summaryrefslogtreecommitdiffstats
path: root/debian/patches
diff options
context:
space:
mode:
Diffstat (limited to 'debian/patches')
-rw-r--r--debian/patches/debian/Add-recognition-of-more-LaTeX-commands-for-tex-filetype-d.patch27
-rw-r--r--debian/patches/debian/Detect-the-rst-filetype-using-the-contents-of-the-file.patch28
-rw-r--r--debian/patches/debian/Document-Debian-s-decision-to-disable-modelines-by-defaul.patch29
-rw-r--r--debian/patches/debian/Support-sourcing-a-vimrc.tiny-when-Vim-is-invoked-as-vi.patch85
-rw-r--r--debian/patches/series8
-rw-r--r--debian/patches/upstream/patch-8.2.3402-invalid-memory-access-when-using-retab-wit.patch203
-rw-r--r--debian/patches/upstream/patch-8.2.3403-memory-leak-for-retab-with-invalid-argumen.patch61
-rw-r--r--debian/patches/upstream/patch-8.2.3409-reading-beyond-end-of-line-with-invalid-ut.patch56
-rw-r--r--debian/patches/upstream/patch-8.2.3428-using-freed-memory-when-replacing.patch76
9 files changed, 573 insertions, 0 deletions
diff --git a/debian/patches/debian/Add-recognition-of-more-LaTeX-commands-for-tex-filetype-d.patch b/debian/patches/debian/Add-recognition-of-more-LaTeX-commands-for-tex-filetype-d.patch
new file mode 100644
index 0000000..c74dc58
--- /dev/null
+++ b/debian/patches/debian/Add-recognition-of-more-LaTeX-commands-for-tex-filetype-d.patch
@@ -0,0 +1,27 @@
+From: Stefano Zacchiroli <zack@debian.org>
+Date: Fri, 25 Aug 2006 13:33:04 +0200
+Subject: Add recognition of more LaTeX commands for tex filetype detection
+
+Since filetype detection of TeX files defaults to plaintex, we've added
+detection of some additional LaTeX commands to help sway the detection
+to LaTeX.
+
+Closes: #384479
+Signed-off-by: James McCoy <jamessan@debian.org>
+---
+ runtime/autoload/dist/ft.vim | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/runtime/autoload/dist/ft.vim b/runtime/autoload/dist/ft.vim
+index 1ac74b5..4bb8917 100644
+--- a/runtime/autoload/dist/ft.vim
++++ b/runtime/autoload/dist/ft.vim
+@@ -684,7 +684,7 @@ func dist#ft#FTtex()
+ call cursor(1,1)
+ let firstNC = search('^\s*[^[:space:]%]', 'c', 1000)
+ if firstNC " Check the next thousand lines for a LaTeX or ConTeXt keyword.
+- let lpat = 'documentclass\>\|usepackage\>\|begin{\|newcommand\>\|renewcommand\>'
++ let lpat = 'documentclass\>\|usepackage\>\|begin{\|newcommand\>\|renewcommand\>\|part\>\|chapter\>\|section\>\|subsection\>\|subsubsection\>\|paragraph\>\|subparagraph\>\|subsubparagraph'
+ let cpat = 'start\a\+\|setup\a\+\|usemodule\|enablemode\|enableregime\|setvariables\|useencoding\|usesymbols\|stelle\a\+\|verwende\a\+\|stel\a\+\|gebruik\a\+\|usa\a\+\|imposta\a\+\|regle\a\+\|utilisemodule\>'
+ let kwline = search('^\s*\\\%(' . lpat . '\)\|^\s*\\\(' . cpat . '\)',
+ \ 'cnp', firstNC + 1000)
diff --git a/debian/patches/debian/Detect-the-rst-filetype-using-the-contents-of-the-file.patch b/debian/patches/debian/Detect-the-rst-filetype-using-the-contents-of-the-file.patch
new file mode 100644
index 0000000..56c6c96
--- /dev/null
+++ b/debian/patches/debian/Detect-the-rst-filetype-using-the-contents-of-the-file.patch
@@ -0,0 +1,28 @@
