From 519cbf08704063b930fa613235d4a598105a449a Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sat, 27 Apr 2024 15:18:04 +0200 Subject: Adding debian version 2:8.2.2434-3+deb11u1. Signed-off-by: Daniel Baumann --- ...of-more-LaTeX-commands-for-tex-filetype-d.patch | 27 +++ ...t-filetype-using-the-contents-of-the-file.patch | 28 +++ ...s-decision-to-disable-modelines-by-defaul.patch | 29 +++ ...ng-a-vimrc.tiny-when-Vim-is-invoked-as-vi.patch | 85 +++++++++ debian/patches/series | 8 + ...nvalid-memory-access-when-using-retab-wit.patch | 203 +++++++++++++++++++++ ...emory-leak-for-retab-with-invalid-argumen.patch | 61 +++++++ ...eading-beyond-end-of-line-with-invalid-ut.patch | 56 ++++++ ....2.3428-using-freed-memory-when-replacing.patch | 76 ++++++++ 9 files changed, 573 insertions(+) create mode 100644 debian/patches/debian/Add-recognition-of-more-LaTeX-commands-for-tex-filetype-d.patch create mode 100644 debian/patches/debian/Detect-the-rst-filetype-using-the-contents-of-the-file.patch create mode 100644 debian/patches/debian/Document-Debian-s-decision-to-disable-modelines-by-defaul.patch create mode 100644 debian/patches/debian/Support-sourcing-a-vimrc.tiny-when-Vim-is-invoked-as-vi.patch create mode 100644 debian/patches/series create mode 100644 debian/patches/upstream/patch-8.2.3402-invalid-memory-access-when-using-retab-wit.patch create mode 100644 debian/patches/upstream/patch-8.2.3403-memory-leak-for-retab-with-invalid-argumen.patch create mode 100644 debian/patches/upstream/patch-8.2.3409-reading-beyond-end-of-line-with-invalid-ut.patch create mode 100644 debian/patches/upstream/patch-8.2.3428-using-freed-memory-when-replacing.patch (limited to 'debian/patches') diff --git a/debian/patches/debian/Add-recognition-of-more-LaTeX-commands-for-tex-filetype-d.patch b/debian/patches/debian/Add-recognition-of-more-LaTeX-commands-for-tex-filetype-d.patch new file mode 100644 index 0000000..c74dc58 --- /dev/null +++ b/debian/patches/debian/Add-recognition-of-more-LaTeX-commands-for-tex-filetype-d.patch @@ -0,0 +1,27 @@ +From: Stefano Zacchiroli +Date: Fri, 25 Aug 2006 13:33:04 +0200 +Subject: Add recognition of more LaTeX commands for tex filetype detection + +Since filetype detection of TeX files defaults to plaintex, we've added +detection of some additional LaTeX commands to help sway the detection +to LaTeX. + +Closes: #384479 +Signed-off-by: James McCoy +--- + runtime/autoload/dist/ft.vim | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/runtime/autoload/dist/ft.vim b/runtime/autoload/dist/ft.vim +index 1ac74b5..4bb8917 100644 +--- a/runtime/autoload/dist/ft.vim ++++ b/runtime/autoload/dist/ft.vim +@@ -684,7 +684,7 @@ func dist#ft#FTtex() + call cursor(1,1) + let firstNC = search('^\s*[^[:space:]%]', 'c', 1000) + if firstNC " Check the next thousand lines for a LaTeX or ConTeXt keyword. +- let lpat = 'documentclass\>\|usepackage\>\|begin{\|newcommand\>\|renewcommand\>' ++ let lpat = 'documentclass\>\|usepackage\>\|begin{\|newcommand\>\|renewcommand\>\|part\>\|chapter\>\|section\>\|subsection\>\|subsubsection\>\|paragraph\>\|subparagraph\>\|subsubparagraph' + let cpat = 