da5db6f3fa0ebe1d40e87 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 28 Jan 2021 17:56:09 +0100
-Subject: PATCH patch 8.2.2423: missing error message
-Conflict:add missing error message
-Reference:https://github.com/vim/vim/commit/61015162ba834541c42da5db6f3fa0ebe1d40e87
-
-Problem: Missing error message.
-Solution: Add the error message.
-
----
- src/globals.h | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/globals.h b/src/globals.h
-index 009834c..872e895 100644
---- a/src/globals.h
-+++ b/src/globals.h
-@@ -1451,6 +1451,7 @@ EXTERN int netbeansSuppressNoLines INIT(= 0); // skip "No lines in buffer"
- */
- EXTERN char e_abort		INIT(= N_("E470: Command aborted"));
- EXTERN char e_argreq	INIT(= N_("E471: Argument required"));
-+EXTERN char e_cannot_change_arglist_recursively INIT(= N_("E1156: Cannot change the argument list recursively"));
- EXTERN char e_backslash	INIT(= N_("E10: \\ should be followed by /, ? or &"));
- #ifdef FEAT_CMDWIN
- EXTERN char e_cmdwin	INIT(= N_("E11: Invalid in command-line window; <CR> executes, CTRL-C quits"));
--- 
-2.27.0
-

_service:tar_scm:backport-no-early-check-if-find-and-sfind-have-an-argument.patch Deleted

@@ -1,70 +0,0 @@
-From 2d10cd478047df8ba144d4b0fcc46480993af57f Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Thu, 19 Mar 2020 14:37:30 +0100
-Subject: PATCH patch 8.2.0407: no early check if :find and :sfind have an
- argument
-
-Problem: No early check if :find and :sfind have an argument.
-Solution: Add EX_NEEDARG.
-
-Reference:https://github.com/vim/vim/commit/2d10cd478047df8ba144d4b0fcc46480993af57f
----
- src/ex_cmds.h | 4 ++--
- src/testdir/test_find_complete.vim | 8 ++++----
- 2 files changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/src/ex_cmds.h b/src/ex_cmds.h
-index 983378c..28ea6ee 100644
---- a/src/ex_cmds.h
-+++ b/src/ex_cmds.h
-@@ -572,7 +572,7 @@ EXCMD(CMD_filter,	"filter",	ex_wrongmodifier,
- 	EX_BANG|EX_NEEDARG|EX_EXTRA|EX_NOTRLCOM,
- 	ADDR_NONE),
- EXCMD(CMD_find,		"find",		ex_find,
--	EX_RANGE|EX_BANG|EX_FILE1|EX_CMDARG|EX_ARGOPT|EX_TRLBAR,
-+	EX_RANGE|EX_BANG|EX_FILE1|EX_CMDARG|EX_ARGOPT|EX_TRLBAR|EX_NEEDARG,
- 	ADDR_OTHER),
- EXCMD(CMD_finally,	"finally",	ex_finally,
- 	EX_TRLBAR|EX_SBOXOK|EX_CMDWIN,
-@@ -1319,7 +1319,7 @@ EXCMD(CMD_setlocal,	"setlocal",	ex_set,
- 	EX_TRLBAR|EX_EXTRA|EX_CMDWIN|EX_SBOXOK,
- 	ADDR_NONE),
- EXCMD(CMD_sfind,	"sfind",	ex_splitview,
--	EX_BANG|EX_FILE1|EX_RANGE|EX_CMDARG|EX_ARGOPT|EX_TRLBAR,
-+	EX_BANG|EX_FILE1|EX_RANGE|EX_CMDARG|EX_ARGOPT|EX_TRLBAR|EX_NEEDARG,
- 	ADDR_OTHER),
- EXCMD(CMD_sfirst,	"sfirst",	ex_rewind,
- 	EX_EXTRA|EX_BANG|EX_CMDARG|EX_ARGOPT|EX_TRLBAR,
-diff --git a/src/testdir/test_find_complete.vim b/src/testdir/test_find_complete.vim
-index 679bf3c..32ca967 100644
---- a/src/testdir/test_find_complete.vim
-+++ b/src/testdir/test_find_complete.vim
-@@ -15,22 +15,22 @@ func Test_find_complete()
- 
- new
- set path=
-- call assert_fails('call feedkeys(":find\t\n", "xt")', 'E345:')
-+ call assert_fails('call feedkeys(":find \t\n", "xt")', 'E471:')
- close
- 
- new
- set path=.
-- call assert_fails('call feedkeys(":find\t\n", "xt")', 'E32:')
-+ call assert_fails('call feedkeys(":find \t\n", "xt")', 'E471:')
- close
- 
- new
- set path=.,,
-- call assert_fails('call feedkeys(":find\t\n", "xt")', 'E32:')
-+ call assert_fails('call feedkeys(":find \t\n", "xt")', 'E471:')
- close
- 
- new
- set path=./**
-- call assert_fails('call feedkeys(":find\t\n", "xt")', 'E32:')
-+ call assert_fails('call feedkeys(":find \t\n", "xt")', 'E471:')
- close
- 
- " We shouldn't find any file till this point
--- 
-2.23.0
\ No newline at end of file

_service:tar_scm:backport-patch-9.0.0022-spell-test-fails.patch Added

_service:tar_scm:backport-patch-9.0.0024-may-access-part-of-typeahead-buf-that-is-not-filled.patch Added

_service:tar_scm:backport-patch-9.0.0054-compiler-warning-for-size_t-to-int-co.patch Added

_service:tar_scm:backport-patch-9.0.0712-wrong-column-when-calling-setcursorch-with-zero-lnum.patch Added