+From: James Vega <jamessan@debian.org>
+Date: Fri, 18 Aug 2006 09:06:20 -0400
+Subject: Detect the rst filetype using the contents of the file
+
+Closes: #382541
+---
+ runtime/scripts.vim | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/runtime/scripts.vim b/runtime/scripts.vim
+index 6448c54..426a9ba 100644
+--- a/runtime/scripts.vim
++++ b/runtime/scripts.vim
+@@ -371,6 +371,14 @@ else
+ elseif s:line1 =~# 'exec\s\+\S*scheme' || s:line2 =~# 'exec\s\+\S*scheme'
+ set ft=scheme
+
++ " rst files
++ elseif s:line1 =~ '^\.\.\s\|^\s*restindex\s*$'
++ \ || s:line2 =~ '^\.\.\s\|^\s*restindex\s*$'
++ \ || s:line3 =~ '^\.\.\s\|^\s*restindex\s*$'
++ \ || s:line4 =~ '^\.\.\s\|^\s*restindex\s*$'
++ \ || s:line5 =~ '^\.\.\s\|^\s*restindex\s*$'
++ set ft=rst
++
+ " Git output
+ elseif s:line1 =~# '^\(commit\|tree\|object\) \x\{40\}\>\|^tag \S\+$'
+ set ft=git
diff --git a/debian/patches/debian/Document-Debian-s-decision-to-disable-modelines-by-defaul.patch b/debian/patches/debian/Document-Debian-s-decision-to-disable-modelines-by-defaul.patch
new file mode 100644
index 0000000..20ed074
--- /dev/null
+++ b/debian/patches/debian/Document-Debian-s-decision-to-disable-modelines-by-defaul.patch
@@ -0,0 +1,29 @@
+From: James Vega <jamessan@debian.org>
+Date: Thu, 27 Mar 2008 03:42:02 +0000
+Subject: Document Debian's decision to disable modelines by default
+
+Modelines have historically been a source of vulnerabilities in Vim.
+As long as it remains a "blacklist suspected/proven dangerous options"
+instead of a "whitelist allowed options" piece of functionality,
+Debian's system-wide vimrc will maintain this setting. As such, the
+documentation needs to be updated to reflect the induced behavior.
+
+Closes: #472522
+Signed-off-by: James McCoy <jamessan@debian.org>
+---
+ runtime/doc/options.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/runtime/doc/options.txt b/runtime/doc/options.txt
+index 8b655dc..e03af4f 100644
+--- a/runtime/doc/options.txt
++++ b/runtime/doc/options.txt
+@@ -5155,7 +5155,7 @@ A jump table for the options with a short description can be found at |Q_op|.
+
+ *'modeline'* *'ml'* *'nomodeline'* *'noml'*
+ 'modeline' 'ml' boolean (Vim default: on (off for root),
+- Vi default: off)
++ Debian: off, Vi default: off)
+ local to buffer
+ If 'modeline' is on 'modelines' gives the number of lines that is
+ checked for set commands. If 'modeline' is off or 'modelines' is zero
diff --git a/debian/patches/debian/Support-sourcing-a-vimrc.tiny-when-Vim-is-invoked-as-vi.patch b/debian/patches/debian/Support-sourcing-a-vimrc.tiny-when-Vim-is-invoked-as-vi.patch
new file mode 100644
index 0000000..78e937c
--- /dev/null
+++ b/debian/patches/debian/Support-sourcing-a-vimrc.tiny-when-Vim-is-invoked-as-vi.patch
@@ -0,0 +1,85 @@
+From: James McCoy <jamessan@debian.org>
+Date: Tue, 6 Oct 2015 23:46:30 -0400
+Subject: Support sourcing a vimrc.tiny when Vim is invoked as vi
+
+This is used only in the vim-tiny package to allow a specific
+configuration for vim-tiny's vi. The vim-tiny package is substantially
+different from other Vim packages, so it does not make sense to
+share the same config.
