.gitignore

@@ -1,3 +1,2 @@
-SOURCES/Changelog.rpm
 SOURCES/gvim64.png
-SOURCES/vim-8.0-1763.tar.bz2
+SOURCES/vim-8.2-2637.tar.bz2

.vim.metadata

@@ -1,3 +1,2 @@
-5ea81545fc28b57c490d25bda67a63a2838dd25b SOURCES/Changelog.rpm
 c32bd520a1498b71ee9bbcddc7ad05df1565d085 SOURCES/gvim64.png
-6716ebb416c9da91d16a2b17dc6bc2cecf65b4eb SOURCES/vim-8.0-1763.tar.bz2
+8405efdee1d83465651f90edc1173ff69f390aea SOURCES/vim-8.2-2637.tar.bz2

SOURCES/0001-patch-8.1.0881-can-execute-shell-commands-in-rvim-th.patch

@@ -1,461 +0,0 @@
-diff --git a/runtime/doc/starting.txt b/runtime/doc/starting.txt
-index 8256152..8320039 100644
---- a/runtime/doc/starting.txt
-+++ b/runtime/doc/starting.txt
-@@ -247,12 +247,18 @@ a slash.  Thus "-R" means recovery and "-/R" readonly.
- 		changes and writing.
- 		{not in Vi}
- 
--						*-Z* *restricted-mode* *E145*
-+					*-Z* *restricted-mode* *E145* *E981*
- -Z		Restricted mode.  All commands that make use of an external
- 		shell are disabled.  This includes suspending with CTRL-Z,
--		":sh", filtering, the system() function, backtick expansion,
--		delete(), rename(), mkdir(), writefile(), libcall(),
--		job_start(), etc.
-+		":sh", filtering, the system() function, backtick expansion
-+		and libcall().
-+		Also disallowed are delete(), rename(), mkdir(), job_start(),
-+		etc.
-+		Interfaces, such as Python, Ruby and Lua, are also disabled,
-+		since they could be used to execute shell commands.  Perl uses
-+		the Safe module.
-+		Note that the user may still find a loophole to execute a
-+		shell command, it has only been made difficult.
- 		{not in Vi}
- 
- 							*-g*
-diff --git a/src/evalfunc.c b/src/evalfunc.c
-index dd4462d..3cc305a 100644
---- a/src/evalfunc.c
-+++ b/src/evalfunc.c
-@@ -6446,7 +6446,7 @@ f_histadd(typval_T *argvars UNUSED, typval_T *rettv)
- #endif
- 
-     rettv->vval.v_number = FALSE;
--    if (check_restricted() || check_secure())
-+    if (check_secure())
- 	return;
- #ifdef FEAT_CMDHIST
-     str = get_tv_string_chk(&argvars[0]);	/* NULL on type error */
-@@ -7456,6 +7456,9 @@ f_luaeval(typval_T *argvars, typval_T *rettv)
-     char_u	*str;
-     char_u	buf[NUMBUFLEN];
- 
-+    if (check_restricted() || check_secure())
-+	return;
-+
-     str = get_tv_string_buf(&argvars[0], buf);
-     do_luaeval(str, argvars + 1, rettv);
- }
-@@ -8188,6 +8191,8 @@ f_mzeval(typval_T *argvars, typval_T *rettv)
-     char_u	*str;
-     char_u	buf[NUMBUFLEN];
- 
-+    if (check_restricted() || check_secure())
-+	return;
-     str = get_tv_string_buf(&argvars[0], buf);
-     do_mzeval(str, rettv);
- }
-@@ -8398,6 +8403,9 @@ f_py3eval(typval_T *argvars, typval_T *rettv)
-     char_u	*str;
-     char_u	buf[NUMBUFLEN];
- 
-+    if (check_restricted() || check_secure())
-+	return;
-+
-     if (p_pyx == 0)
- 	p_pyx = 3;
- 
-@@ -8416,6 +8424,9 @@ f_pyeval(typval_T *argvars, typval_T *rettv)
-     char_u	*str;
-     char_u	buf[NUMBUFLEN];
- 
-+    if (check_restricted() || check_secure())
-+	return;
-+
-     if (p_pyx == 0)
- 	p_pyx = 2;
- 
-@@ -8431,6 +8442,9 @@ f_pyeval(typval_T *argvars, typval_T *rettv)
-     static void
- f_pyxeval(typval_T *argvars, typval_T *rettv)
- {
-+    if (check_restricted() || check_secure())
-+	return;
-+
- # if defined(FEAT_PYTHON) && defined(FEAT_PYTHON3)
-     init_pyxversion();
-     if (p_pyx == 2)
-@@ -10272,7 +10286,7 @@ f_setbufvar(typval_T *argvars, typval_T *rettv UNUSED)
-     typval_T	*varp;
-     char_u	nbuf[NUMBUFLEN];
- 
--    if (check_restricted() || check_secure())
-+    if (check_secure())
- 	return;
-     (void)get_tv_number(&argvars[0]);	    /* issue errmsg if type error */
-     varname = get_tv_string_chk(&argvars[1]);
-@@ -10792,7 +10806,7 @@ f_settabvar(typval_T *argvars, typval_T *rettv)
- 
-     rettv->vval.v_number = 0;
- 
--    if (check_restricted() || check_secure())
-+    if (check_secure())
- 	return;
- 
-     tp = find_tabpage((int)get_tv_number_chk(&argvars[0], NULL));
-@@ -13674,7 +13688,7 @@ f_writefile(typval_T *argvars, typval_T *rettv)
-     list_T	*list;
- 
-     rettv->vval.v_number = -1;
--    if (check_restricted() || check_secure())
-+    if (check_secure())
- 	return;
- 
-     if (argvars[0].v_type != VAR_LIST)
-diff --git a/src/ex_cmds.c b/src/ex_cmds.c
-index 111fe01..1827fec 100644
---- a/src/ex_cmds.c
-+++ b/src/ex_cmds.c
-@@ -4693,7 +4693,7 @@ check_restricted(void)
- {
-     if (restricted)
-     {
--	EMSG(_("E145: Shell commands not allowed in rvim"));
-+	EMSG(_("E145: Shell commands and some functionality not allowed in rvim"));
- 	return TRUE;
-     }
-     return FALSE;
-diff --git a/src/ex_cmds.h b/src/ex_cmds.h
-index 48b0253..82d6e29 100644
---- a/src/ex_cmds.h
-+++ b/src/ex_cmds.h
-@@ -56,6 +56,7 @@
- 				 * curbuf_lock is set */
- #define MODIFY       0x200000L	/* forbidden in non-'modifiable' buffer */
- #define EXFLAGS      0x400000L	/* allow flags after count in argument */
-+#define RESTRICT     0x800000L	/* forbidden in restricted mode */
- #define FILES	(XFILE | EXTRA)	/* multiple extra files allowed */
- #define WORD1	(EXTRA | NOSPC)	/* one extra word allowed */
- #define FILE1	(FILES | NOSPC)	/* 1 file allowed, defaults to current file */
-@@ -860,13 +861,13 @@ EX(CMD_lunmap,		"lunmap",	ex_unmap,
- 			EXTRA|TRLBAR|NOTRLCOM|USECTRLV|CMDWIN,
- 			ADDR_LINES),
- EX(CMD_lua,		"lua",		ex_lua,
--			RANGE|EXTRA|NEEDARG|CMDWIN,
-+			RANGE|EXTRA|NEEDARG|CMDWIN|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_luado,		"luado",	ex_luado,
--			RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN,
-+			RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_luafile,		"luafile",	ex_luafile,
--			RANGE|FILE1|NEEDARG|CMDWIN,
-+			RANGE|FILE1|NEEDARG|CMDWIN|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_lvimgrep,	"lvimgrep",	ex_vimgrep,
- 			RANGE|NOTADR|BANG|NEEDARG|EXTRA|NOTRLCOM|TRLBAR|XFILE,
-@@ -929,10 +930,10 @@ EX(CMD_mode,		"mode",		ex_mode,
- 			WORD1|TRLBAR|CMDWIN,
- 			ADDR_LINES),
- EX(CMD_mzscheme,	"mzscheme",	ex_mzscheme,
--			RANGE|EXTRA|DFLALL|NEEDARG|CMDWIN|SBOXOK,
-+			RANGE|EXTRA|DFLALL|NEEDARG|CMDWIN|SBOXOK|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_mzfile,		"mzfile",	ex_mzfile,
--			RANGE|FILE1|NEEDARG|CMDWIN,
-+			RANGE|FILE1|NEEDARG|CMDWIN|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_next,		"next",		ex_next,
- 			RANGE|NOTADR|BANG|FILES|EDITCMD|ARGOPT|TRLBAR,
-@@ -1115,37 +1116,37 @@ EX(CMD_pwd,		"pwd",		ex_pwd,
- 			TRLBAR|CMDWIN,
- 			ADDR_LINES),
- EX(CMD_python,		"python",	ex_python,
--			RANGE|EXTRA|NEEDARG|CMDWIN,
-+			RANGE|EXTRA|NEEDARG|CMDWIN|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_pydo,		"pydo",		ex_pydo,
--			RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN,
-+			RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_pyfile,		"pyfile",	ex_pyfile,
--			RANGE|FILE1|NEEDARG|CMDWIN,
-+			RANGE|FILE1|NEEDARG|CMDWIN|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_py3,		"py3",		ex_py3,
--			RANGE|EXTRA|NEEDARG|CMDWIN,
-+			RANGE|EXTRA|NEEDARG|CMDWIN|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_py3do,		"py3do",	ex_py3do,
--			RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN,
-+			RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_python3,		"python3",	ex_py3,
--			RANGE|EXTRA|NEEDARG|CMDWIN,
-+			RANGE|EXTRA|NEEDARG|CMDWIN|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_py3file,		"py3file",	ex_py3file,
--			RANGE|FILE1|NEEDARG|CMDWIN,
-+			RANGE|FILE1|NEEDARG|CMDWIN|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_pyx,		"pyx",		ex_pyx,
--			RANGE|EXTRA|NEEDARG|CMDWIN,
-+			RANGE|EXTRA|NEEDARG|CMDWIN|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_pyxdo,		"pyxdo",	ex_pyxdo,
--			RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN,
-+			RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_pythonx,		"pythonx",	ex_pyx,