@@ -0,0 +1,137 @@
+From 79f234499b6692cc16970b7455bc9b002242632f Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Mon, 10 Oct 2022 12:42:57 +0100
+Subject: PATCH patch 9.0.0712: wrong column when calling setcursorcharpos()
+ with zero lnum
+
+Problem: Wrong column when calling setcursorcharpos() with zero lnum.
+Solution: Set the line number before calling buf_charidx_to_byteidx().
+ (closes #11329)
+---
+ src/eval.c | 10 +++++++---
+ src/evalfunc.c | 26 ++++++++++++++------------
+ src/testdir/test_cursor_func.vim | 6 ++++++
+ 3 files changed, 27 insertions(+), 15 deletions(-)
+
+diff --git a/src/eval.c b/src/eval.c
+index 8df374a..cbd4740 100644
+--- a/src/eval.c
++++ b/src/eval.c
+@@ -5906,10 +5906,12 @@ var2fpos(
+ }
+ 
+ /*
+- * Convert list in "arg" into a position and optional file number.
+- * When "fnump" is NULL there is no file number, only 3 items.
++ * Convert list in "arg" into position "psop" and optional file number "fnump".
++ * When "fnump" is NULL there is no file number, only 3 items: lnum, col, off
+ * Note that the column is passed on as-is, the caller may want to decrement
+ * it to use 1 for the first column.
++ * If "charcol" is TRUE use the column as the character index instead of the
++ * byte index.
+ * Return FAIL when conversion is not possible, doesn't check the position for
+ * validity.
+ */
+@@ -5952,6 +5954,7 @@ list2fpos(
+ if (n < 0)
+ 	return FAIL;
+ // If character position is specified, then convert to byte position
++ // If the line number is zero use the cursor line.
+ if (charcol)
+ {
+ 	buf_T	*buf;
+@@ -5961,7 +5964,8 @@ list2fpos(
+ 	if (buf == NULL || buf->b_ml.ml_mfp == NULL)
+ 	 return FAIL;
+ 
+-	n = buf_charidx_to_byteidx(buf, posp->lnum, n) + 1;
++	n = buf_charidx_to_byteidx(buf,
++		 posp->lnum == 0 ? curwin->w_cursor.lnum : posp->lnum, n) + 1;
+ }
+ posp->col = n;
+ 
+diff --git a/src/evalfunc.c b/src/evalfunc.c
+index cb12a46..2703865 100644
+--- a/src/evalfunc.c
++++ b/src/evalfunc.c
+@@ -3484,7 +3484,7 @@ f_copy(typval_T *argvars, typval_T *rettv)
+ static void
+ set_cursorpos(typval_T *argvars, typval_T *rettv, int charcol)
+ {
+- long	line, col;
++ long	lnum, col;
+ long	coladd = 0;
+ int		set_curswant = TRUE;
+ 
+@@ -3506,7 +3506,7 @@ set_cursorpos(typval_T *argvars, typval_T *rettv, int charcol)
+ 	 emsg(_(e_invalid_argument));
+ 	 return;
+ 	}
+-	line = pos.lnum;
++	lnum = pos.lnum;
+ 	col = pos.col;
+ 	coladd = pos.coladd;
+ 	if (curswant >= 0)
+@@ -3515,17 +3515,19 @@ set_cursorpos(typval_T *argvars, typval_T *rettv, int charcol)
+ 	 set_curswant = FALSE;
+ 	}
+ }
+- else if ((argvars0.v_type == VAR_NUMBER ||
+-					argvars0.v_type == VAR_STRING)
+-	 && (argvars1.v_type == VAR_NUMBER ||
+-					argvars1.v_type == VAR_STRING))
++ else if ((argvars0.v_type == VAR_NUMBER
++					 || argvars0.v_type == VAR_STRING)
++	 && (argvars1.v_type == VAR_NUMBER
++					 || argvars1.v_type == VAR_STRING))
+ {
+-	line = tv_get_lnum(argvars);
+-	if (line < 0)
++	lnum = tv_get_lnum(argvars);
++	if (lnum < 0)
+ 	 semsg(_(e_invalid_argument_str), tv_get_string(&argvars0));
++	else if (lnum == 0)
++	 lnum = curwin->w_cursor.lnum;
+ 	col = (long)tv_get_number_chk(&argvars1, NULL);
+ 	if (charcol)
+-	 col = buf_charidx_to_byteidx(curbuf, line, col) + 1;
++	 col = buf_charidx_to_byteidx(curbuf, lnum, col) + 1;
+ 	if (argvars2.v_type != VAR_UNKNOWN)
+ 	 coladd = (long)tv_get_number_chk(&argvars2, NULL);
+ }
+@@ -3534,10 +3536,10 @@ set_cursorpos(typval_T *argvars, typval_T *rettv, int charcol)
+ 	emsg(_(e_invalid_argument));
+ 	return;
+ }
+- if (line < 0 || col < 0 || coladd < 0)
++ if (lnum < 0 || col < 0 || coladd < 0)
+ 	return;		// type error; errmsg already given
+- if (line > 0)
+-	curwin->w_cursor.lnum = line;
++ if (lnum > 0)
++	curwin->w_cursor.lnum = lnum;
+ if (col > 0)
+ 	curwin->w_cursor.col = col - 1;
+ curwin->w_cursor.coladd = coladd;
+diff --git a/src/testdir/test_cursor_func.vim b/src/testdir/test_cursor_func.vim
+index d5f0ac7..d2685ed 100644
+--- a/src/testdir/test_cursor_func.vim
++++ b/src/testdir/test_cursor_func.vim
+@@ -399,8 +399,14 @@ func Test_setcursorcharpos()
+ normal G
+ call setcursorcharpos(1, 1)
+ call assert_equal(1, 1, line('.'), col('.'))
++
+ call setcursorcharpos(2, 7, 0)
+ call assert_equal(2, 9, line('.'), col('.'))
++ call setcursorcharpos(0, 7, 0)
++ call assert_equal(2, 9, line('.'), col('.'))
++ call setcursorcharpos(0, 7, 0)
++ call assert_equal(2, 9, line('.'), col('.'))
++
+ call setcursorcharpos(3, 4)
+ call assert_equal(3, 1, line('.'), col('.'))
+ call setcursorcharpos(3, 1)
+-- 
+2.33.0
+