+
+Closes: #222138
+Signed-off-by: Stefano Zacchiroli <zack@debian.org>
+Signed-off-by: James Vega <jamessan@debian.org>
+---
+ src/main.c | 14 +++++++++++++-
+ src/os_unix.h | 3 +++
+ src/structs.h | 3 +++
+ 3 files changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/src/main.c b/src/main.c
+index ef53b33..6e67e72 100644
+--- a/src/main.c
++++ b/src/main.c
+@@ -1868,6 +1868,10 @@ parse_command_name(mparm_T *parmp)
+ }
+ else if (STRNICMP(initstr, "vim", 3) == 0)
+ initstr += 3;
++#ifdef SYS_TINYRC_FILE
++ else if (STRNICMP(initstr, "vi", 2) == 0)
++ parmp->vi_mode = TRUE;
++#endif
+
+ // Catch "[r][g]vimdiff" and "[r][g]viewdiff".
+ if (STRICMP(initstr, "diff") == 0)
+@@ -3130,7 +3134,12 @@ source_startup_scripts(mparm_T *parmp)
+ * Get system wide defaults, if the file name is defined.
+ */
+ #ifdef SYS_VIMRC_FILE
+- (void)do_source((char_u *)SYS_VIMRC_FILE, FALSE, DOSO_NONE, NULL);
++# if defined(SYS_TINYRC_FILE) && defined(TINY_VIMRC)
++ if (parmp->vi_mode)
++ (void)do_source((char_u *)SYS_TINYRC_FILE, FALSE, DOSO_NONE, NULL);
++ else
++# endif
++ (void)do_source((char_u *)SYS_VIMRC_FILE, FALSE, DOSO_NONE, NULL);
+ #endif
+ #ifdef MACOS_X
+ (void)do_source((char_u *)"$VIMRUNTIME/macmap.vim", FALSE,
+@@ -3169,6 +3178,9 @@ source_startup_scripts(mparm_T *parmp)
+ #ifdef USR_EXRC_FILE2
+ && do_source((char_u *)USR_EXRC_FILE2, FALSE,
+ DOSO_NONE, NULL) == FAIL
++#endif
++#if defined(SYS_TINYRC_FILE) && defined(TINY_VIMRC)
++ && !parmp->vi_mode
+ #endif
+ && !has_dash_c_arg)
+ {
+diff --git a/src/os_unix.h b/src/os_unix.h
+index 83fe66d..8880fec 100644
+--- a/src/os_unix.h
++++ b/src/os_unix.h
+@@ -219,6 +219,9 @@ typedef struct dsc$descriptor DESC;
+ /*
+ * Unix system-dependent file names
+ */
++#ifndef SYS_TINYRC_FILE
++# define SYS_TINYRC_FILE "$VIM/vimrc.tiny"
++#endif
+ #ifndef SYS_VIMRC_FILE
+ # define SYS_VIMRC_FILE "$VIM/vimrc"
+ #endif
+diff --git a/src/structs.h b/src/structs.h
+index bd59656..6e6499c 100644
+--- a/src/structs.h
++++ b/src/structs.h
+@@ -4130,6 +4130,9 @@ typedef struct
+ #ifdef FEAT_DIFF
+ int diff_mode; // start with 'diff' set
+ #endif
++#ifdef SYS_TINYRC_FILE
++ int vi_mode; /* started as "vi" */
++#endif
+ } mparm_T;
+
+ /*
diff --git a/debian/patches/series b/debian/patches/series
new file mode 100644
index 0000000..158f03a
--- /dev/null
+++ b/debian/patches/series
@@ -0,0 +1,8 @@
+debian/Support-sourcing-a-vimrc.tiny-when-Vim-is-invoked-as-vi.patch
+debian/Detect-the-rst-filetype-using-the-contents-of-the-file.patch
+debian/Add-recognition-of-more-LaTeX-commands-for-tex-filetype-d.patch
+debian/Document-Debian-s-decision-to-disable-modelines-by-defaul.patch
+upstream/patch-8.2.3402-invalid-memory-access-when-using-retab-wit.patch
+upstream/patch-8.2.3403-memory-leak-for-retab-with-invalid-argumen.patch
+upstream/patch-8.2.3409-reading-beyond-end-of-line-with-invalid-ut.patch
+upstream/patch-8.2.3428-using-freed-memory-when-replacing.patch
diff --git a/debian/patches/upstream/patch-8.2.3402-invalid-memory-access-when-using-retab-wit.patch b/debian/patches/upstream/patch-8.2.3402-invalid-memory-access-when-using-retab-wit.patch
new file mode 100644
index 0000000..245516d
--- /dev/null
+++ b/debian/patches/upstream/patch-8.2.3402-invalid-memory-access-when-using-retab-wit.patch
@@ -0,0 +1,203 @@
+From: Bram Moolenaar <Bram@vim.org>
+Date: Sat, 4 Sep 2021 18:47:28 +0200
+Subject: patch 8.2.3402: invalid memory access when using :retab with large
+ value
+
+Problem: Invalid memory access when using :retab with large value.