--			RANGE|EXTRA|NEEDARG|CMDWIN,
-+			RANGE|EXTRA|NEEDARG|CMDWIN|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_pyxfile,		"pyxfile",	ex_pyxfile,
--			RANGE|FILE1|NEEDARG|CMDWIN,
-+			RANGE|FILE1|NEEDARG|CMDWIN|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_quit,		"quit",		ex_quit,
- 			BANG|RANGE|COUNT|NOTADR|TRLBAR|CMDWIN,
-@@ -1199,13 +1200,13 @@ EX(CMD_runtime,		"runtime",	ex_runtime,
- 			BANG|NEEDARG|FILES|TRLBAR|SBOXOK|CMDWIN,
- 			ADDR_LINES),
- EX(CMD_ruby,		"ruby",		ex_ruby,
--			RANGE|EXTRA|NEEDARG|CMDWIN,
-+			RANGE|EXTRA|NEEDARG|CMDWIN|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_rubydo,		"rubydo",	ex_rubydo,
--			RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN,
-+			RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_rubyfile,	"rubyfile",	ex_rubyfile,
--			RANGE|FILE1|NEEDARG|CMDWIN,
-+			RANGE|FILE1|NEEDARG|CMDWIN|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_rundo,		"rundo",	ex_rundo,
- 			NEEDARG|FILE1,
-@@ -1472,13 +1473,13 @@ EX(CMD_tabs,		"tabs",		ex_tabs,
- 			TRLBAR|CMDWIN,
- 			ADDR_TABS),
- EX(CMD_tcl,		"tcl",		ex_tcl,
--			RANGE|EXTRA|NEEDARG|CMDWIN,
-+			RANGE|EXTRA|NEEDARG|CMDWIN|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_tcldo,		"tcldo",	ex_tcldo,
--			RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN,
-+			RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_tclfile,		"tclfile",	ex_tclfile,
--			RANGE|FILE1|NEEDARG|CMDWIN,
-+			RANGE|FILE1|NEEDARG|CMDWIN|RESTRICT,
- 			ADDR_LINES),
- EX(CMD_tearoff,		"tearoff",	ex_tearoff,
- 			NEEDARG|EXTRA|TRLBAR|NOTRLCOM|CMDWIN,
-diff --git a/src/ex_docmd.c b/src/ex_docmd.c
-index ef86fc8..aaf2f9d 100644
---- a/src/ex_docmd.c
-+++ b/src/ex_docmd.c
-@@ -2372,11 +2372,16 @@ do_one_cmd(
- #ifdef HAVE_SANDBOX
- 	if (sandbox != 0 && !(ea.argt & SBOXOK))
- 	{
--	    /* Command not allowed in sandbox. */
-+	    // Command not allowed in sandbox.
- 	    errormsg = (char_u *)_(e_sandbox);
- 	    goto doend;
- 	}
- #endif
-+	if (restricted != 0 && (ea.argt & RESTRICT))
-+	{
-+	    errormsg = (char_u *)_("E981: Command not allowed in rvim");
-+	    goto doend;
-+	}
- 	if (!curbuf->b_p_ma && (ea.argt & MODIFY))
- 	{
- 	    /* Command not allowed in non-'modifiable' buffer */
-diff --git a/src/if_perl.xs b/src/if_perl.xs
-index 7b45033..fc8d613 100644
---- a/src/if_perl.xs
-+++ b/src/if_perl.xs
-@@ -930,6 +930,7 @@ VIM_init(void)
- #ifdef DYNAMIC_PERL
- static char *e_noperl = N_("Sorry, this command is disabled: the Perl library could not be loaded.");
- #endif
-+static char *e_perlsandbox = N_("E299: Perl evaluation forbidden in sandbox without the Safe module");
- 
- /*
-  * ":perl"
-@@ -978,13 +979,12 @@ ex_perl(exarg_T *eap)
- 	vim_free(script);
-     }
- 
--#ifdef HAVE_SANDBOX
--    if (sandbox)
-+    if (sandbox || secure)
-     {
- 	safe = perl_get_sv("VIM::safe", FALSE);
- # ifndef MAKE_TEST  /* avoid a warning for unreachable code */
- 	if (safe == NULL || !SvTRUE(safe))
--	    EMSG(_("E299: Perl evaluation forbidden in sandbox without the Safe module"));
-+	    EMSG(_(e_perlsandbox));
- 	else
- # endif
- 	{
-@@ -996,7 +996,6 @@ ex_perl(exarg_T *eap)
- 	}
-     }
-     else
--#endif
- 	perl_eval_sv(sv, G_DISCARD | G_NOARGS);
- 
-     SvREFCNT_dec(sv);
-@@ -1259,13 +1258,12 @@ do_perleval(char_u *str, typval_T *rettv)
- 	ENTER;
- 	SAVETMPS;
- 
--#ifdef HAVE_SANDBOX
--	if (sandbox)
-+	if (sandbox || secure)
- 	{
- 	    safe = get_sv("VIM::safe", FALSE);
- # ifndef MAKE_TEST  /* avoid a warning for unreachable code */
- 	    if (safe == NULL || !SvTRUE(safe))
--		EMSG(_("E299: Perl evaluation forbidden in sandbox without the Safe module"));
-+		EMSG(_(e_perlsandbox));
- 	    else
- # endif
- 	    {
-@@ -1281,7 +1279,6 @@ do_perleval(char_u *str, typval_T *rettv)
- 	    }
- 	}
- 	else
--#endif /* HAVE_SANDBOX */
- 	    sv = eval_pv((char *)str, 0);
- 
- 	if (sv) {
-diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
-index e36089a..5f1c38c 100644
---- a/src/testdir/Make_all.mak
-+++ b/src/testdir/Make_all.mak
-@@ -156,6 +156,7 @@ NEW_TESTS = test_arabic.res \
- 	    test_quotestar.res \
- 	    test_regex_char_classes.res \
- 	    test_registers.res \
-+	    test_restricted.res \
- 	    test_retab.res \
- 	    test_ruby.res \
- 	    test_scrollbind.res \
-diff --git a/src/testdir/test_restricted.vim b/src/testdir/test_restricted.vim
-new file mode 100644
-index 0000000..9dd937c
---- /dev/null
-+++ b/src/testdir/test_restricted.vim
-@@ -0,0 +1,107 @@
-+" Test for "rvim" or "vim -Z"
-+
-+source shared.vim
-+
-+func Test_restricted()
-+  let cmd = GetVimCommand('Xrestricted')
-+  if cmd == ''
-+    return
-+  endif
-+
-+  call writefile([
-+	\ "silent !ls",
-+	\ "call writefile([v:errmsg], 'Xrestrout')",
-+	\ "qa!",
-+	\ ], 'Xrestricted')
-+  call system(cmd . ' -Z')
-+  call assert_match('E145:', join(readfile('Xrestrout')))
-+
-+  call delete('Xrestricted')
-+  call delete('Xrestrout')
-+endfunc
-+
-+func Run_restricted_test(ex_cmd, error)
-+  let cmd = GetVimCommand('Xrestricted')
-+  if cmd == ''
-+    return
-+  endif
-+
-+  call writefile([
-+	\ a:ex_cmd,
-+	\ "call writefile([v:errmsg], 'Xrestrout')",
-+	\ "qa!",
-+	\ ], 'Xrestricted')
-+  call system(cmd . ' -Z')
-+  call assert_match(a:error, join(readfile('Xrestrout')))
-+
-+  call delete('Xrestricted')
-+  call delete('Xrestrout')
-+endfunc
-+
-+func Test_restricted_lua()
-+  if !has('lua')
-+    throw 'Skipped: Lua is not supported'
-+  endif
-+  call Run_restricted_test('lua print("Hello, Vim!")', 'E981:')
-+  call Run_restricted_test('luado return "hello"', 'E981:')
-+  call Run_restricted_test('luafile somefile', 'E981:')
-+  call Run_restricted_test('call luaeval("expression")', 'E145:')
-+endfunc
-+
-+func Test_restricted_mzscheme()
-+  if !has('mzscheme')
-+    throw 'Skipped: MzScheme is not supported'
-+  endif
-+  call Run_restricted_test('mzscheme statement', 'E981:')
-+  call Run_restricted_test('mzfile somefile', 'E981:')
-+  call Run_restricted_test('call mzeval("expression")', 'E145:')
-+endfunc
-+
-+func Test_restricted_perl()
-+  if !has('perl')
-+    throw 'Skipped: Perl is not supported'
-+  endif
-+  " TODO: how to make Safe mode fail?
-+  " call Run_restricted_test('perl system("ls")', 'E981:')
-+  " call Run_restricted_test('perldo system("hello")', 'E981:')
-+  " call Run_restricted_test('perlfile somefile', 'E981:')
-+  " call Run_restricted_test('call perleval("system(\"ls\")")', 'E145:')
-+endfunc
-+
-+func Test_restricted_python()
-+  if !has('python')
-+    throw 'Skipped: Python is not supported'
-+  endif
-+  call Run_restricted_test('python print "hello"', 'E981:')
-+  call Run_restricted_test('pydo return "hello"', 'E981:')
-+  call Run_restricted_test('pyfile somefile', 'E981:')
-+  call Run_restricted_test('call pyeval("expression")', 'E145:')
-+endfunc
-+
-+func Test_restricted_python3()
-+  if !has('python3')
-+    throw 'Skipped: Python3 is not supported'
-+  endif
-+  call Run_restricted_test('py3 print "hello"', 'E981:')
-+  call Run_restricted_test('py3do return "hello"', 'E981:')
-+  call Run_restricted_test('py3file somefile', 'E981:')
-+  call Run_restricted_test('call py3eval("expression")', 'E145:')
-+endfunc
-+
-+func Test_restricted_ruby()
-+  if !has('ruby')
-+    throw 'Skipped: Ruby is not supported'
-+  endif
-+  call Run_restricted_test('ruby print "Hello"', 'E981:')
-+  call Run_restricted_test('rubydo print "Hello"', 'E981:')
-+  call Run_restricted_test('rubyfile somefile', 'E981:')
-+endfunc
-+
-+func Test_restricted_tcl()
-+  if !has('tcl')
-+    throw 'Skipped: Tcl is not supported'
-+  endif
-+  call Run_restricted_test('tcl puts "Hello"', 'E981:')
-+  call Run_restricted_test('tcldo puts "Hello"', 'E981:')
-+  call Run_restricted_test('tclfile somefile', 'E981:')
-+endfunc

