From: Bram Moolenaar <Bram@vim.org>
Date: Sat, 4 Sep 2021 18:47:28 +0200
Subject: patch 8.2.3402: invalid memory access when using :retab with large
 value

Problem:    Invalid memory access when using :retab with large value.
Solution:   Check the number is positive.
(cherry picked from commit b7081e135a16091c93f6f5f7525a5c58fb7ca9f9)
---
 src/ex_cmds.c              |  2 +-
 src/option.c               | 46 +++++++++++++++++++++++++++-------------------
 src/testdir/test_retab.vim |  3 +++
 src/version.c              |  1 +
 4 files changed, 32 insertions(+), 20 deletions(-)

--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -698,7 +698,7 @@ ex_retab(exarg_T *eap)
 
 #ifdef FEAT_VARTABS
     new_ts_str = eap->arg;
-    if (!tabstop_set(eap->arg, &new_vts_array))
+    if (tabstop_set(eap->arg, &new_vts_array) == FAIL)
 	return;
     while (vim_isdigit(*(eap->arg)) || *(eap->arg) == ',')
 	++(eap->arg);
--- a/src/option.c
+++ b/src/option.c
@@ -5612,9 +5612,9 @@ didset_options2(void)
 #endif
 #ifdef FEAT_VARTABS
     vim_free(curbuf->b_p_vsts_array);
-    tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
+    (void)tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
     vim_free(curbuf->b_p_vts_array);
-    tabstop_set(curbuf->b_p_vts,  &curbuf->b_p_vts_array);
+    (void)tabstop_set(curbuf->b_p_vts,  &curbuf->b_p_vts_array);
 #endif
 }
 
@@ -7551,7 +7551,7 @@ did_set_string_option(
 	    if (errmsg == NULL)
 	    {
 		int *oldarray = curbuf->b_p_vsts_array;
-		if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)))
+		if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)) == OK)
 		{
 		    if (oldarray)
 			vim_free(oldarray);
@@ -7590,7 +7590,7 @@ did_set_string_option(
 	    {
 		int *oldarray = curbuf->b_p_vts_array;
 
-		if (tabstop_set(*varp, &(curbuf->b_p_vts_array)))
+		if (tabstop_set(*varp, &(curbuf->b_p_vts_array)) == OK)
 		{
 		    vim_free(oldarray);
 #ifdef FEAT_FOLDING
@@ -11395,7 +11395,7 @@ buf_copy_options(buf_T *buf, int flags)
 #ifdef FEAT_VARTABS
 	    buf->b_p_vsts = vim_strsave(p_vsts);
 	    if (p_vsts && p_vsts != empty_option)
-		tabstop_set(p_vsts, &buf->b_p_vsts_array);
+		(void)tabstop_set(p_vsts, &buf->b_p_vsts_array);
 	    else
 		buf->b_p_vsts_array = 0;
 	    buf->b_p_vsts_nopaste = p_vsts_nopaste
@@ -11524,7 +11524,7 @@ buf_copy_options(buf_T *buf, int flags)
 		buf->b_p_isk = save_p_isk;
 #ifdef FEAT_VARTABS
 		if (p_vts && p_vts != empty_option && !buf->b_p_vts_array)
-		    tabstop_set(p_vts, &buf->b_p_vts_array);
+		    (void)tabstop_set(p_vts, &buf->b_p_vts_array);
 		else
 		    buf->b_p_vts_array = NULL;
 #endif
@@ -11537,7 +11537,7 @@ buf_copy_options(buf_T *buf, int flags)
 #ifdef FEAT_VARTABS
 		buf->b_p_vts = vim_strsave(p_vts);
 		if (p_vts && p_vts != empty_option && !buf->b_p_vts_array)
-		    tabstop_set(p_vts, &buf->b_p_vts_array);
+		    (void)tabstop_set(p_vts, &buf->b_p_vts_array);
 		else
 		    buf->b_p_vts_array = NULL;
 #endif
@@ -12435,7 +12435,7 @@ paste_option_changed(void)
 	    if (buf->b_p_vsts_array)
 		vim_free(buf->b_p_vsts_array);
 	    if (buf->b_p_vsts && buf->b_p_vsts != empty_option)
-		tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
+		(void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
 	    else
 		buf->b_p_vsts_array = 0;
 #endif
@@ -12807,18 +12807,19 @@ check_ff_value(char_u *p)
 /*
  * Set the integer values corresponding to the string setting of 'vartabstop'.
  * "array" will be set, caller must free it if needed.
+ * Return FAIL for an error.
  */
     int
 tabstop_set(char_u *var, int **array)
 {
-    int valcount = 1;
-    int t;
-    char_u *cp;
+    int		valcount = 1;
+    int		t;
+    char_u	*cp;
 
     if (var[0] == NUL || (var[0] == '0' && var[1] == NUL))
     {
 	*array = NULL;
-	return TRUE;
+	return OK;
     }
 
     for (cp = var; *cp != NUL; ++cp)
@@ -12832,8 +12833,8 @@ tabstop_set(char_u *var, int **array)
 		if (cp != end)
 		    emsg(_(e_positive));
 		else
-		    emsg(_(e_invarg));
-		return FALSE;
+		    semsg(_(e_invarg2), cp);
+		return FAIL;
 	    }
 	}
 
@@ -12844,26 +12845,33 @@ tabstop_set(char_u *var, int **array)
 	    ++valcount;
 	    continue;
 	}
-	emsg(_(e_invarg));
-	return FALSE;
+	semsg(_(e_invarg2), var);
+	return FAIL;
     }
 
     *array = (int *)alloc((unsigned) ((valcount + 1) * sizeof(int)));
     if (*array == NULL)
-	return FALSE;
+	return FAIL;
     (*array)[0] = valcount;
 
     t = 1;
     for (cp = var; *cp != NUL;)
     {
-	(*array)[t++] = atoi((char *)cp);
+	int n = atoi((char *)cp);
+
+	if (n < 0 || n > 9999)
+	{
+	    semsg(_(e_invarg2), cp);
+	    return FAIL;
+	}
+	(*array)[t++] = n;
 	while (*cp  != NUL && *cp != ',')
 	    ++cp;
 	if (*cp != NUL)
 	    ++cp;
     }
 
-    return TRUE;
+    return OK;
 }
 
 /*
--- a/src/testdir/test_retab.vim
+++ b/src/testdir/test_retab.vim
@@ -74,4 +74,7 @@ endfunc
 func Test_retab_error()
   call assert_fails('retab -1',  'E487:')
   call assert_fails('retab! -1', 'E487:')
+  call assert_fails('ret -1000', 'E487:')
+  call assert_fails('ret 10000', 'E475:')
+  call assert_fails('ret 80000000000000000000', 'E475:')
 endfunc
--- a/src/version.c
+++ b/src/version.c
@@ -2580,6 +2580,7 @@ static int included_patches[] =
  */
 static char *(extra_patches[]) =
 {   /* Add your patch description below this line */
+    "8.2.3402",
 /**/
     NULL
 };