+Solution: Check the number is positive.
+---
+ src/indent.c | 34 +++++++++++++++++++++-------------
+ src/option.c | 12 ++++++------
+ src/optionstr.c | 4 ++--
+ src/testdir/test_retab.vim | 3 +++
+ src/version.c | 1 +
+ 5 files changed, 33 insertions(+), 21 deletions(-)
+
+diff --git a/src/indent.c b/src/indent.c
+index a9d406e..9209a39 100644
+--- a/src/indent.c
++++ b/src/indent.c
+@@ -18,18 +18,19 @@
+ /*
+ * Set the integer values corresponding to the string setting of 'vartabstop'.
+ * "array" will be set, caller must free it if needed.
++ * Return FAIL for an error.
+ */
+ int
+ tabstop_set(char_u *var, int **array)
+ {
+- int valcount = 1;
+- int t;
+- char_u *cp;
++ int valcount = 1;
++ int t;
++ char_u *cp;
+
+ if (var[0] == NUL || (var[0] == '0' && var[1] == NUL))
+ {
+ *array = NULL;
+- return TRUE;
++ return OK;
+ }
+
+ for (cp = var; *cp != NUL; ++cp)
+@@ -43,8 +44,8 @@ tabstop_set(char_u *var, int **array)
+ if (cp != end)
+ emsg(_(e_positive));
+ else
+- emsg(_(e_invarg));
+- return FALSE;
++ semsg(_(e_invarg2), cp);
++ return FAIL;
+ }
+ }
+
+@@ -55,26 +56,33 @@ tabstop_set(char_u *var, int **array)
+ ++valcount;
+ continue;
+ }
+- emsg(_(e_invarg));
+- return FALSE;
++ semsg(_(e_invarg2), var);
++ return FAIL;
+ }
+
+ *array = ALLOC_MULT(int, valcount + 1);
+ if (*array == NULL)
+- return FALSE;
++ return FAIL;
+ (*array)[0] = valcount;
+
+ t = 1;
+ for (cp = var; *cp != NUL;)
+ {
+- (*array)[t++] = atoi((char *)cp);
+- while (*cp != NUL && *cp != ',')
++ int n = atoi((char *)cp);
++
++ if (n < 0 || n > 9999)
++ {
++ semsg(_(e_invarg2), cp);
++ return FAIL;
++ }
++ (*array)[t++] = n;
++ while (*cp != NUL && *cp != ',')
+ ++cp;
+ if (*cp != NUL)
+ ++cp;
+ }
+
+- return TRUE;
++ return OK;
+ }
+
+ /*
+@@ -1560,7 +1568,7 @@ ex_retab(exarg_T *eap)
+
+ #ifdef FEAT_VARTABS
+ new_ts_str = eap->arg;
+- if (!tabstop_set(eap->arg, &new_vts_array))
++ if (tabstop_set(eap->arg, &new_vts_array) == FAIL)
+ return;
+ while (vim_isdigit(*(eap->arg)) || *(eap->arg) == ',')
+ ++(eap->arg);
+diff --git a/src/option.c b/src/option.c
+index b4893a1..94986bf 100644
+--- a/src/option.c
++++ b/src/option.c
+@@ -2347,9 +2347,9 @@ didset_options2(void)
+ #endif
+ #ifdef FEAT_VARTABS
+ vim_free(curbuf->b_p_vsts_array);
+- tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
++ (void)tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
+ vim_free(curbuf->b_p_vts_array);
+- tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array);
++ (void)tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array);
+ #endif
+ }
+
+@@ -5808,7 +5808,7 @@ buf_copy_options(buf_T *buf, int flags)
+ buf->b_p_vsts = vim_strsave(p_vsts);
+ COPY_OPT_SCTX(buf, BV_VSTS);
+ if (p_vsts && p_vsts != empty_option)
+- tabstop_set(p_vsts, &buf->b_p_vsts_array);
++ (void)tabstop_set(p_vsts, &buf->b_p_vsts_array);
+ else
+ buf->b_p_vsts_array = 0;
+ buf->b_p_vsts_nopaste = p_vsts_nopaste
+@@ -5968,7 +5968,7 @@ buf_copy_options(buf_T *buf, int flags)