SOURCES/0001-patch-8.1.1365-source-command-doesn-t-check-for-the-.patch

@@ -1,16 +0,0 @@
-diff -up vim80/src/getchar.c.cve vim80/src/getchar.c
---- vim80/src/getchar.c.cve	2019-06-14 13:46:17.269523985 +0200
-+++ vim80/src/getchar.c	2019-06-14 13:46:58.427169288 +0200
-@@ -1418,6 +1418,12 @@ openscript(
- 	EMSG(_(e_nesting));
- 	return;
-     }
-+
-+    // Disallow sourcing a file in the sandbox, the commands would be executed
-+    // later, possibly outside of the sandbox.
-+    if (check_secure())
-+	return;
-+
- #ifdef FEAT_EVAL
-     if (ignore_script)
- 	/* Not reading from script, also don't open one.  Warning message? */

SOURCES/0001-patch-8.2.3115-Coverity-complains-about-free_wininfo.patch

@@ -0,0 +1,30 @@
+From b5098060f4acae4dac3203130278c948d670a3d5 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Wed, 7 Jul 2021 19:26:19 +0200
+Subject: [PATCH] patch 8.2.3115: Coverity complains about free_wininfo() use
+
+Problem:    Coverity complains about free_wininfo() use.
+Solution:   Add a condition that "wip2" is not equal to "wip". (Neovim #14996)
+---
+ src/version.c | 2 ++
+ src/window.c  | 3 ++-
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/src/window.c b/src/window.c
+index 09067b081..cc9c217b4 100644
+--- a/src/window.c
++++ b/src/window.c
+@@ -5057,8 +5057,9 @@ win_free(
+ 
+ 		// If there already is an entry with "wi_win" set to NULL it
+ 		// must be removed, it would never be used.
++		// Skip "wip" itself, otherwise Coverity complains.
+ 		for (wip2 = buf->b_wininfo; wip2 != NULL; wip2 = wip2->wi_next)
+-		    if (wip2->wi_win == NULL)
++		    if (wip2 != wip && wip2->wi_win == NULL)
+ 		    {
+ 			if (wip2->wi_next != NULL)
+ 			    wip2->wi_next->wi_prev = wip2->wi_prev;
+-- 
+2.31.1
+