_service:tar_scm:backport-patch-9.0.0790-test-for-dummy-buffer-does-not-always.patch Added

@@ -0,0 +1,29 @@
+From 53c5c9f50ca68d3ed559eebb2c5f7d23f39a768c Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Tue, 18 Oct 2022 17:25:03 +0100
+Subject: PATCH patch 9.0.0790: test for dummy buffer does not always produce
+ the E86 error
+
+Problem: Test for dummy buffer does not always produce the E86 error.
+Solution: Do not check if the error is produced.
+---
+ src/testdir/test_autocmd.vim | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
+index 6ba1b02df..04f3e1431 100644
+--- a/src/testdir/test_autocmd.vim
++++ b/src/testdir/test_autocmd.vim
+@@ -3868,7 +3868,8 @@ func Test_autocmd_split_dummy()
+ lex 'Xtestfile2:4:4'
+ endfunc
+ call Xautocmd_changelist()
+- call assert_fails('call Xautocmd_changelist()', 'E86:')
++ " Should get E86, but it doesn't always happen (timing?)
++ silent! call Xautocmd_changelist()
+ 
+ au! BufReadPre
+ au! FileChangedShell
+-- 
+2.27.0
+

_service:tar_scm:backport-patch-9.0.1331-illegal-memory-access-when-using-ball-in-Visual-mode.patch Added

@@ -0,0 +1,57 @@
+From e1121b139480f53d1b06f84f3e4574048108fa0b Mon Sep 17 00:00:00 2001
+From: Pavel Mayorov <pmayorov@cloudlinux.com>
+Date: Mon, 20 Feb 2023 14:35:20 +0000
+Subject: PATCH patch 9.0.1331: illegal memory access when using :ball in
+ Visual mode
+
+Problem: Illegal memory access when using :ball in Visual mode.
+Solution: Stop Visual mode when using :ball. (Pavel Mayorov, closes #11923)
+---
+ src/buffer.c | 4 ++++
+ src/testdir/test_visual.vim | 19 +++++++++++++++++++++
+ 2 files changed, 23 insertions(+)
+
+diff --git a/src/buffer.c b/src/buffer.c
+index cb7bdf445dee..ff35729fb929 100644
+--- a/src/buffer.c
++++ b/src/buffer.c
+@@ -5319,6 +5319,10 @@ ex_buffer_all(exarg_T *eap)
+ else
+ 	all = TRUE;
+ 
++ // Stop Visual mode, the cursor and "VIsual" may very well be invalid after
++ // switching to another buffer.
++ reset_VIsual_and_resel();
++
+ setpcmark();
+ 
+ #ifdef FEAT_GUI
+diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
+index 295e16f93d9d..f152e7b79ba8 100644
+--- a/src/testdir/test_visual.vim
++++ b/src/testdir/test_visual.vim
+@@ -1493,5 +1493,24 @@ func Test_visual_area_adjusted_when_hiding()
+ bwipe!
+ endfunc
+ 
++" Check fix for the heap-based buffer overflow bug found in the function
++" utfc_ptr2len and reported at
++" https://huntr.dev/bounties/ae933869-a1ec-402a-bbea-d51764c6618e
++func Test_heap_buffer_overflow()
++ enew
++ set updatecount=0
++
++ norm R0
++ split other
++ norm R000
++ exe "norm \<C-V>l"
++ ball
++ call assert_equal(getpos("."), getpos("v"))
++ call assert_equal('n', mode())
++ norm zW
++
++ %bwipe!
++ set updatecount&
++endfunc
+
+ " vim: shiftwidth=2 sts=2 expandtab

_service:tar_scm:backport-spell-test-fails-because-error-message-changed.patch Added

_service:tar_scm:backport-spell-test-fails-because-of-new-illegal-byte-check.patch Deleted

@@ -1,34 +0,0 @@
-From fe978c2b6bb9d897d962595a4a51dd7a71dc8e89 Mon Sep 17 00:00:00 2001
-From: Bram Moolenaar <Bram@vim.org>
-Date: Sun, 8 May 2022 22:43:51 +0100
-Subject: PATCH patch 8.2.4921: spell test fails because of new illegal byte
- check
-
-Problem: Spell test fails because of new illegal byte check.
-Solution: Remove the test.
----
- src/testdir/test_spell.vim | 8 --------
- 1 file changed, 8 deletions(-)
-
-diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
-index 49118a9..437ad5c 100644
---- a/src/testdir/test_spell.vim
-+++ b/src/testdir/test_spell.vim
-@@ -552,14 +552,6 @@ func Test_spell_screendump()
- call delete('XtestSpell')
- endfunc
- 
--func Test_spell_single_word()
-- new
-- silent! norm 0R00
-- spell! ßÂ
-- silent 0norm 0r$ Dvz=
-- bwipe!
--endfunc
--
- let g:test_data_aff1 = 
- \"SET ISO8859-1",
- \"TRY esianrtolcdugmphbyfvkwjkqxz-\xEB\xE9\xE8\xEA\xEF\xEE\xE4\xE0\xE2\xF6\xFC\xFB'ESIANRTOLCDUGMPHBYFVKWJKQXZ",
--- 
-1.8.3.1
-

_service:tar_scm:backport-vim-7.0-rclocation.patch Added

_service:tar_scm:backport-vim-fix-garbled-characters-display-when-file-name-ma.patch Deleted