+ buf->b_p_isk = save_p_isk;
+ #ifdef FEAT_VARTABS
+ if (p_vts && p_vts != empty_option && !buf->b_p_vts_array)
+- tabstop_set(p_vts, &buf->b_p_vts_array);
++ (void)tabstop_set(p_vts, &buf->b_p_vts_array);
+ else
+ buf->b_p_vts_array = NULL;
+ #endif
+@@ -5983,7 +5983,7 @@ buf_copy_options(buf_T *buf, int flags)
+ buf->b_p_vts = vim_strsave(p_vts);
+ COPY_OPT_SCTX(buf, BV_VTS);
+ if (p_vts && p_vts != empty_option && !buf->b_p_vts_array)
+- tabstop_set(p_vts, &buf->b_p_vts_array);
++ (void)tabstop_set(p_vts, &buf->b_p_vts_array);
+ else
+ buf->b_p_vts_array = NULL;
+ #endif
+@@ -6676,7 +6676,7 @@ paste_option_changed(void)
+ if (buf->b_p_vsts_array)
+ vim_free(buf->b_p_vsts_array);
+ if (buf->b_p_vsts && buf->b_p_vsts != empty_option)
+- tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
++ (void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
+ else
+ buf->b_p_vsts_array = 0;
+ #endif
+diff --git a/src/optionstr.c b/src/optionstr.c
+index 8f3f0c5..24657fd 100644
+--- a/src/optionstr.c
++++ b/src/optionstr.c
+@@ -2180,7 +2180,7 @@ did_set_string_option(
+ if (errmsg == NULL)
+ {
+ int *oldarray = curbuf->b_p_vsts_array;
+- if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)))
++ if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)) == OK)
+ {
+ if (oldarray)
+ vim_free(oldarray);
+@@ -2219,7 +2219,7 @@ did_set_string_option(
+ {
+ int *oldarray = curbuf->b_p_vts_array;
+
+- if (tabstop_set(*varp, &(curbuf->b_p_vts_array)))
++ if (tabstop_set(*varp, &(curbuf->b_p_vts_array)) == OK)
+ {
+ vim_free(oldarray);
+ #ifdef FEAT_FOLDING
+diff --git a/src/testdir/test_retab.vim b/src/testdir/test_retab.vim
+index b792da5..c7190aa 100644
+--- a/src/testdir/test_retab.vim
++++ b/src/testdir/test_retab.vim
+@@ -75,6 +75,9 @@ endfunc
+ func Test_retab_error()
+ call assert_fails('retab -1', 'E487:')
+ call assert_fails('retab! -1', 'E487:')
++ call assert_fails('ret -1000', 'E487:')
++ call assert_fails('ret 10000', 'E475:')
++ call assert_fails('ret 80000000000000000000', 'E475:')
+ endfunc
+
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/version.c b/src/version.c
+index 8159289..c5617f6 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -5631,6 +5631,7 @@ static int included_patches[] =
+ */
+ static char *(extra_patches[]) =
+ { /* Add your patch description below this line */
++ "8.2.3402",
+ /**/
+ NULL
+ };
diff --git a/debian/patches/upstream/patch-8.2.3403-memory-leak-for-retab-with-invalid-argumen.patch b/debian/patches/upstream/patch-8.2.3403-memory-leak-for-retab-with-invalid-argumen.patch
new file mode 100644
index 0000000..a02728b
--- /dev/null
+++ b/debian/patches/upstream/patch-8.2.3403-memory-leak-for-retab-with-invalid-argumen.patch
@@ -0,0 +1,61 @@
+From: Bram Moolenaar <Bram@vim.org>
+Date: Sat, 4 Sep 2021 21:20:41 +0200
+Subject: patch 8.2.3403: memory leak for :retab with invalid argument
+
+Problem: Memory leak for :retab with invalid argument.