SOURCES/0001-patch-8.2.3290-Vim9-compiling-dict-may-use-pointer-a.patch

@@ -0,0 +1,102 @@
+diff --git a/src/vim9compile.c b/src/vim9compile.c
+index 535de05..ae7b253 100644
+--- a/src/vim9compile.c
++++ b/src/vim9compile.c
+@@ -1073,21 +1073,26 @@ generate_PUSHF(cctx_T *cctx, float_T fnumber)
+ 
+ /*
+  * Generate an ISN_PUSHS instruction.
+- * Consumes "str".
++ * Consumes "*str".  When freed *str is set to NULL, unless "str" is NULL.
+  */
+     static int
+-generate_PUSHS(cctx_T *cctx, char_u *str)
++generate_PUSHS(cctx_T *cctx, char_u **str)
+ {
+     isn_T	*isn;
+ 
+     if (cctx->ctx_skip == SKIP_YES)
+     {
+-	vim_free(str);
++	if (str != NULL)
++	    VIM_CLEAR(*str);
+ 	return OK;
+     }
+     if ((isn = generate_instr_type(cctx, ISN_PUSHS, &t_string)) == NULL)
++    {
++	if (str != NULL)
++	    VIM_CLEAR(*str);
+ 	return FAIL;
+-    isn->isn_arg.string = str;
++    }
++    isn->isn_arg.string = str == NULL ? NULL : *str;
+ 
+     return OK;
+ }
+@@ -2547,7 +2552,7 @@ generate_tv_PUSH(cctx_T *cctx, typval_T *tv)
+ 		tv->vval.v_blob = NULL;
+ 		break;
+ 	    case VAR_STRING:
+-		generate_PUSHS(cctx, tv->vval.v_string);
++		generate_PUSHS(cctx, &tv->vval.v_string);
+ 		tv->vval.v_string = NULL;
+ 		break;
+ 	    default:
+@@ -3301,7 +3306,7 @@ compile_dict(char_u **arg, cctx_T *cctx, ppconst_T *ppconst)
+ 	    key = get_literal_key(arg);
+ 	    if (key == NULL)
+ 		return FAIL;
+-	    if (generate_PUSHS(cctx, key) == FAIL)
++	    if (generate_PUSHS(cctx, &key) == FAIL)
+ 		return FAIL;
+ 	}
+ 
+@@ -5978,7 +5983,7 @@ compile_assign_unlet(
+ 	char_u *key_end = to_name_end(p + 1, TRUE);
+ 	char_u *key = vim_strnsave(p + 1, key_end - p - 1);
+ 
+-	r = generate_PUSHS(cctx, key);
++	r = generate_PUSHS(cctx, &key);
+     }
+     if (r == FAIL)
+ 	return FAIL;
+@@ -6149,7 +6154,7 @@ compile_assignment(char_u *arg, exarg_T *eap, cmdidx_T cmdidx, cctx_T *cctx)
+ 	    // Push each line and the create the list.
+ 	    FOR_ALL_LIST_ITEMS(l, li)
+ 	    {
+-		generate_PUSHS(cctx, li->li_tv.vval.v_string);
++		generate_PUSHS(cctx, &li->li_tv.vval.v_string);
+ 		li->li_tv.vval.v_string = NULL;
+ 	    }
+ 	    generate_NEWLIST(cctx, l->lv_len);
+@@ -7709,7 +7714,7 @@ compile_catch(char_u *arg, cctx_T *cctx UNUSED)
+ 	p += len + 2 + dropped;
+ 	if (pat == NULL)
+ 	    return FAIL;
+-	if (generate_PUSHS(cctx, pat) == FAIL)
++	if (generate_PUSHS(cctx, &pat) == FAIL)
+ 	    return FAIL;
+ 
+ 	if (generate_COMPARE(cctx, EXPR_MATCH, FALSE) == FAIL)
+@@ -8080,7 +8085,9 @@ compile_exec(char_u *line, exarg_T *eap, cctx_T *cctx)
+ 	{
+ 	    if (p > start)
+ 	    {
+-		generate_PUSHS(cctx, vim_strnsave(start, p - start));
++		char_u *val = vim_strnsave(start, p - start);
++
++		generate_PUSHS(cctx, &val);
+ 		++count;
+ 	    }
+ 	    p += 2;
+@@ -8101,7 +8108,9 @@ compile_exec(char_u *line, exarg_T *eap, cctx_T *cctx)
+ 	    {
+ 		if (*skipwhite(start) != NUL)
+ 		{
+-		    generate_PUSHS(cctx, vim_strsave(start));
++		    char_u *val = vim_strsave(start);
++
++		    generate_PUSHS(cctx, &val);
+ 		    ++count;
+ 		}
+ 		break;

SOURCES/0001-patch-8.2.3406-on-some-systems-tests-fail-without-_R.patch

@@ -0,0 +1,49 @@
+From 3ae5fc9a6a881e0be381e4cc70080ac5908d7520 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Mon, 6 Sep 2021 18:57:30 +0200
+Subject: [PATCH] patch 8.2.3406: on some systems tests fail without _REENTRANT
+
+Problem:    On some systems tests fail without _REENTRANT. (Elimar
+            Riesebieter)
+Solution:   Add -D_REENTRANT in configure. (closes #7402)
+---
+ src/auto/configure | 4 ++++
+ src/configure.ac   | 6 ++++++
+ src/version.c      | 2 ++
+ 3 files changed, 12 insertions(+)
+
+diff --git a/src/auto/configure b/src/auto/configure
+index fba6a19b5..4f4363224 100755
+--- a/src/auto/configure
++++ b/src/auto/configure
+@@ -14960,6 +14960,10 @@ $as_echo "no" >&6; }
+   fi
+ fi
+ 
++if `echo "$CFLAGS" | grep -v D_XEENTRANT >/dev/null`; then
++  CFLAGS="$CFLAGS -D_REENTRANT"
++fi
++
+ DEPEND_CFLAGS_FILTER=
+ if test "$GCC" = yes; then
+   { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GCC 3 or later" >&5
+diff --git a/src/configure.ac b/src/configure.ac
+index 5ec955757..4cd6dea1f 100644
+--- a/src/configure.ac
++++ b/src/configure.ac
+@@ -4504,6 +4504,12 @@ if test "$MACOS_X" = "yes"; then
+   fi
+ fi
+ 
++dnl On some systems REENTRANT needs to be defined.  It should not hurt to use
++dnl it everywhere.
++if `echo "$CFLAGS" | grep -v D_REENTRANT >/dev/null`; then
++  CFLAGS="$CFLAGS -D_REENTRANT"
++fi
++
+ dnl gcc 3.1 changed the meaning of -MM.  The only solution appears to be to
+ dnl use "-isystem" instead of "-I" for all non-Vim include dirs.
+ dnl But only when making dependencies, cproto and lint don't take "-isystem".
+-- 
+2.31.1
+

