Adding debian version 2:8.1.0875-5+deb10u4.debian/2%8.1.0875-5+deb10u4

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 104 insertions, 0 deletions

diff --git a/debian/patches/CVE-2022-0318.patch b/debian/patches/CVE-2022-0318.patch
new file mode 100644
index 0000000..b2005a7
--- /dev/null
+++ b/debian/patches/CVE-2022-0318.patch
@@ -0,0 +1,104 @@
+From 57df9e8a9f9ae1aafdde9b86b10ad907627a87dc Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Thu, 20 Jan 2022 12:10:48 +0000
+Subject: [PATCH] patch 8.2.4151: reading beyond the end of a line
+
+Problem:    Reading beyond the end of a line.
+Solution:   For block insert only use the offset for correcting the length.
+---
+ src/ops.c                   | 19 ++-----------------
+ src/testdir/test_visual.vim |  9 +++++++++
+ src/version.c               |  2 ++
+ 3 files changed, 13 insertions(+), 17 deletions(-)
+
+Backport:
+ * In Debian, this patch got swapped with CVE-2022-0261 aka
+   9f8c304c8a390ade133bac29963dc8e56ab14cbc.
+ * We also backport the spaces check from
+   4067bd3604215b48e4b4201e28f9e401b08418e4, see #1023818.
+ * We also backport the expected test output from
+   fc6ccebea668c49e9e617e0657421b6a8ed9df1e.
+ * Replace expr-.. by expr-.
+
+diff --git a/src/ops.c b/src/ops.c
+index a9968024901e..e0fa344d8ee6 100644
+--- a/src/ops.c
++++ b/src/ops.c
+@@ -629,24 +629,12 @@ block_insert(
+ 	}
+ 
+ 	if (has_mbyte && spaces > 0)
+-	{
+-	    int off;
++	    /* avoid copying part of a multi-byte character */
++	    offset -= (*mb_head_off)(oldp, oldp + offset);
+ 
+-	    /* Avoid starting halfway a multi-byte character. */
+-	    if (b_insert)
+-	    {
+-		off = (*mb_head_off)(oldp, oldp + offset + spaces);
+-		spaces -= off;
+-		count -= off;
+-	    }
+-	    else
+-	    {
+-		// spaces fill the gap, the character that's at the edge moves
+-		// right
+-		off = (*mb_head_off)(oldp, oldp + offset);
+-		offset -= off;
+-	    }
+-	}
++	if (spaces < 0)  // can happen when the cursor was moved
++	    spaces = 0;
++
+ 	// Make sure the allocated size matches what is actually copied below.
+ 	newp = alloc_check((unsigned)(STRLEN(oldp)) + spaces + s_len
+ 		    + (spaces > 0 && !bdp->is_short ? p_ts - spaces : 0)
+diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
+index b438fa1e66c6..a187aa8e085e 100644
+--- a/src/testdir/test_visual.vim
++++ b/src/testdir/test_visual.vim
+@@ -417,6 +417,15 @@
+   bwipe!
+ endfunc
+ 
++func Test_visual_block_insert_round_off()
++  new
++  " The number of characters are tuned to fill a 4096 byte allocated block,
++  " so that valgrind reports going over the end.
++  call setline(1, ['xxxxx', repeat('0', 1350), "\t", repeat('x', 60)])
++  exe "normal gg0\<C-V>GI" . repeat('0', 1320) . "\<Esc>"
++  bwipe!
++endfunc
++
+ " CVE-2022-0361
+ func Test_visual_ex_copy_line()
+   new
+diff --git a/src/testdir/test_utf8.vim b/src/testdir/test_utf8.vim
+index 0210ce63c..862e73b9a 100644
+--- a/src/testdir/test_utf8.vim
++++ b/src/testdir/test_utf8.vim
+@@ -6,7 +6,7 @@ func Test_visual_block_insert()
+   new
+   call setline(1, ["aaa", "あああ", "bbb"])
+   exe ":norm! gg0l\<C-V>jjIx\<Esc>"
+-  call assert_equal(['axaa', 'xあああ', 'bxbb'], getline(1, '$'))
++  call assert_equal(['axaa', ' xあああ', 'bxbb'], getline(1, '$'))
+   bwipeout!
+ endfunc
+ 
+diff --git a/src/version.c b/src/version.c
+index 53f1619f94d4..227eaa958e2b 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -797,6 +797,10 @@ static char *(features[]) =
+     5024,
+ /**/
+     4214,
++/**/
++    4152,
++/**/
++    4151,
+ /**/
+     4120,
+ /**/