+Solution: Free the memory. Make error messages consistent.
+---
+ src/indent.c | 13 +++++++++++--
+ src/version.c | 1 +
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/src/indent.c b/src/indent.c
+index 9209a39..a43413c 100644
+--- a/src/indent.c
++++ b/src/indent.c
+@@ -70,9 +70,12 @@ tabstop_set(char_u *var, int **array)
+ {
+ int n = atoi((char *)cp);
+
++ // Catch negative values, overflow and ridiculous big values.
+ if (n < 0 || n > 9999)
+ {
+ semsg(_(e_invarg2), cp);
++ vim_free(*array);
++ *array = NULL;
+ return FAIL;
+ }
+ (*array)[t++] = n;
+@@ -1584,12 +1587,18 @@ ex_retab(exarg_T *eap)
+ else
+ new_ts_str = vim_strnsave(new_ts_str, eap->arg - new_ts_str);
+ #else
+- new_ts = getdigits(&(eap->arg));
+- if (new_ts < 0)
++ ptr = eap->arg;
++ new_ts = getdigits(&ptr);
++ if (new_ts < 0 && *eap->arg == '-')
+ {
+ emsg(_(e_positive));
+ return;
+ }
++ if (new_ts < 0 || new_ts > 9999)
++ {
++ semsg(_(e_invarg2), eap->arg);
++ return;
++ }
+ if (new_ts == 0)
+ new_ts = curbuf->b_p_ts;
+ #endif
+diff --git a/src/version.c b/src/version.c
+index c5617f6..c3c64d5 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -5632,6 +5632,7 @@ static int included_patches[] =
+ static char *(extra_patches[]) =
+ { /* Add your patch description below this line */
+ "8.2.3402",
++ "8.2.3403",
+ /**/
+ NULL
+ };
diff --git a/debian/patches/upstream/patch-8.2.3409-reading-beyond-end-of-line-with-invalid-ut.patch b/debian/patches/upstream/patch-8.2.3409-reading-beyond-end-of-line-with-invalid-ut.patch
new file mode 100644
index 0000000..bc7c8d7
--- /dev/null
+++ b/debian/patches/upstream/patch-8.2.3409-reading-beyond-end-of-line-with-invalid-ut.patch
@@ -0,0 +1,56 @@
+From: Bram Moolenaar <Bram@vim.org>
+Date: Tue, 7 Sep 2021 19:26:53 +0200
+Subject: patch 8.2.3409: reading beyond end of line with invalid utf-8
+ character
+
+Problem: Reading beyond end of line with invalid utf-8 character.
+Solution: Check for NUL when advancing.
+---
+ src/regexp_nfa.c | 3 ++-
+ src/testdir/test_regexp_utf8.vim | 8 ++++++++
+ src/version.c | 1 +
+ 3 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c
+index 064d90a..46604bd 100644
+--- a/src/regexp_nfa.c
++++ b/src/regexp_nfa.c
+@@ -5479,7 +5479,8 @@ find_match_text(colnr_T startcol, int regstart, char_u *match_text)
+ match = FALSE;
+ break;
+ }
+- len2 += MB_CHAR2LEN(c2);
++ len2 += enc_utf8 ? utf_ptr2len(rex.line + col + len2)
++ : MB_CHAR2LEN(c2);
+ }
+ if (match
+ // check that no composing char follows
+diff --git a/src/testdir/test_regexp_utf8.vim b/src/testdir/test_regexp_utf8.vim
+index a7d1020..58386ac 100644
+--- a/src/testdir/test_regexp_utf8.vim
++++ b/src/testdir/test_regexp_utf8.vim
+@@ -558,4 +558,12 @@ func Test_match_char_class_upper()
+ bwipe!