SOURCES/0001-patch-8.2.3409-reading-beyond-end-of-line-with-inval.patch

@@ -0,0 +1,48 @@
+From 65b605665997fad54ef39a93199e305af2fe4d7f Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Tue, 7 Sep 2021 19:26:53 +0200
+Subject: [PATCH] patch 8.2.3409: reading beyond end of line with invalid utf-8
+ character
+
+Problem:    Reading beyond end of line with invalid utf-8 character.
+Solution:   Check for NUL when advancing.
+---
+ src/regexp_nfa.c                 | 3 ++-
+ src/testdir/test_regexp_utf8.vim | 8 ++++++++
+ src/version.c                    | 2 ++
+ 3 files changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c
+index 9757d7c47..c7db98187 100644
+--- a/src/regexp_nfa.c
++++ b/src/regexp_nfa.c
+@@ -5664,7 +5664,8 @@ find_match_text(colnr_T startcol, int regstart, char_u *match_text)
+ 		match = FALSE;
+ 		break;
+ 	    }
+-	    len2 += MB_CHAR2LEN(c2);
++	    len2 += enc_utf8 ? utf_ptr2len(rex.line + col + len2)
++							     : MB_CHAR2LEN(c2);
+ 	}
+ 	if (match
+ 		// check that no composing char follows
+diff --git a/src/testdir/test_regexp_utf8.vim b/src/testdir/test_regexp_utf8.vim
+index 9f0ffb9aa..044aeffb6 100644
+--- a/src/testdir/test_regexp_utf8.vim
++++ b/src/testdir/test_regexp_utf8.vim
+@@ -558,4 +558,12 @@ func Test_match_char_class_upper()
+   bwipe!
+ endfunc
+ 
++func Test_match_invalid_byte()
++  call writefile(0z630a.765d30aa0a.2e0a.790a.4030, 'Xinvalid')
++  new
++  source Xinvalid
++  bwipe!
++  call delete('Xinvalid')
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+2.31.1
+

SOURCES/0001-patch-8.2.3428-using-freed-memory-when-replacing.patch

@@ -1,8 +1,7 @@
-diff --git a/src/normal.c b/src/normal.c
-index be0e75e..7d62e20 100644
---- a/src/normal.c
-+++ b/src/normal.c
-@@ -7147,19 +7147,23 @@ nv_replace(cmdarg_T *cap)
+diff -up vim82/src/normal.c.cve-3796 vim82/src/normal.c
+--- vim82/src/normal.c.cve-3796	2021-03-22 10:02:42.000000000 +0100
++++ vim82/src/normal.c	2021-10-15 10:45:21.397258123 +0200
+@@ -5076,19 +5076,23 @@ nv_replace(cmdarg_T *cap)
  	    {
  		/*
  		 * Get ptr again, because u_save and/or showmatch() will have
@@ -29,12 +28,11 @@ index be0e75e..7d62e20 100644
  		if (p_sm && msg_silent == 0)
  		    showmatch(cap->nchar);
  		++curwin->w_cursor.col;
-diff --git a/src/testdir/test_edit.vim b/src/testdir/test_edit.vim
-index 7278bcd..8818805 100644
---- a/src/testdir/test_edit.vim
-+++ b/src/testdir/test_edit.vim
-@@ -1387,3 +1387,15 @@ func Test_edit_quit()
-   only
+diff -up vim82/src/testdir/test_edit.vim.cve-3796 vim82/src/testdir/test_edit.vim
+--- vim82/src/testdir/test_edit.vim.cve-3796	2021-10-15 10:45:21.398258115 +0200
++++ vim82/src/testdir/test_edit.vim	2021-10-15 10:46:22.892764135 +0200
+@@ -1844,4 +1844,16 @@ func Test_read_invalid()
+   set encoding=utf-8
  endfunc
  
 +" Test for getting the character of the line below after "p"
@@ -49,3 +47,4 @@ index 7278bcd..8818805 100644
 +  set encoding=utf-8
 +endfunc
 +
+ " vim: shiftwidth=2 sts=2 expandtab

SOURCES/0001-patch-8.2.3487-illegal-memory-access-if-buffer-name-.patch

@@ -1,7 +1,22 @@
-diff -up vim80/src/screen.c.cve3872 vim80/src/screen.c
---- vim80/src/screen.c.cve3872	2021-10-21 13:20:27.694921335 +0200
-+++ vim80/src/screen.c	2021-10-21 13:22:42.221732996 +0200
-@@ -6911,13 +6911,13 @@ win_redr_status(win_T *wp)
+From 826bfe4bbd7594188e3d74d2539d9707b1c6a14b Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Fri, 8 Oct 2021 18:39:28 +0100
+Subject: [PATCH] patch 8.2.3487: illegal memory access if buffer name is very
+ long
+
+Problem:    Illegal memory access if buffer name is very long.
+Solution:   Make sure not to go over the end of the buffer.
+---
+ src/drawscreen.c                | 10 +++++-----
+ src/testdir/test_statusline.vim | 10 ++++++++++
+ src/version.c                   |  2 ++
+ 3 files changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/src/drawscreen.c b/src/drawscreen.c
+index 82e53753b..e38ca9586 100644
+--- a/src/drawscreen.c
++++ b/src/drawscreen.c
+@@ -464,13 +464,13 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED)
  	    *(p + len++) = ' ';
  	if (bt_help(wp->w_buffer))
  	{
@@ -17,7 +32,7 @@ diff -up vim80/src/screen.c.cve3872 vim80/src/screen.c
  	    len += (int)STRLEN(p + len);
  	}
  #endif
-@@ -6927,12 +6927,12 @@ win_redr_status(win_T *wp)
+@@ -480,12 +480,12 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED)
  #endif
  		)
  	{
@@ -33,3 +48,25 @@ diff -up vim80/src/screen.c.cve3872 vim80/src/screen.c
  	    len += (int)STRLEN(p + len);
  	}
  
+diff --git a/src/testdir/test_statusline.vim b/src/testdir/test_statusline.vim
+index f3eea2e71..a952de69b 100644
+--- a/src/testdir/test_statusline.vim
++++ b/src/testdir/test_statusline.vim
+@@ -522,4 +522,14 @@ func Test_statusline_mbyte_fillchar()
+   %bw!
+ endfunc
+ 
++" Used to write beyond allocated memory.  This assumes MAXPATHL is 4096 bytes.
++func Test_statusline_verylong_filename()
++  let fname = repeat('x', 4090)
++  exe "new " .. fname
++  set buftype=help
++  set previewwindow
++  redraw
++  bwipe!
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+2.31.1
+

SOURCES/0001-patch-8.2.3625-illegal-memory-access-when-C-indentin.patch

@@ -1,9 +1,9 @@
-diff --git a/src/misc1.c b/src/misc1.c
-index de79c8e..1c5867d 100644
---- a/src/misc1.c
-+++ b/src/misc1.c
-@@ -6792,7 +6792,7 @@ find_start_brace(void)	    /* XXX */
- 		       && (pos = ind_find_start_CORS(NULL)) == NULL) /* XXX */
+diff --git a/src/cindent.c b/src/cindent.c
+index b2fac1a..ce513e3 100644
+--- a/src/cindent.c
++++ b/src/cindent.c
+@@ -1654,7 +1654,7 @@ find_start_brace(void)	    // XXX
+ 		       && (pos = ind_find_start_CORS(NULL)) == NULL) // XXX
  	    break;
  	if (pos != NULL)
 -	    curwin->w_cursor.lnum = pos->lnum;
@@ -12,11 +12,11 @@ index de79c8e..1c5867d 100644
      curwin->w_cursor = cursor_save;
      return trypos;
 diff --git a/src/testdir/test_cindent.vim b/src/testdir/test_cindent.vim
-index 7c2c5e3..f8c7e57 100644
+index 5926408..f668faa 100644
 --- a/src/testdir/test_cindent.vim
 +++ b/src/testdir/test_cindent.vim
-@@ -102,4 +102,16 @@ func Test_cindent_expr()
-   bw!
+@@ -5307,4 +5307,16 @@ func Test_cindent_pragma()
+   enew! | close
  endfunc
  