@@ -1,37 +0,0 @@
-From 150fab01a9e9eb61061bf145998b608c5c9c470e Mon Sep 17 00:00:00 2001
-From: lvying6 <lvying6@huawei.com>
-Date: Tue, 14 Jul 2020 16:43:33 +0800
-Subject: PATCH vim: fix garbled characters display when file name matches
- warning or error in tar file
-
-Reference: https://github.com/vim/vim/issues/6425
-
-The problem is, the tar.vim plugin checks if the last line matches
-warning or error or a few other keywords and if it does, it aborts.
-
-Signed-off-by: lvying6 <lvying6@huawei.com>
----
- runtime/autoload/tar.vim | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/runtime/autoload/tar.vim b/runtime/autoload/tar.vim
-index dc670db..168a2f1 100644
---- a/runtime/autoload/tar.vim
-+++ b/runtime/autoload/tar.vim
-@@ -184,7 +184,12 @@ fun! tar#Browse(tarfile)
- " call Dret("tar#Browse : a:tarfile<".a:tarfile.">")
- return
- endif
-- if line("$") == curlast || ( line("$") == (curlast + 1) && getline("$") =~ '\c\%(warning\|error\|inappropriate\|unrecognized\)')
-+ " If there was an error message, the last line probably matches some keywords but
-+ " should also contain whitespace for readability. Make sure not to match a
-+ " filename that contains the keyword (error/warning/unrecognized/inappropriate, etc)
-+ if line("$") == curlast || ( line("$") == (curlast + 1) &&
-+ \ getline("$") =~# '\c\<\%(warning\|error\|inappropriate\|unrecognized\)\>' &&
-+ \ getline("$") =~ '\s' )
- redraw!
- echohl WarningMsg | echo "***warning*** (tar#Browse) ".a:tarfile." doesn't appear to be a tar file" | echohl None
- keepj sil! %d
--- 
-1.8.3.1
-

_service:tar_scm:vim-7.0-fixkeys.patch Changed

@@ -1,26 +1,26 @@
-diff -up vim81/src/term.c.fixkeys vim81/src/term.c
---- vim81/src/term.c.fixkeys	2019-12-12 09:00:20.685567074 +0100
-+++ vim81/src/term.c	2019-12-12 09:21:36.708769626 +0100
-@@ -957,14 +957,14 @@ static struct builtin_term builtin_termc
-     {K_XRIGHT,		IF_EB("\0331;*C", ESC_STR "1;*C")},
-     {K_XLEFT,		IF_EB("\0331;*D", ESC_STR "1;*D")},
+diff -up vim82/src/term.c.fixkeys vim82/src/term.c
+--- vim82/src/term.c.fixkeys	2022-02-07 09:23:09.195365881 +0100
++++ vim82/src/term.c	2022-02-07 09:31:31.279695977 +0100
+@@ -921,14 +921,14 @@ static struct builtin_term builtin_termc
+     {K_XRIGHT,		"\033@;*C"},
+     {K_XLEFT,		"\033@;*D"},
      // An extra set of function keys for vt100 mode
--    {K_XF1,		IF_EB("\033O*P", ESC_STR "O*P")},
--    {K_XF2,		IF_EB("\033O*Q", ESC_STR "O*Q")},
--    {K_XF3,		IF_EB("\033O*R", ESC_STR "O*R")},
--    {K_XF4,		IF_EB("\033O*S", ESC_STR "O*S")},
--    {K_F1,		IF_EB("\03311;*~", ESC_STR "11;*~")},
--    {K_F2,		IF_EB("\03312;*~", ESC_STR "12;*~")},
--    {K_F3,		IF_EB("\03313;*~", ESC_STR "13;*~")},
--    {K_F4,		IF_EB("\03314;*~", ESC_STR "14;*~")},
-+    {K_XF1,             IF_EB("\03311~", ESC_STR "11~")},
-+    {K_XF2,             IF_EB("\03312~", ESC_STR "12~")},
-+    {K_XF3,             IF_EB("\03313~", ESC_STR "13~")},
-+    {K_XF4,             IF_EB("\03314~", ESC_STR "14~")},
-+    {K_F1,              IF_EB("\033OP", ESC_STR "OP")},
-+    {K_F2,              IF_EB("\033OQ", ESC_STR "OQ")},
-+    {K_F3,              IF_EB("\033OR", ESC_STR "OR")},
-+    {K_F4,              IF_EB("\033OS", ESC_STR "OS")},
-     {K_F5,		IF_EB("\03315;*~", ESC_STR "15;*~")},
-     {K_F6,		IF_EB("\03317;*~", ESC_STR "17;*~")},
-     {K_F7,		IF_EB("\03318;*~", ESC_STR "18;*~")},
+-    {K_XF1,		"\033O*P"},
+-    {K_XF2,		"\033O*Q"},
+-    {K_XF3,		"\033O*R"},
+-    {K_XF4,		"\033O*S"},
+-    {K_F1,		"\03311;*~"},
+-    {K_F2,		"\03312;*~"},
+-    {K_F3,		"\03313;*~"},
+-    {K_F4,		"\03314;*~"},
++    {K_XF1,		"\03311~"},
++    {K_XF2,		"\03312~"},
++    {K_XF3,		"\03313~"},
++    {K_XF4,		"\03314~"},
++    {K_F1,		"\033OP"},
++    {K_F2,		"\033OQ"},
++    {K_F3,		"\033OR"},
++    {K_F4,		"\033OS"},
+     {K_F5,		"\03315;*~"},
+     {K_F6,		"\03317;*~"},
+     {K_F7,		"\03318;*~"},