'start\a\+\|setup\a\+\|usemodule\|enablemode\|enableregime\|setvariables\|useencoding\|usesymbols\|stelle\a\+\|verwende\a\+\|stel\a\+\|gebruik\a\+\|usa\a\+\|imposta\a\+\|regle\a\+\|utilisemodule\>' + let kwline = search('^\s*\\\%(' . lpat . '\)\|^\s*\\\(' . cpat . '\)', + \ 'cnp', firstNC + 1000) diff --git a/debian/patches/debian/Detect-the-rst-filetype-using-the-contents-of-the-file.patch b/debian/patches/debian/Detect-the-rst-filetype-using-the-contents-of-the-file.patch new file mode 100644 index 0000000..56c6c96 --- /dev/null +++ b/debian/patches/debian/Detect-the-rst-filetype-using-the-contents-of-the-file.patch @@ -0,0 +1,28 @@ +From: James Vega +Date: Fri, 18 Aug 2006 09:06:20 -0400 +Subject: Detect the rst filetype using the contents of the file + +Closes: #382541 +--- + runtime/scripts.vim | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/runtime/scripts.vim b/runtime/scripts.vim +index 6448c54..426a9ba 100644 +--- a/runtime/scripts.vim ++++ b/runtime/scripts.vim +@@ -371,6 +371,14 @@ else + elseif s:line1 =~# 'exec\s\+\S*scheme' || s:line2 =~# 'exec\s\+\S*scheme' + set ft=scheme + ++ " rst files ++ elseif s:line1 =~ '^\.\.\s\|^\s*restindex\s*$' ++ \ || s:line2 =~ '^\.\.\s\|^\s*restindex\s*$' ++ \ || s:line3 =~ '^\.\.\s\|^\s*restindex\s*$' ++ \ || s:line4 =~ '^\.\.\s\|^\s*restindex\s*$' ++ \ || s:line5 =~ '^\.\.\s\|^\s*restindex\s*$' ++ set ft=rst ++ + " Git output + elseif s:line1 =~# '^\(commit\|tree\|object\) \x\{40\}\>\|^tag \S\+$' + set ft=git diff --git a/debian/patches/debian/Document-Debian-s-decision-to-disable-modelines-by-defaul.patch b/debian/patches/debian/Document-Debian-s-decision-to-disable-modelines-by-defaul.patch new file mode 100644 index 0000000..20ed074 --- /dev/null +++ b/debian/patches/debian/Document-Debian-s-decision-to-disable-modelines-by-defaul.patch @@ -0,0 +1,29 @@ +From: James Vega +Date: Thu, 27 Mar 2008 03:42:02 +0000 +Subject: Document Debian's decision to disable modelines by default + +Modelines have historically been a source of vulnerabilities in Vim. +As long as it remains a "blacklist suspected/proven dangerous options" +instead of a "whitelist allowed options" piece of functionality, +Debian's system-wide vimrc will maintain this setting. As such, the +documentation needs to be updated to reflect the induced behavior. + +Closes: #472522 +Signed-off-by: James McCoy +--- + runtime/doc/options.txt | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/runtime/doc/options.txt b/runtime/doc/options.txt +index 8b655dc..e03af4f 100644 +--- a/runtime/doc/options.txt ++++ b/runtime/doc/options.txt +@@ -5155,7 +5155,7 @@ A jump table for the options with a short description can be found at |Q_op|. + + *'modeline'* *'ml'* *'nomodeline'* *'noml'* + 'modeline' 'ml' boolean (Vim default: on (off for root), +- Vi default: off) ++ Debian: off, Vi default: off) + local to buffer + If 'modeline' is on 'modelines' gives the number of lines that is + checked for set commands. If 'modeline' is off or 'modelines' is zero diff --git a/debian/patches/debian/Support-sourcing-a-vimrc.tiny-when-Vim-is-invoked-as-vi.patch b/debian/patches/debian/Support-sourcing-a-vimrc.tiny-when-Vim-is-invoked-as-vi.patch