 +func Test_find_brace_backwards()

SOURCES/0001-patch-8.2.3669-buffer-overflow-with-long-help-argume.patch

@@ -1,14 +1,32 @@
-diff --git a/src/ex_cmds.c b/src/ex_cmds.c
-index 1827fec..e69fbd3 100644
---- a/src/ex_cmds.c
-+++ b/src/ex_cmds.c
-@@ -6537,8 +6537,7 @@ find_help_tags(
+diff --git a/src/help.c b/src/help.c
+index ee6ff18..67e4fb2 100644
+--- a/src/help.c
++++ b/src/help.c
+@@ -422,8 +422,7 @@ find_help_tags(
  		    || (vim_strchr((char_u *)"%_z@", arg[1]) != NULL
  							   && arg[2] != NUL)))
  	{
 -	    STRCPY(d, "/\\\\");
 -	    STRCPY(d + 3, arg + 1);
 +	    vim_snprintf((char *)d, IOSIZE, "/\\\\%s", arg + 1);
- 	    /* Check for "/\\_$", should be "/\\_\$" */
+ 	    // Check for "/\\_$", should be "/\\_\$"
  	    if (d[3] == '_' && d[4] == '$')
  		STRCPY(d + 4, "\\$");
+diff --git a/src/testdir/test_help.vim b/src/testdir/test_help.vim
+index ff2bc41..c8ff5b8 100644
+--- a/src/testdir/test_help.vim
++++ b/src/testdir/test_help.vim
+@@ -123,5 +123,13 @@ func Test_helptag_cmd_readonly()
+   call delete('Xdir', 'rf')
+ endfunc
+ 
++func Test_help_long_argument()
++  try
++    exe 'help \%' .. repeat('0', 1021)
++  catch
++    call assert_match("E149:", v:exception)
++  endtry
++endfunc
++
+ 
+ " vim: shiftwidth=2 sts=2 expandtab

SOURCES/0001-patch-8.2.3949-using-freed-memory-with-V.patch

@@ -1,39 +1,38 @@
-diff -up vim80/src/regexp.c.cve4192 vim80/src/regexp.c
---- vim80/src/regexp.c.cve4192	2022-01-12 15:21:44.792239040 +0100
-+++ vim80/src/regexp.c	2022-01-12 15:34:35.190425880 +0100
-@@ -4203,9 +4203,9 @@ reg_match_visual(void)
+diff -up vim82/src/regexp.c.cve4192 vim82/src/regexp.c
+--- vim82/src/regexp.c.cve4192	2021-03-22 10:02:42.000000000 +0100
++++ vim82/src/regexp.c	2022-01-13 10:54:17.629176807 +0100
+@@ -1316,9 +1316,9 @@ reg_match_visual(void)
      if (lnum < top.lnum || lnum > bot.lnum)
  	return FALSE;
  
-+    col = (colnr_T)(reginput - regline);
++    col = (colnr_T)(rex.input - rex.line);
      if (mode == 'v')
      {
--	col = (colnr_T)(reginput - regline);
+-	col = (colnr_T)(rex.input - rex.line);
  	if ((lnum == top.lnum && col < top.col)
  		|| (lnum == bot.lnum && col >= bot.col + (*p_sel != 'e')))
  	    return FALSE;
-@@ -4220,7 +4220,12 @@ reg_match_visual(void)
+@@ -1333,7 +1333,12 @@ reg_match_visual(void)
  	    end = end2;
  	if (top.col == MAXCOL || bot.col == MAXCOL)
  	    end = MAXCOL;
--	cols = win_linetabsize(wp, regline, (colnr_T)(reginput - regline));
+-	cols = win_linetabsize(wp, rex.line, (colnr_T)(rex.input - rex.line));
 +
 +	// getvvcol() flushes rex.line, need to get it again
-+	regline = reg_getline(reglnum);
-+	reginput = regline + col;
++	rex.line = reg_getline(rex.lnum);
++	rex.input = rex.line + col;
 +
-+	cols = win_linetabsize(wp, regline, col);
++	cols = win_linetabsize(wp, rex.line, col);
  	if (cols < start || cols > end - (*p_sel == 'e'))
  	    return FALSE;
      }
-diff -up vim80/src/testdir/test_regexp_latin.vim.cve4192 vim80/src/testdir/test_regexp_latin.vim
---- vim80/src/testdir/test_regexp_latin.vim.cve4192	2022-01-12 15:21:44.792239040 +0100
-+++ vim80/src/testdir/test_regexp_latin.vim	2022-01-12 15:36:12.499693099 +0100
-@@ -80,3 +80,13 @@ func Test_using_invalid_visual_position(
-   /\%V
+diff -up vim82/src/testdir/test_regexp_latin.vim.cve4192 vim82/src/testdir/test_regexp_latin.vim
+--- vim82/src/testdir/test_regexp_latin.vim.cve4192	2022-01-13 10:52:05.508789448 +0100
++++ vim82/src/testdir/test_regexp_latin.vim	2022-01-13 10:52:05.510789454 +0100
+@@ -946,4 +946,12 @@ func Test_using_invalid_visual_position(
    bwipe!
  endfunc
-+
+ 
 +func Test_using_visual_position()
 +  " this was using freed memory
 +  new
@@ -42,4 +41,4 @@ diff -up vim80/src/testdir/test_regexp_latin.vim.cve4192 vim80/src/testdir/test_
 +  bwipe!
 +endfunc
 +
-+" vim: shiftwidth=2 sts=2 expandtab
+ " vim: shiftwidth=2 sts=2 expandtab

SOURCES/0001-patch-8.2.3950-going-beyond-the-end-of-the-line-with.patch

@@ -1,12 +1,12 @@
-diff -up vim80/src/charset.c.cve4193 vim80/src/charset.c
---- vim80/src/charset.c.cve4193	2022-01-12 14:49:08.710592947 +0100
-+++ vim80/src/charset.c	2022-01-12 14:49:47.594705863 +0100
-@@ -1291,10 +1291,15 @@ getvcol(
- 	posptr = NULL;  /* continue until the NUL */
+diff -up vim82/src/charset.c.cve4193 vim82/src/charset.c
+--- vim82/src/charset.c.cve4193	2021-03-22 10:02:42.000000000 +0100
++++ vim82/src/charset.c	2022-01-13 10:14:55.634913386 +0100
+@@ -1232,10 +1232,15 @@ getvcol(
+ 	posptr = NULL;  // continue until the NUL
      else
      {
--	/* Special check for an empty line, which can happen on exit, when
--	 * ml_get_buf() always returns an empty string. */
+-	// Special check for an empty line, which can happen on exit, when
+-	// ml_get_buf() always returns an empty string.
 -	if (*ptr == NUL)
 -	    pos->col = 0;
 +	colnr_T i;
@@ -19,16 +19,15 @@ diff -up vim80/src/charset.c.cve4193 vim80/src/charset.c
 +		break;
 +	    }
  	posptr = ptr + pos->col;
- #ifdef FEAT_MBYTE
  	if (has_mbyte)
-diff -up vim80/src/testdir/test_regexp_latin.vim.cve4193 vim80/src/testdir/test_regexp_latin.vim
---- vim80/src/testdir/test_regexp_latin.vim.cve4193	2022-01-12 14:49:08.710592947 +0100
-+++ vim80/src/testdir/test_regexp_latin.vim	2022-01-12 14:50:45.186873107 +0100
-@@ -72,3 +72,11 @@ func Test_backref()
-   call assert_fails('call search("\\%#=2\\(e\\1\\)")', 'E65:')
-   bwipe!
+ 	    // always start on the first byte
+diff -up vim82/src/testdir/test_regexp_latin.vim.cve4193 vim82/src/testdir/test_regexp_latin.vim
+--- vim82/src/testdir/test_regexp_latin.vim.cve4193	2022-01-13 10:14:55.634913386 +0100
++++ vim82/src/testdir/test_regexp_latin.vim	2022-01-13 10:17:01.905292715 +0100
+@@ -938,4 +938,12 @@ func Test_regexp_last_subst_string()
+   close!
  endfunc
-+
+ 
 +func Test_using_invalid_visual_position()
 +  " this was going beyond the end of the line
 +  new
@@ -36,3 +35,5 @@ diff -up vim80/src/testdir/test_regexp_latin.vim.cve4193 vim80/src/testdir/test_
 +  /\%V
 +  bwipe!
 +endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab

SOURCES/0001-patch-8.2.4120-block-insert-goes-over-the-end-of-the.patch

@@ -1,7 +1,8 @@
-diff -up vim80/src/ops.c.cve0261 vim80/src/ops.c
---- vim80/src/ops.c.cve0261	2022-01-26 14:30:27.475308323 +0100
-+++ vim80/src/ops.c	2022-01-26 14:34:16.650933713 +0100
-@@ -636,23 +636,30 @@ block_insert(
+diff --git a/src/ops.c b/src/ops.c
+index d8e96ff..88992b6 100644
+--- a/src/ops.c
++++ b/src/ops.c
+@@ -534,22 +534,27 @@ block_insert(
  	    if (b_insert)
  	    {
  		off = (*mb_head_off)(oldp, oldp + offset + spaces);
@@ -17,43 +18,42 @@ diff -up vim80/src/ops.c.cve0261 vim80/src/ops.c
 +		off = (*mb_head_off)(oldp, oldp + offset);
 +		offset -= off;
  	    }
- 	    spaces -= off;
- 	    count -= off;
+-	    spaces -= off;
+-	    count -= off;
  	}
- #endif
  
--	newp = alloc_check((unsigned)(STRLEN(oldp)) + s_len + count + 1);
+-	newp = alloc(STRLEN(oldp) + s_len + count + 1);
 +	// Make sure the allocated size matches what is actually copied below.
 +	newp = alloc(STRLEN(oldp) + spaces + s_len
-+		    + (spaces > 0 && !bdp->is_short ? p_ts - spaces : 0)
++		    + (spaces > 0 && !bdp->is_short ? ts_val - spaces : 0)
 +								  + count + 1);
  	if (newp == NULL)
  	    continue;
  
- 	/* copy up to shifted part */
+ 	// copy up to shifted part
 -	mch_memmove(newp, oldp, (size_t)(offset));
 +	mch_memmove(newp, oldp, (size_t)offset);
  	oldp += offset;
  
- 	/* insert pre-padding */
-@@ -662,14 +669,21 @@ block_insert(
- 	mch_memmove(newp + offset + spaces, s, (size_t)s_len);
+ 	// insert pre-padding
+@@ -560,14 +565,21 @@ block_insert(
+ 	mch_memmove(newp + startcol, s, (size_t)s_len);
  	offset += s_len;
  
 -	if (spaces && !bdp->is_short)
 +	if (spaces > 0 && !bdp->is_short)
  	{
--	    /* insert post-padding */
--	    vim_memset(newp + offset + spaces, ' ', (size_t)(p_ts - spaces));
--	    /* We're splitting a TAB, don't copy it. */
+-	    // insert post-padding
+-	    vim_memset(newp + offset + spaces, ' ', (size_t)(ts_val - spaces));
+-	    // We're splitting a TAB, don't copy it.
 -	    oldp++;
--	    /* We allowed for that TAB, remember this now */
+-	    // We allowed for that TAB, remember this now
 -	    count++;
 +	    if (*oldp == TAB)
 +	    {
 +		// insert post-padding
 +		vim_memset(newp + offset + spaces, ' ',
-+						    (size_t)(p_ts - spaces));
++						    (size_t)(ts_val - spaces));
 +		// we're splitting a TAB, don't copy it
 +		oldp++;
 +		// We allowed for that TAB, remember this now
@@ -65,26 +65,23 @@ diff -up vim80/src/ops.c.cve0261 vim80/src/ops.c
  	}
  
  	if (spaces > 0)
-@@ -2738,9 +2752,9 @@ op_insert(oparg_T *oap, long count1)
+@@ -1574,7 +1586,7 @@ op_insert(oparg_T *oap, long count1)
  		oap->start_vcol = t;
  	    }
  	    else if (oap->op_type == OP_APPEND
--		      && oap->end.col
-+		      && oap->start.col
- #ifdef FEAT_VIRTUALEDIT
--			    + oap->end.coladd
-+			    + oap->start.coladd
- #endif
+-		      && oap->end.col + oap->end.coladd
++		      && oap->start.col + oap->start.coladd
  			>= curbuf->b_op_start_orig.col
- #ifdef FEAT_VIRTUALEDIT
-diff -up vim80/src/testdir/test_visual.vim.cve0261 vim80/src/testdir/test_visual.vim
---- vim80/src/testdir/test_visual.vim.cve0261	2022-01-26 14:30:27.476308325 +0100
-+++ vim80/src/testdir/test_visual.vim	2022-01-26 14:36:03.482225225 +0100
-@@ -254,3 +254,12 @@ func Test_virtual_replace2()
-   %d_
-   set bs&vim
+ 					      + curbuf->b_op_start_orig.coladd)
+ 	    {
+diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
+index 7c5f973..dc8e376 100644
+--- a/src/testdir/test_visual.vim
++++ b/src/testdir/test_visual.vim
+@@ -967,4 +967,13 @@ func Test_visual_put_in_block()
+   bwipe!
  endfunc
-+
+ 
 +func Test_visual_block_append_invalid_char()
 +  " this was going over the end of the line
 +  new
@@ -93,3 +90,5 @@ diff -up vim80/src/testdir/test_visual.vim.cve0261 vim80/src/testdir/test_visual
 +  call assert_equal(['	-   let xxx', 'xxxxx   -ˆ', 'xxxxxxxx-xxx'], getline(1, 3))
 +  bwipe!
 +endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab

SOURCES/0001-patch-8.2.4151-reading-beyond-the-end-of-a-line.patch

@@ -1,17 +1,15 @@
 diff --git a/src/ops.c b/src/ops.c
-index e9cfb1d..e35b033 100644
+index 88992b6..80e0ea1 100644
 --- a/src/ops.c
 +++ b/src/ops.c
-@@ -629,26 +629,9 @@ block_insert(
+@@ -527,24 +527,8 @@ block_insert(
+ 	}
  
- #ifdef FEAT_MBYTE
  	if (has_mbyte && spaces > 0)
 -	{
 -	    int off;
-+	    // avoid copying part of a multi-byte character
-+	    offset -= (*mb_head_off)(oldp, oldp + offset);
- 
--	    /* Avoid starting halfway a multi-byte character. */
+-
+-	    // Avoid starting halfway a multi-byte character.
 -	    if (b_insert)
 -	    {
 -		off = (*mb_head_off)(oldp, oldp + offset + spaces);
@@ -25,17 +23,17 @@ index e9cfb1d..e35b033 100644
 -		off = (*mb_head_off)(oldp, oldp + offset);
 -		offset -= off;
 -	    }
--	    spaces -= off;
--	    count -= off;
 -	}
- #endif
++	    // avoid copying part of a multi-byte character
++	    offset -= (*mb_head_off)(oldp, oldp + offset);
  