_service:tar_scm:vim-7.0-rclocation.patch Deleted

_service:tar_scm:vim-7.4-checkhl.patch Deleted

@@ -1,12 +0,0 @@
-diff -up vim74/runtime/syntax/spec.vim.kh1 vim74/runtime/syntax/spec.vim
---- vim74/runtime/syntax/spec.vim.kh1	2016-08-04 15:23:25.275955301 +0200
-+++ vim74/runtime/syntax/spec.vim	2016-08-04 15:24:56.699417602 +0200
-@@ -114,7 +114,7 @@ syn region specDescriptionArea matchgrou
- syn region specPackageArea matchgroup=specSection start='^%package' end='^%'me=e-1 contains=specPackageOpts,specPreAmble,specComment
- 
- "%% Scripts Section %%
--syn region specScriptArea matchgroup=specSection start='^%$prep\|build\|install\|clean\|pre\|postun\|preun\|post\|posttrans$\>' skip='^%{\|^%$define\|patch\d*\|configure\|GNUconfigure\|setup\|autosetup\|autopatch\|find_lang\|make_build\|makeinstall\|make_install$\>' end='^%'me=e-1 contains=specSpecialVariables,specVariables,@specCommands,specVariables,shDo,shFor,shCaseEsac,specNoNumberHilite,specCommandOpts,shComment,shIf,specSpecialChar,specMacroIdentifier,specSectionMacroArea,specSectionMacroBracketArea,shOperator,shQuote1,shQuote2
-+syn region specScriptArea matchgroup=specSection start='^%$prep\|build\|install\|check\|clean\|pre\|postun\|preun\|post\|posttrans$\>' skip='^%{\|^%$define\|patch\d*\|configure\|GNUconfigure\|setup\|find_lang\|makeinstall\|make_install$\>' end='^%'me=e-1 contains=specSpecialVariables,specVariables,@specCommands,specVariables,shDo,shFor,shCaseEsac,specNoNumberHilite,specCommandOpts,shComment,shIf,specSpecialChar,specMacroIdentifier,specSectionMacroArea,specSectionMacroBracketArea,shOperator,shQuote1,shQuote2
- 
- "%% Changelog Section %%
- syn region specChangelogArea matchgroup=specSection start='^%changelog' end='^%'me=e-1 contains=specEmail,specURL,specWeekday,specMonth,specNumber,specComment,specLicense

_service:tar_scm:vim-7.4-fstabsyntax.patch Changed

@@ -1,6 +1,6 @@
-diff -up vim81/runtime/syntax/fstab.vim.fstabsyntax vim81/runtime/syntax/fstab.vim
---- vim81/runtime/syntax/fstab.vim.fstabsyntax	2019-06-11 09:55:23.000000000 +0200
-+++ vim81/runtime/syntax/fstab.vim	2019-06-11 10:14:22.223616868 +0200
+diff -up vim82/runtime/syntax/fstab.vim.fstabsyntax vim82/runtime/syntax/fstab.vim
+--- vim82/runtime/syntax/fstab.vim.fstabsyntax	2020-08-10 12:08:01.000000000 +0200
++++ vim82/runtime/syntax/fstab.vim	2020-08-10 12:17:22.540855735 +0200
 @@ -56,7 +56,7 @@ syn keyword fsMountPointKeyword containe
  " Type
  syn cluster fsTypeCluster contains=fsTypeKeyword,fsTypeUnknown
@@ -14,7 +14,7 @@
  syn keyword fsOptionsYesNo yes no
  syn cluster fsOptionsCheckCluster contains=fsOptionsExt2Check,fsOptionsFatCheck
  syn keyword fsOptionsSize 512 1024 2048
--syn keyword fsOptionsGeneral async atime auto bind current defaults dev devgid devmode devmtime devuid dirsync exec force fstab kudzu loop mand move noatime noauto noclusterr noclusterw nodev nodevmtime nodiratime noexec nomand norelatime nosuid nosymfollow nouser owner rbind rdonly relatime remount ro rq rw suid suiddir supermount sw sync union update user users wxallowed xx nofail
+-syn keyword fsOptionsGeneral async atime auto bind current defaults dev devgid devmode devmtime devuid dirsync exec force fstab kudzu loop mand move noatime noauto noclusterr noclusterw nodev nodevmtime nodiratime noexec nomand norelatime nosuid nosymfollow nouser owner rbind rdonly relatime remount ro rq rw suid suiddir supermount sw sync union update user users wxallowed xx nofail failok
 +syn keyword fsOptionsGeneral async atime auto bind current defaults dev devgid devmode devmtime devuid dirsync exec force fstab kudzu loop managed mand move noatime noauto noclusterr noclusterw nodev nodevmtime nodiratime noexec nomand norelatime nosuid nosymfollow nouser owner pamconsole rbind rdonly relatime remount ro rq rw suid suiddir supermount sw sync union update user users wxallowed xx nofail
  syn match fsOptionsGeneral /_netdev/

_service:tar_scm:vim-7.4-globalsyntax.patch Changed

@@ -1,12 +1,13 @@
-diff -up vim74/runtime/syntax/spec.vim.orig vim74/runtime/syntax/spec.vim
---- vim74/runtime/syntax/spec.vim.orig	2016-01-12 13:51:55.727569873 +0100
-+++ vim74/runtime/syntax/spec.vim	2016-01-12 13:53:08.124991178 +0100
-@@ -114,7 +114,7 @@ syn region specDescriptionArea matchgrou
+diff --git a/runtime/syntax/spec.vim b/runtime/syntax/spec.vim
+index 1a5a108..b709d20 100644
+--- a/runtime/syntax/spec.vim
++++ b/runtime/syntax/spec.vim
+@@ -111,7 +111,7 @@ syn region specDescriptionArea matchgroup=specSection start='^%description' end=
  syn region specPackageArea matchgroup=specSection start='^%package' end='^%'me=e-1 contains=specPackageOpts,specPreAmble,specComment
  