new file mode 100644 index 0000000..78e937c --- /dev/null +++ b/debian/patches/debian/Support-sourcing-a-vimrc.tiny-when-Vim-is-invoked-as-vi.patch @@ -0,0 +1,85 @@ +From: James McCoy +Date: Tue, 6 Oct 2015 23:46:30 -0400 +Subject: Support sourcing a vimrc.tiny when Vim is invoked as vi + +This is used only in the vim-tiny package to allow a specific +configuration for vim-tiny's vi. The vim-tiny package is substantially +different from other Vim packages, so it does not make sense to +share the same config. + +Closes: #222138 +Signed-off-by: Stefano Zacchiroli +Signed-off-by: James Vega +--- + src/main.c | 14 +++++++++++++- + src/os_unix.h | 3 +++ + src/structs.h | 3 +++ + 3 files changed, 19 insertions(+), 1 deletion(-) + +diff --git a/src/main.c b/src/main.c +index ef53b33..6e67e72 100644 +--- a/src/main.c ++++ b/src/main.c +@@ -1868,6 +1868,10 @@ parse_command_name(mparm_T *parmp) + } + else if (STRNICMP(initstr, "vim", 3) == 0) + initstr += 3; ++#ifdef SYS_TINYRC_FILE ++ else if (STRNICMP(initstr, "vi", 2) == 0) ++ parmp->vi_mode = TRUE; ++#endif + + // Catch "[r][g]vimdiff" and "[r][g]viewdiff". + if (STRICMP(initstr, "diff") == 0) +@@ -3130,7 +3134,12 @@ source_startup_scripts(mparm_T *parmp) + * Get system wide defaults, if the file name is defined. + */ + #ifdef SYS_VIMRC_FILE +- (void)do_source((char_u *)SYS_VIMRC_FILE, FALSE, DOSO_NONE, NULL); ++# if defined(SYS_TINYRC_FILE) && defined(TINY_VIMRC) ++ if (parmp->vi_mode) ++ (void)do_source((char_u *)SYS_TINYRC_FILE, FALSE, DOSO_NONE, NULL); ++ else ++# endif ++ (void)do_source((char_u *)SYS_VIMRC_FILE, FALSE, DOSO_NONE, NULL); + #endif + #ifdef MACOS_X + (void)do_source((char_u *)"$VIMRUNTIME/macmap.vim", FALSE, +@@ -3169,6 +3178,9 @@ source_startup_scripts(mparm_T *parmp) + #ifdef USR_EXRC_FILE2 + && do_source((char_u *)USR_EXRC_FILE2, FALSE, + DOSO_NONE, NULL) == FAIL ++#endif ++#if defined(SYS_TINYRC_FILE) && defined(TINY_VIMRC) ++ && !parmp->vi_mode + #endif + && !has_dash_c_arg) + { +diff --git a/src/os_unix.h b/src/os_unix.h +index 83fe66d..8880fec 100644 +--- a/src/os_unix.h ++++ b/src/os_unix.h +@@ -219,6 +219,9 @@ typedef struct dsc$descriptor DESC; + /* + * Unix system-dependent file names + */ ++#ifndef SYS_TINYRC_FILE ++# define SYS_TINYRC_FILE "$VIM/vimrc.tiny" ++#endif + #ifndef SYS_VIMRC_FILE + # define SYS_VIMRC_FILE "$VIM/vimrc" + #endif +diff --git a/src/structs.h b/src/structs.h +index bd59656..6e6499c 100644 +--- a/src/structs.h ++++ b/src/structs.h +@@ -4130,6 +4130,9 @@ typedef struct + #ifdef FEAT_DIFF + int diff_mode; // start with 'diff' set + #endif ++#ifdef SYS_TINYRC_FILE ++ int vi_mode; /* started as "vi" */ ++#endif + } mparm_T; + + /* diff --git a/debian/patches/series b/debian/patches/series new file mode 100644 index 0000000..158f03a --- /dev/null +++ b/debian/patches/series @@ -0,0 +1,8 @@ +debian/Support-sourcing-a-vimrc.tiny-when-Vim-is-invoked-as-vi.patch +debian/Detect-the-rst-filetype-using-the-contents-of-the-file.patch +debian/Add-recognition-of-more-LaTeX-commands-for-tex-filetype-d.patch +debian/Document-Debian-s-decision-to-disable-modelines-by-defaul.patch +upstream/patch-8.2.3402-invalid-memory-access-when-using-retab-wit.patch +upstream/patch-8.2.3403-memory-leak-for-retab-with-invalid-argumen.patch +upstream/patch-8.2.3409-reading-beyond-end-of-line-with-invalid-ut.patch +upstream/patch-8.2.3428-using-freed-memory-when-replacing.patch diff --git a/debian/patches/upstream/patch-8.2.3402-invalid-memory-access-when-using-retab-wit.patch b/debian/patches/upstream/patch-8.2.3402-invalid-memory-access-when-using-retab-wit.patch new file mode 100644 index 0000000..245516d --- /dev/null +++ b/debian/patches/upstream/patch-8.2.3402-invalid-memory-access-when-using-retab-wit.patch @@ -0,0 +1,203 @@ +From: Bram Moolenaar +Date: Sat, 4 Sep 2021 18:47:28 +0200 +Subject: patch 8.2.3402: invalid memory access when using :retab with large + value + +Problem: Invalid memory access when using :retab with large value. +Solution: Check the number is positive. +--- + src/indent.c | 34 +++++++++++++++++++++------------- + src/option.c | 12 ++++++------ + src/optionstr.c | 4 ++-- + src/testdir/test_retab.vim | 3 +++ + src/version.c | 1 + + 5 files changed, 33 insertions(+), 21 deletions(-) + +diff --git a/src/indent.c b/src/indent.c +index a9d406e..9209a39 100644 +--- a/src/indent.c ++++ b/src/indent.c +@@ -18,18 +18,19 @@ + /* + * Set the integer values corresponding to the string setting of 'vartabstop'. + * "array" will be set, caller must free it if needed. ++ * Return FAIL for an error. + */ + int + tabstop_set(char_u *var, int **array) + { +- int valcount = 1; +- int t; +- char_u *cp; ++ int valcount = 1; ++ int t; ++ char_u *cp; + + if (var[0] == NUL || (var[0] == '0' && var[1] == NUL)) + { + *array = NULL; +- return TRUE; ++ return OK; + } + + for (cp = var; *cp != NUL; ++cp) +@@ -43,8 +44,8 @@ tabstop_set(char_u *var, int **array) + if (cp != end) + emsg(_(e_positive)); + else +- emsg(_(e_invarg)); +- return FALSE; ++ semsg(_(e_invarg2), cp); ++ return FAIL; + } + } + +@@ -55,26 +56,33 @@ tabstop_set(char_u *var, int **array) + ++valcount; + continue; + } +- emsg(_(e_invarg)); +- return FALSE; ++ semsg(_(e_invarg2), var); ++ return FAIL; + } + + *array = ALLOC_MULT(int, valcount + 1); + if (*array == NULL) +- return FALSE; ++ return FAIL; + (*array)[0] = valcount; + + t = 1; + for (cp = var; *cp != NUL;) + { +- (*array)[t++] = atoi((char *)cp); +- while (*cp != NUL && *cp != ',') ++ int n = atoi((char *)cp); ++ ++ if (n < 0 || n > 9999) ++ { ++ semsg(_(e_invarg2), cp); ++ return FAIL; ++ } ++ (*array)[t++] = n; ++ while (*cp != NUL && *cp != ',') + ++cp; + if (*cp != NUL) + ++cp; + } + +- return TRUE; ++ return OK; + } + + /* +@@ -1560,7 +1568,7 @@ ex_retab(exarg_T *eap) + + #ifdef FEAT_VARTABS + new_ts_str = eap->arg; +- if (!tabstop_set(eap->arg, &new_vts_array)) ++ if (tabstop_set(eap->arg, &new_vts_array) == FAIL) + return; + while (vim_isdigit(*(eap->arg)) || *(eap->arg) == ',') + ++(eap->arg); +diff --git a/src/option.c b/src/option.c +index b4893a1..94986bf 100644 +--- a/src/option.c ++++ b/src/option.c +@@ -2347,9 +2347,9 @@ didset_options2(void) + #endif + #ifdef FEAT_VARTABS + vim_free(curbuf->b_p_vsts_array); +- tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array); ++ (void)tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array); + vim_free(curbuf->b_p_vts_array); +- tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array); ++ (void)tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array); + #endif + } + +@@ -5808,7 +5808,7 @@ buf_copy_options(buf_T *buf, int flags) + buf->b_p_vsts = vim_strsave(p_vsts); + COPY_OPT_SCTX(buf, BV_VSTS); + if (p_vsts && p_vsts != empty_option) +- tabstop_set(p_vsts, &buf->b_p_vsts_array); ++ (void)tabstop_set(p_vsts, &buf->b_p_vsts_array); + else + buf->b_p_vsts_array = 0; + buf->b_p_vsts_nopaste = p_vsts_nopaste +@@ -5968,7 +5968,7 @@ buf_copy_options(buf_T *buf, int flags) + buf->b_p_isk = save_p_isk; + #ifdef FEAT_VARTABS + if (p_vts && p_vts != empty_option && !buf->b_p_vts_array) +- tabstop_set(p_vts, &buf->b_p_vts_array); ++ (void)tabstop_set(p_vts, &buf->b_p_vts_array); + else + buf->b_p_vts_array = NULL; + #endif +@@ -5983,7 +5983,7 @@ buf_copy_options(buf_T *buf, int flags) + buf->b_p_vts = vim_strsave(p_vts); + COPY_OPT_SCTX(buf, BV_VTS); + if (p_vts && p_vts != empty_option && !buf->b_p_vts_array) +- tabstop_set(p_vts, &buf->b_p_vts_array); ++ (void)tabstop_set(p_vts, &buf->b_p_vts_array); + else + buf->b_p_vts_array = NULL; + #endif +@@ -6676,7 +6676,7 @@ paste_option_changed(void) + if (buf->b_p_vsts_array) + vim_free(buf->b_p_vsts_array); + if (buf->b_p_vsts && buf->b_p_vsts != empty_option) +- tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array); ++ (void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array); + else + buf->b_p_vsts_array = 0; + #endif +diff --git a/src/optionstr.c b/src/optionstr.c +index 8f3f0c5..24657fd 100644 +--- a/src/optionstr.c ++++ b/src/optionstr.c +@@ -2180,7 +2180,7 @@ did_set_string_option( + if (errmsg == NULL) + { + int *oldarray = curbuf->b_p_vsts_array; +- if (tabstop_set(*varp, &(curbuf->b_p_vsts_array))) ++ if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)) == OK) + { + if (oldarray) + vim_free(oldarray); +@@ -2219,7 +2219,7 @@ did_set_string_option( + { + int *oldarray = curbuf->b_p_vts_array; + +- if (tabstop_set(*varp, &(curbuf->b_p_vts_array))) ++ if (tabstop_set(*varp, &(curbuf->b_p_vts_array)) == OK) + { + vim_free(oldarray); + #ifdef FEAT_FOLDING +diff --git a/src/testdir/test_retab.vim b/src/testdir/test_retab.vim +index b792da5..c7190aa 100644 +--- a/src/testdir/test_retab.vim ++++ b/src/testdir/test_retab.vim +@@ -75,6 +75,9 @@ endfunc + func Test_retab_error() + call assert_fails('retab -1', 'E487:') + call assert_fails('retab! -1', 'E487:') ++ call assert_fails('ret -1000', 'E487:') ++ call assert_fails('ret 10000', 'E475:') ++ call assert_fails('ret 80000000000000000000', 'E475:') + endfunc + + " vim: shiftwidth=2 sts=2 expandtab +diff --git a/src/version.c b/src/version.c +index 8159289..c5617f6 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -5631,6 +5631,7 @@ static int included_patches[] = + */ + static char *(extra_patches[]) = + { /* Add your patch description below this line */ ++ "8.2.3402", + /**/ + NULL + }; diff --git a/debian/patches/upstream/patch-8.2.3403-memory-leak-for-retab-with-invalid-argumen.patch