1 files changed, 65 insertions, 0 deletions
diff --git a/debian/patches/CVE-2022-1898.patch b/debian/patches/CVE-2022-1898.patch
new file mode 100644
index 0000000..c5817ba
--- /dev/null
+++ b/debian/patches/CVE-2022-1898.patch
@@ -0,0 +1,65 @@
+From: Markus Koschany <apo@debian.org>
+Date: Wed, 2 Nov 2022 22:07:35 +0100
+Subject: CVE-2022-1898
+
+Origin: https://github.com/vim/vim/commit/e2fa213cf571041dbd04ab0329303ffdc980678a
+---
+ src/normal.c                 | 6 ++++++
+ src/testdir/test_tagjump.vim | 6 ++++++
+ src/version.c                | 2 ++
+ 3 files changed, 14 insertions(+)
+
+diff --git a/src/normal.c b/src/normal.c
+index ebda136..c3b6897 100644
+--- a/src/normal.c
++++ b/src/normal.c
+@@ -6426,6 +6426,11 @@ nv_brackets(cmdarg_T *cap)
+ 	    clearop(cap->oap);
+ 	else
+ 	{
++	    // Make a copy, if the line was changed it will be freed.
++	    ptr = vim_strnsave(ptr, len);
++	    if (ptr == NULL)
++		return;
++
+ 	    find_pattern_in_path(ptr, 0, len, TRUE,
+ 		cap->count0 == 0 ? !isupper(cap->nchar) : FALSE,
+ 		((cap->nchar & 0xf) == ('d' & 0xf)) ?  FIND_DEFINE : FIND_ANY,
+@@ -6434,6 +6439,7 @@ nv_brackets(cmdarg_T *cap)
+ 			    islower(cap->nchar) ? ACTION_SHOW : ACTION_GOTO,
+ 		cap->cmdchar == ']' ? curwin->w_cursor.lnum + 1 : (linenr_T)1,
+ 		(linenr_T)MAXLNUM);
++	    vim_free(ptr);
+ 	    curwin->w_set_curswant = TRUE;
+ 	}
+     }
+diff --git a/src/testdir/test_tagjump.vim b/src/testdir/test_tagjump.vim
+index ae47a69..da4af2f 100644
+--- a/src/testdir/test_tagjump.vim
++++ b/src/testdir/test_tagjump.vim
+@@ -255,6 +255,12 @@ func Test_tagjump_etags()
+   call delete('Xtags')
+   call delete('Xmain.c')
+   bwipe!
++
++  new somefile
++  call setline(1, ['first line', '', '#define something 0'])
++  sil norm 0o0
++  sil! norm ]d
++  bwipe!
+ endfunc
+ 
+ " Test for getting and modifying the tag stack
+diff --git a/src/version.c b/src/version.c
+index 586e9ca..cd174b0 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -791,6 +791,8 @@ static char *(features[]) =
+ 
+ static int included_patches[] =
+ {   /* Add new patch number below this line */
++/**/
++    5024,
+ /**/
+     4214,
+ /**/