  "%% Scripts Section %%
--syn region specScriptArea matchgroup=specSection start='^%$prep\|build\|install\|check\|clean\|pre\|postun\|preun\|post\|posttrans$\>' skip='^%{\|^%$define\|patch\d*\|configure\|GNUconfigure\|setup\|find_lang\|makeinstall\|make_install$\>' end='^%'me=e-1 contains=specSpecialVariables,specVariables,@specCommands,specVariables,shDo,shFor,shCaseEsac,specNoNumberHilite,specCommandOpts,shComment,shIf,specSpecialChar,specMacroIdentifier,specSectionMacroArea,specSectionMacroBracketArea,shOperator,shQuote1,shQuote2
-+syn region specScriptArea matchgroup=specSection start='^%$prep\|build\|install\|check\|clean\|pre\|postun\|preun\|post\|posttrans$\>' skip='^%{\|^%$define\|global\|patch\d*\|configure\|GNUconfigure\|setup\|find_lang\|makeinstall\|make_install$\>' end='^%'me=e-1 contains=specSpecialVariables,specVariables,@specCommands,specVariables,shDo,shFor,shCaseEsac,specNoNumberHilite,specCommandOpts,shComment,shIf,specSpecialChar,specMacroIdentifier,specSectionMacroArea,specSectionMacroBracketArea,shOperator,shQuote1,shQuote2
+-syn region specScriptArea matchgroup=specSection start='^%$prep\|build\|install\|clean\|check\|pre\|postun\|preun\|post\|posttrans$\>' skip='^%{\|^%$define\|patch\d*\|configure\|GNUconfigure\|setup\|autosetup\|autopatch\|find_lang\|make_build\|makeinstall\|make_install$\>' end='^%'me=e-1 contains=specSpecialVariables,specVariables,@specCommands,specVariables,shDo,shFor,shCaseEsac,specNoNumberHilite,specCommandOpts,shComment,shIf,specSpecialChar,specMacroIdentifier,specSectionMacroArea,specSectionMacroBracketArea,shOperator,shQuote1,shQuote2
++syn region specScriptArea matchgroup=specSection start='^%$prep\|build\|install\|clean\|check\|pre\|postun\|preun\|post\|posttrans$\>' skip='^%{\|^%$define\|global\|patch\d*\|configure\|GNUconfigure\|setup\|autosetup\|autopatch\|find_lang\|make_build\|makeinstall\|make_install$\>' end='^%'me=e-1 contains=specSpecialVariables,specVariables,@specCommands,specVariables,shDo,shFor,shCaseEsac,specNoNumberHilite,specCommandOpts,shComment,shIf,specSpecialChar,specMacroIdentifier,specSectionMacroArea,specSectionMacroBracketArea,shOperator,shQuote1,shQuote2
  
  "%% Changelog Section %%
  syn region specChangelogArea matchgroup=specSection start='^%changelog' end='^%'me=e-1 contains=specEmail,specURL,specWeekday,specMonth,specNumber,specComment,specLicense

_service:tar_scm:vim-7.4-nowarnings.patch Deleted

_service:tar_scm:vim-7.4-releasestring-1318991.patch Deleted

_service:tar_scm:vim-7.4-syncolor.patch Deleted

@@ -1,26 +0,0 @@
-diff --git a/src/highlight.c b/src/highlight.c
-index 9322f96..f7147a0 100644
---- a/src/highlight.c
-+++ b/src/highlight.c
-@@ -211,8 +211,8 @@ static char *(highlight_init_light) = {
-     CENT("Visual term=reverse",
- 	 "Visual term=reverse guibg=LightGrey"),
- #ifdef FEAT_DIFF
--    CENT("DiffAdd term=bold ctermbg=LightBlue",
--	 "DiffAdd term=bold ctermbg=LightBlue guibg=LightBlue"),
-+    CENT("DiffAdd term=bold ctermbg=LightRed",
-+	  "DiffAdd term=bold ctermbg=LightRed guibg=LightBlue"),
-     CENT("DiffChange term=bold ctermbg=LightMagenta",
- 	 "DiffChange term=bold ctermbg=LightMagenta guibg=LightMagenta"),
-     CENT("DiffDelete term=bold ctermfg=Blue ctermbg=LightCyan",
-@@ -304,8 +304,8 @@ static char *(highlight_init_dark) = {
-     CENT("Visual term=reverse",
- 	 "Visual term=reverse guibg=DarkGrey"),
- #ifdef FEAT_DIFF
--    CENT("DiffAdd term=bold ctermbg=DarkBlue",
--	 "DiffAdd term=bold ctermbg=DarkBlue guibg=DarkBlue"),
-+    CENT("DiffAdd term=bold ctermbg=DarkRed",
-+	  "DiffAdd term=bold ctermbg=DarkRed guibg=DarkBlue"),
-     CENT("DiffChange term=bold ctermbg=DarkMagenta",
- 	 "DiffChange term=bold ctermbg=DarkMagenta guibg=DarkMagenta"),
-     CENT("DiffDelete term=bold ctermfg=Blue ctermbg=DarkCyan",

_service:tar_scm:vim-7.4-syntax.patch Deleted

_service:tar_scm:vim-8.0-copy-paste.patch Changed

@@ -1,7 +1,8 @@
-diff -up vim81/runtime/defaults.vim.copypaste vim81/runtime/defaults.vim
---- vim81/runtime/defaults.vim.copypaste	2019-10-30 10:30:23.108710252 +0100
-+++ vim81/runtime/defaults.vim	2019-10-30 10:36:19.127508406 +0100
-@@ -73,18 +73,6 @@ map Q gq
+diff --git a/runtime/defaults.vim b/runtime/defaults.vim
+index f1d5cd1..b08de8e 100644
+--- a/runtime/defaults.vim
++++ b/runtime/defaults.vim
+@@ -74,18 +74,6 @@ sunmap Q
 " Revert with ":iunmap <C-U>".
 inoremap <C-U> <C-G>u<C-U>
 