b/debian/patches/upstream/patch-8.2.3403-memory-leak-for-retab-with-invalid-argumen.patch new file mode 100644 index 0000000..a02728b --- /dev/null +++ b/debian/patches/upstream/patch-8.2.3403-memory-leak-for-retab-with-invalid-argumen.patch @@ -0,0 +1,61 @@ +From: Bram Moolenaar +Date: Sat, 4 Sep 2021 21:20:41 +0200 +Subject: patch 8.2.3403: memory leak for :retab with invalid argument + +Problem: Memory leak for :retab with invalid argument. +Solution: Free the memory. Make error messages consistent. +--- + src/indent.c | 13 +++++++++++-- + src/version.c | 1 + + 2 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/src/indent.c b/src/indent.c +index 9209a39..a43413c 100644 +--- a/src/indent.c ++++ b/src/indent.c +@@ -70,9 +70,12 @@ tabstop_set(char_u *var, int **array) + { + int n = atoi((char *)cp); + ++ // Catch negative values, overflow and ridiculous big values. + if (n < 0 || n > 9999) + { + semsg(_(e_invarg2), cp); ++ vim_free(*array); ++ *array = NULL; + return FAIL; + } + (*array)[t++] = n; +@@ -1584,12 +1587,18 @@ ex_retab(exarg_T *eap) + else + new_ts_str = vim_strnsave(new_ts_str, eap->arg - new_ts_str); + #else +- new_ts = getdigits(&(eap->arg)); +- if (new_ts < 0) ++ ptr = eap->arg; ++ new_ts = getdigits(&ptr); ++ if (new_ts < 0 && *eap->arg == '-') + { + emsg(_(e_positive)); + return; + } ++ if (new_ts < 0 || new_ts > 9999) ++ { ++ semsg(_(e_invarg2), eap->arg); ++ return; ++ } + if (new_ts == 0) + new_ts = curbuf->b_p_ts; + #endif +diff --git a/src/version.c b/src/version.c +index c5617f6..c3c64d5 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -5632,6 +5632,7 @@ static int included_patches[] = + static char *(extra_patches[]) = + { /* Add your patch description below this line */ + "8.2.3402", ++ "8.2.3403", + /**/ + NULL + }; diff --git a/debian/patches/upstream/patch-8.2.3409-reading-beyond-end-of-line-with-invalid-ut.patch b/debian/patches/upstream/patch-8.2.3409-reading-beyond-end-of-line-with-invalid-ut.patch new file mode 100644 index 0000000..bc7c8d7 --- /dev/null +++ b/debian/patches/upstream/patch-8.2.3409-reading-beyond-end-of-line-with-invalid-ut.patch @@ -0,0 +1,56 @@ +From: Bram Moolenaar +Date: Tue, 7 Sep 2021 19:26:53 +0200 +Subject: patch 8.2.3409: reading beyond end of line with invalid utf-8 + character + +Problem: Reading beyond end of line with invalid utf-8 character. +Solution: Check for NUL when advancing. +--- + src/regexp_nfa.c | 3 ++- + src/testdir/test_regexp_utf8.vim | 8 ++++++++ + src/version.c | 1 + + 3 files changed, 11 insertions(+), 1 deletion(-) + +diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c +index 064d90a..46604bd 100644 +--- a/src/regexp_nfa.c ++++ b/src/regexp_nfa.c +@@ -5479,7 +5479,8 @@ find_match_text(colnr_T startcol, int regstart, char_u *match_text) + match = FALSE; + break; + } +- len2 += MB_CHAR2LEN(c2); ++ len2 += enc_utf8 ? utf_ptr2len(rex.line + col + len2) ++ : MB_CHAR2LEN(c2); + } + if (match + // check that no composing char follows +diff --git a/src/testdir/test_regexp_utf8.vim b/src/testdir/test_regexp_utf8.vim +index a7d1020..58386ac 100644 +--- a/src/testdir/test_regexp_utf8.vim ++++ b/src/testdir/test_regexp_utf8.vim +@@ -558,4 +558,12 @@ func Test_match_char_class_upper() + bwipe! + endfunc + ++func Test_match_invalid_byte() ++ call writefile(0z630a.765d30aa0a.2e0a.790a.4030, 'Xinvalid') ++ new ++ source Xinvalid ++ bwipe! ++ call delete('Xinvalid') ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab +diff --git a/src/version.c b/src/version.c +index c3c64d5..b34d74a 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -5633,6 +5633,7 @@ static char *(extra_patches[]) = + { /* Add your patch description below this line */ + "8.2.3402", + "8.2.3403", ++ "8.2.3409", + /**/ + NULL + }; diff --git a/debian/patches/upstream/patch-8.2.3428-using-freed-memory-when-replacing.patch b/debian/patches/upstream/patch-8.2.3428-using-freed-memory-when-replacing.patch new file mode 100644 index 0000000..c9d8cb3 --- /dev/null +++ b/debian/patches/upstream/patch-8.2.3428-using-freed-memory-when-replacing.patch @@ -0,0 +1,76 @@ +From: Bram Moolenaar +Date: Sat, 11 Sep 2021 21:14:20 +0200 +Subject: patch 8.2.3428: using freed memory when replacing + +Problem: Using freed memory when replacing. (Dhiraj Mishra) +Solution: Get the line pointer after calling ins_copychar(). +--- + src/normal.c | 10 +++++++--- + src/testdir/test_edit.vim | 12 ++++++++++++ + src/version.c | 1 + + 3 files changed, 20 insertions(+), 3 deletions(-) + +diff --git a/src/normal.c b/src/normal.c +index 9fbfadf..150aa18 100644 +--- a/src/normal.c ++++ b/src/normal.c +@@ -5074,19 +5074,23 @@ nv_replace(cmdarg_T *cap) + { + /* + * Get ptr again, because u_save and/or showmatch() will have +- * released the line. At the same time we let know that the +- * line will be changed. ++ * released the line. This may also happen in ins_copychar(). ++ * At the same time we let know that the line will be changed. + */ +- ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE); + if (cap->nchar == Ctrl_E || cap->nchar == Ctrl_Y) + { + int c = ins_copychar(curwin->w_cursor.lnum + + (cap->nchar == Ctrl_Y ? -1 : 1)); ++ ++ ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE); + if (c != NUL) + ptr[curwin->w_cursor.col] = c; + } + else ++ { ++ ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE); + ptr[curwin->w_cursor.col] = cap->nchar; ++ } + if (p_sm && msg_silent == 0) + showmatch(cap->nchar); + ++curwin->w_cursor.col; +diff --git a/src/testdir/test_edit.vim b/src/testdir/test_edit.vim +index de3e3a1..9602682 100644 +--- a/src/testdir/test_edit.vim ++++ b/src/testdir/test_edit.vim +@@ -1839,4 +1839,16 @@ func Test_read_invalid() + set encoding=utf-8 + endfunc + ++" Test for getting the character of the line below after "p" ++func Test_edit_put_CTRL_E() ++ set encoding=latin1 ++ new ++ let @" = '' ++ sil! norm orggRx ++ sil! norm pr ++ call assert_equal(['r', 'r'], getline(1, 2)) ++ bwipe! ++ set encoding=utf-8 ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab +diff --git a/src/version.c b/src/version.c +index b34d74a..ea55117 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -5634,6 +5634,7 @@ static char *(extra_patches[]) = + "8.2.3402", + "8.2.3403", + "8.2.3409", ++ "8.2.3428", + /**/ + NULL + }; -- cgit v1.2.3