+ endfunc
+
++func Test_match_invalid_byte()
++ call writefile(0z630a.765d30aa0a.2e0a.790a.4030, 'Xinvalid')
++ new
++ source Xinvalid
++ bwipe!
++ call delete('Xinvalid')
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/version.c b/src/version.c
+index c3c64d5..b34d74a 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -5633,6 +5633,7 @@ static char *(extra_patches[]) =
+ { /* Add your patch description below this line */
+ "8.2.3402",
+ "8.2.3403",
++ "8.2.3409",
+ /**/
+ NULL
+ };
diff --git a/debian/patches/upstream/patch-8.2.3428-using-freed-memory-when-replacing.patch b/debian/patches/upstream/patch-8.2.3428-using-freed-memory-when-replacing.patch
new file mode 100644
index 0000000..c9d8cb3
--- /dev/null
+++ b/debian/patches/upstream/patch-8.2.3428-using-freed-memory-when-replacing.patch
@@ -0,0 +1,76 @@
+From: Bram Moolenaar <Bram@vim.org>
+Date: Sat, 11 Sep 2021 21:14:20 +0200
+Subject: patch 8.2.3428: using freed memory when replacing
+
+Problem: Using freed memory when replacing. (Dhiraj Mishra)
+Solution: Get the line pointer after calling ins_copychar().
+---
+ src/normal.c | 10 +++++++---
+ src/testdir/test_edit.vim | 12 ++++++++++++
+ src/version.c | 1 +
+ 3 files changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/src/normal.c b/src/normal.c
+index 9fbfadf..150aa18 100644
+--- a/src/normal.c
++++ b/src/normal.c
+@@ -5074,19 +5074,23 @@ nv_replace(cmdarg_T *cap)
+ {
+ /*
+ * Get ptr again, because u_save and/or showmatch() will have
+- * released the line. At the same time we let know that the
+- * line will be changed.
++ * released the line. This may also happen in ins_copychar().
++ * At the same time we let know that the line will be changed.
+ */
+- ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
+ if (cap->nchar == Ctrl_E || cap->nchar == Ctrl_Y)
+ {
+ int c = ins_copychar(curwin->w_cursor.lnum
+ + (cap->nchar == Ctrl_Y ? -1 : 1));
++
++ ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
+ if (c != NUL)
+ ptr[curwin->w_cursor.col] = c;
+ }
+ else
++ {
++ ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
+ ptr[curwin->w_cursor.col] = cap->nchar;
++ }
+ if (p_sm && msg_silent == 0)
+ showmatch(cap->nchar);
+ ++curwin->w_cursor.col;
+diff --git a/src/testdir/test_edit.vim b/src/testdir/test_edit.vim
+index de3e3a1..9602682 100644
+--- a/src/testdir/test_edit.vim
++++ b/src/testdir/test_edit.vim
+@@ -1839,4 +1839,16 @@ func Test_read_invalid()
+ set encoding=utf-8
+ endfunc
+
++" Test for getting the character of the line below after "p"
++func Test_edit_put_CTRL_E()
++ set encoding=latin1
++ new
++ let @" = ''
++ sil! norm orggRx
++ sil! norm pr
++ call assert_equal(['r', 'r'], getline(1, 2))
++ bwipe!
++ set encoding=utf-8
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/version.c b/src/version.c
+index b34d74a..ea55117 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -5634,6 +5634,7 @@ static char *(extra_patches[]) =
+ "8.2.3402",
+ "8.2.3403",
+ "8.2.3409",
++ "8.2.3428",
+ /**/
+ NULL
+ };