@@ -17,6 +18,70 @@
 - endif
 -endif
 -
- " Switch syntax highlighting on when the terminal has colors or when using the
- " GUI (which always has colors).
- if &t_Co > 2 || has("gui_running")
+ " Only do this part when Vim was compiled with the +eval feature.
+ if 1
+ 
+diff --git a/src/testdir/test_balloon.vim b/src/testdir/test_balloon.vim
+index ed0c6c1..90c8c40 100644
+--- a/src/testdir/test_balloon.vim
++++ b/src/testdir/test_balloon.vim
+@@ -9,6 +9,7 @@ source screendump.vim
+ CheckScreendump
+ 
+ let s:common_script =<< trim CODE
++ set mouse=a
+ call setline(1, "one one one", "two tXo two", "three three three")
+ set balloonevalterm balloonexpr=MyBalloonExpr()..s:trailing balloondelay=100
+ let s:trailing = '<' " check that script context is set
+diff --git a/src/testdir/test_popupwin.vim b/src/testdir/test_popupwin.vim
+index b91689e..c6b70d1 100644
+--- a/src/testdir/test_popupwin.vim
++++ b/src/testdir/test_popupwin.vim
+@@ -553,6 +553,7 @@ func Test_popup_drag()
+ " create a popup that covers the command line
+ let lines =<< trim END
+ 	call setline(1, range(1, 20))
++	set mouse=a
+ 	split
+ 	vsplit
+ 	$wincmd w
+@@ -621,6 +622,7 @@ func Test_popup_drag_minwidth()
+ 
+ " create a popup that does not fit
+ let lines =<< trim END
++ set mouse=a
+ call range(40)
+ 	 \ ->map({_,i -> string(i)})
+ 	 \ ->popup_create({
+@@ -669,6 +671,7 @@ func Test_popup_drag_termwin()
+ let lines =<< trim END
+ 	set foldmethod=marker
+ 	call setline(1, range(100))
++	set mouse=a
+ 	for nr in range(7)
+ 	 call setline(nr * 12 + 1, "fold {{{")
+ 	 call setline(nr * 12 + 11, "end }}}")
+@@ -722,6 +725,7 @@ func Test_popup_close_with_mouse()
+ 
+ let lines =<< trim END
+ 	call setline(1, range(1, 20))
++	set mouse=a
+ 	" With border, can click on X
+ 	let winid = popup_create('foobar', #{
+ 	 \ close: 'button',
+@@ -1557,6 +1561,7 @@ func Test_popup_beval()
+ let lines =<< trim END
+ 	call setline(1, range(1, 20))
+ 	call setline(5, 'here is some text to hover over')
++	set mouse=a
+ 	set balloonevalterm
+ 	set balloonexpr=BalloonExpr()
+ 	set balloondelay=100
+@@ -2262,6 +2267,7 @@ func Test_popup_scrollbar()
+ 
+ let lines =<< trim END
+ call setline(1, range(1, 20))
++ set mouse=a
+ hi ScrollThumb ctermbg=blue
+ hi ScrollBar ctermbg=red
+ let winid = popup_create('one', 'two', 'three', 'four', 'five',

_service:tar_scm:vim-python3-tests.patch Changed

@@ -1,16 +1,16 @@
-diff -up vim80/runtime/tools/demoserver.py.python3-tests vim80/runtime/tools/demoserver.py
---- vim80/runtime/tools/demoserver.py.python3-tests	2018-05-11 08:24:41.774618804 +0200
-+++ vim80/runtime/tools/demoserver.py	2018-05-11 09:24:48.363309856 +0200
+diff -up vim82/runtime/tools/demoserver.py.python-tests vim82/runtime/tools/demoserver.py
+--- vim82/runtime/tools/demoserver.py.python-tests	2019-07-26 07:58:50.000000000 +0200
++++ vim82/runtime/tools/demoserver.py	2020-04-17 06:18:06.748977527 +0200
 @@ -1,4 +1,4 @@
 -#!/usr/bin/python
 +#!/usr/bin/python3
 #
 # Server that will accept connections from a Vim channel.
 # Run this server and then in Vim you can open the channel:
-diff -up vim80/src/auto/configure.python3-tests vim80/src/auto/configure
---- vim80/src/auto/configure.python3-tests	2018-05-11 08:25:03.632420873 +0200
-+++ vim80/src/auto/configure	2018-05-11 09:25:26.062000471 +0200
-@@ -6396,7 +6396,7 @@ eof
+diff -up vim82/src/auto/configure.python-tests vim82/src/auto/configure
+--- vim82/src/auto/configure.python-tests	2020-04-17 06:07:48.000000000 +0200
++++ vim82/src/auto/configure	2020-04-17 06:18:06.750977509 +0200
+@@ -6418,7 +6418,7 @@ eof
 	 if test "x$MACOS_X" = "xyes" && test -n "${python_PYTHONFRAMEWORK}" && ${vi_cv_path_python} -c \
 		"import sys; sys.exit(${vi_cv_var_python_version} < 2.3)"; then
 	 vi_cv_path_python_plibs="-framework Python"
@@ -19,10 +19,10 @@
 		 vi_cv_path_python_plibs="-F${python_PYTHONFRAMEWORKPREFIX} -framework Python"
 	 fi
 	 else
-diff -up vim80/src/configure.ac.python3-tests vim80/src/configure.ac
---- vim80/src/configure.ac.python3-tests	2018-05-11 08:25:26.070218957 +0200
-+++ vim80/src/configure.ac	2018-05-11 09:26:01.603708243 +0200
-@@ -1248,7 +1248,7 @@ eof
+diff -up vim82/src/configure.ac.python-tests vim82/src/configure.ac
+--- vim82/src/configure.ac.python-tests	2020-04-17 06:07:48.000000000 +0200
++++ vim82/src/configure.ac	2020-04-17 06:18:06.750977509 +0200
+@@ -1263,7 +1263,7 @@ eof
 	 if test "x$MACOS_X" = "xyes" && test -n "${python_PYTHONFRAMEWORK}" && ${vi_cv_path_python} -c \
 		"import sys; sys.exit(${vi_cv_var_python_version} < 2.3)"; then
 	 vi_cv_path_python_plibs="-framework Python"
@@ -31,54 +31,54 @@
 		 vi_cv_path_python_plibs="-F${python_PYTHONFRAMEWORKPREFIX} -framework Python"
 	 fi
 	 else
-diff -up vim80/src/testdir/test_channel_pipe.py.python3-tests vim80/src/testdir/test_channel_pipe.py
---- vim80/src/testdir/test_channel_pipe.py.python3-tests	2018-05-11 09:23:05.738146018 +0200
-+++ vim80/src/testdir/test_channel_pipe.py	2018-05-11 09:26:37.354413350 +0200
+diff -up vim82/src/testdir/test_channel_pipe.py.python-tests vim82/src/testdir/test_channel_pipe.py
+--- vim82/src/testdir/test_channel_pipe.py.python-tests	2019-07-26 07:58:53.000000000 +0200
++++ vim82/src/testdir/test_channel_pipe.py	2020-04-17 06:18:06.751977500 +0200
 @@ -1,4 +1,4 @@
 -#!/usr/bin/python
 +#!/usr/bin/python3
 #
 # Server that will communicate over stdin/stderr
 #
-diff -up vim80/src/testdir/test_channel.py.python3-tests vim80/src/testdir/test_channel.py
---- vim80/src/testdir/test_channel.py.python3-tests	2018-05-11 09:22:48.522284266 +0200
-+++ vim80/src/testdir/test_channel.py	2018-05-11 09:26:17.762574955 +0200
+diff -up vim82/src/testdir/test_channel.py.python-tests vim82/src/testdir/test_channel.py
+--- vim82/src/testdir/test_channel.py.python-tests	2020-04-17 06:18:06.751977500 +0200
++++ vim82/src/testdir/test_channel.py	2020-04-17 06:18:24.517813082 +0200
 @@ -1,4 +1,4 @@
--#!/usr/bin/python
+-#!/usr/bin/env python
 +#!/usr/bin/python3
 #
 # Server that will accept connections from a Vim channel.
 # Used by test_channel.vim.
-diff -up vim80/src/testdir/test_channel_write.py.python3-tests vim80/src/testdir/test_channel_write.py
---- vim80/src/testdir/test_channel_write.py.python3-tests	2018-05-11 09:23:21.254021422 +0200
-+++ vim80/src/testdir/test_channel_write.py	2018-05-11 09:26:54.952268193 +0200
+diff -up vim82/src/testdir/test_channel_write.py.python-tests vim82/src/testdir/test_channel_write.py
+--- vim82/src/testdir/test_channel_write.py.python-tests	2019-07-26 07:58:53.000000000 +0200
++++ vim82/src/testdir/test_channel_write.py	2020-04-17 06:18:06.751977500 +0200
 @@ -1,4 +1,4 @@
 -#!/usr/bin/python
 +#!/usr/bin/python3
 #
 # Program that writes a number to stdout repeatedly
 #
-diff -up vim80/src/testdir/test_makeencoding.py.python3-tests vim80/src/testdir/test_makeencoding.py
---- vim80/src/testdir/test_makeencoding.py.python3-tests	2018-05-11 09:23:38.990878990 +0200
-+++ vim80/src/testdir/test_makeencoding.py	2018-05-11 09:27:14.402107759 +0200
+diff -up vim82/src/testdir/test_makeencoding.py.python-tests vim82/src/testdir/test_makeencoding.py
+--- vim82/src/testdir/test_makeencoding.py.python-tests	2019-07-26 07:58:53.000000000 +0200
++++ vim82/src/testdir/test_makeencoding.py	2020-04-17 06:18:06.751977500 +0200
 @@ -1,4 +1,4 @@
 -#!/usr/bin/python
 +#!/usr/bin/python3
 # -*- coding: utf-8 -*-
 
 # Test program for :make, :grep and :cgetfile.
-diff -up vim80/src/testdir/test_netbeans.py.python3-tests vim80/src/testdir/test_netbeans.py
---- vim80/src/testdir/test_netbeans.py.python3-tests	2018-05-11 09:23:54.398752732 +0200
-+++ vim80/src/testdir/test_netbeans.py	2018-05-11 09:27:30.489975057 +0200
+diff -up vim82/src/testdir/test_netbeans.py.python-tests vim82/src/testdir/test_netbeans.py
+--- vim82/src/testdir/test_netbeans.py.python-tests	2019-07-26 07:58:53.000000000 +0200
++++ vim82/src/testdir/test_netbeans.py	2020-04-17 06:18:06.751977500 +0200
 @@ -1,4 +1,4 @@
 -#!/usr/bin/python
 +#!/usr/bin/python3
 #
 # Server that will communicate with Vim through the netbeans interface.
 # Used by test_netbeans.vim.
-diff -up vim80/src/testdir/test_short_sleep.py.python3-tests vim80/src/testdir/test_short_sleep.py
---- vim80/src/testdir/test_short_sleep.py.python3-tests	2018-05-11 09:24:09.134631798 +0200
-+++ vim80/src/testdir/test_short_sleep.py	2018-05-11 09:27:48.432827053 +0200
+diff -up vim82/src/testdir/test_short_sleep.py.python-tests vim82/src/testdir/test_short_sleep.py
+--- vim82/src/testdir/test_short_sleep.py.python-tests	2019-07-26 07:58:53.000000000 +0200
++++ vim82/src/testdir/test_short_sleep.py	2020-04-17 06:18:06.751977500 +0200
 @@ -1,4 +1,4 @@
 -#!/usr/bin/python
 +#!/usr/bin/python3

_service Changed

_service:tar_scm:vim-8.2.tar.bz2 -> _service:tar_scm:vim-9.0.tar.bz2 Changed