  	// Make sure the allocated size matches what is actually copied below.
+ 	newp = alloc(STRLEN(oldp) + spaces + s_len
 diff --git a/src/testdir/test_utf8.vim b/src/testdir/test_utf8.vim
-index 24e3db8..1042720 100644
+index 5454e43..bedec20 100644
 --- a/src/testdir/test_utf8.vim
 +++ b/src/testdir/test_utf8.vim
-@@ -9,7 +9,7 @@ func Test_visual_block_insert()
+@@ -7,7 +7,7 @@ func Test_visual_block_insert()
    new
    call setline(1, ["aaa", "あああ", "bbb"])
    exe ":norm! gg0l\<C-V>jjIx\<Esc>"
@@ -44,3 +42,21 @@ index 24e3db8..1042720 100644
    bwipeout!
  endfunc
  
+diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
+index dc8e376..8de9e3d 100644
+--- a/src/testdir/test_visual.vim
++++ b/src/testdir/test_visual.vim
+@@ -976,4 +976,13 @@ func Test_visual_block_append_invalid_char()
+   bwipe!
+ endfunc
+ 
++func Test_visual_block_insert_round_off()
++  new
++  " The number of characters are tuned to fill a 4096 byte allocated block,
++  " so that valgrind reports going over the end.
++  call setline(1, ['xxxxx', repeat('0', 1350), "\t", repeat('x', 60)])
++  exe "normal gg0\<C-V>GI" .. repeat('0', 1320) .. "\<Esc>"
++  bwipe!
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab

SOURCES/0001-patch-8.2.4154-ml_get-error-when-exchanging-windows-.patch

@@ -0,0 +1,43 @@
+diff -up vim82/src/testdir/test_visual.vim.cve0319 vim82/src/testdir/test_visual.vim
+--- vim82/src/testdir/test_visual.vim.cve0319	2022-02-08 13:24:54.170813231 +0100
++++ vim82/src/testdir/test_visual.vim	2022-02-08 13:26:21.313747976 +0100
+@@ -985,4 +985,15 @@ func Test_visual_block_insert_round_off(
+   bwipe!
+ endfunc
+ 
++" this was causing an ml_get error
++func Test_visual_exchange_windows()
++  enew!
++  new
++  call setline(1, ['foo', 'bar'])
++  exe "normal G\<C-V>gg\<C-W>\<C-X>OO\<Esc>"
++  bwipe!
++  bwipe!
++endfunc
++
++
+ " vim: shiftwidth=2 sts=2 expandtab
+diff -up vim82/src/window.c.cve0319 vim82/src/window.c
+--- vim82/src/window.c.cve0319	2022-02-08 13:24:54.137813879 +0100
++++ vim82/src/window.c	2022-02-08 13:24:54.171813211 +0100
+@@ -1697,6 +1697,11 @@ win_exchange(long Prenum)
+ 
+     (void)win_comp_pos();		// recompute window positions
+ 
++    if (wp->w_buffer != curbuf)
++	reset_VIsual_and_resel();
++    else if (VIsual_active)
++	wp->w_cursor = curwin->w_cursor;
++
+     win_enter(wp, TRUE);
+     redraw_all_later(NOT_VALID);
+ }
+@@ -5261,7 +5266,7 @@ frame_remove(frame_T *frp)
+ win_alloc_lines(win_T *wp)
+ {
+     wp->w_lines_valid = 0;
+-    wp->w_lines = ALLOC_CLEAR_MULT(wline_T, Rows );
++    wp->w_lines = ALLOC_CLEAR_MULT(wline_T, Rows);
+     if (wp->w_lines == NULL)
+ 	return FAIL;
+     return OK;

SOURCES/0001-patch-8.2.4214-illegal-memory-access-with-large-tabs.patch

@@ -1,12 +1,49 @@
-diff -up vim80/src/ex_getln.c.cve0359 vim80/src/ex_getln.c
---- vim80/src/ex_getln.c.cve0359	2022-01-27 16:55:41.386213891 +0100
-+++ vim80/src/ex_getln.c	2022-01-27 17:00:20.330960544 +0100
-@@ -300,7 +300,7 @@ getcmdline(
+From 85b6747abc15a7a81086db31289cf1b8b17e6cb1 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Tue, 25 Jan 2022 11:55:02 +0000
+Subject: [PATCH] patch 8.2.4214: illegal memory access with large 'tabstop' in
+ Ex mode
+
+Problem:    Illegal memory access with large 'tabstop' in Ex mode.
+Solution:   Allocate enough memory.
+---
+ src/ex_getln.c               |  2 +-
+ src/testdir/test_ex_mode.vim | 10 ++++++++++
+ src/version.c                |  2 ++
+ 3 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/src/ex_getln.c b/src/ex_getln.c
+index 5dc43d845..097b97eeb 100644
+--- a/src/ex_getln.c
++++ b/src/ex_getln.c
+@@ -1513,7 +1513,7 @@ init_ccline(int firstc, int indent)
      ccline.cmdindent = (firstc > 0 ? indent : 0);
  
-     /* alloc initial ccline.cmdbuff */
+     // alloc initial ccline.cmdbuff
 -    alloc_cmdbuff(exmode_active ? 250 : indent + 1);
 +    alloc_cmdbuff(indent + 50);
      if (ccline.cmdbuff == NULL)
- 	return NULL;			    /* out of memory */
+ 	return FAIL;
      ccline.cmdlen = ccline.cmdpos = 0;
+diff --git a/src/testdir/test_ex_mode.vim b/src/testdir/test_ex_mode.vim
+index 7031115fc..2642a16d2 100644
+--- a/src/testdir/test_ex_mode.vim
++++ b/src/testdir/test_ex_mode.vim
+@@ -241,4 +241,14 @@ func Test_ex_mode_count_overflow()
+   call delete('Xexmodescript')
+ endfunc
+ 
++func Test_ex_mode_large_indent()
++  new
++  set ts=500 ai
++  call setline(1, "\t")
++  exe "normal gQi\<CR>."
++  set ts=8 noai
++  bwipe!
++endfunc
++
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+2.34.1
+

SOURCES/0001-patch-8.2.4215-illegal-memory-access-when-copying-li.patch

@@ -1,7 +1,22 @@
-diff -up vim80/src/ex_cmds.c.cve0361 vim80/src/ex_cmds.c
---- vim80/src/ex_cmds.c.cve0361	2022-02-08 12:20:51.277666290 +0100
-+++ vim80/src/ex_cmds.c	2022-02-08 12:20:51.280666209 +0100
-@@ -983,6 +983,8 @@ ex_copy(linenr_T line1, linenr_T line2,
+From dc5490e2cbc8c16022a23b449b48c1bd0083f366 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Tue, 25 Jan 2022 13:52:53 +0000
+Subject: [PATCH] patch 8.2.4215: illegal memory access when copying lines in
+ Visual mode
+
+Problem:    Illegal memory access when copying lines in Visual mode.
+Solution:   Adjust the Visual position after copying lines.
+---
+ src/ex_cmds.c               |  2 ++
+ src/testdir/test_visual.vim | 11 +++++++++++
+ src/version.c               |  2 ++
+ 3 files changed, 15 insertions(+)
+
+diff --git a/src/ex_cmds.c b/src/ex_cmds.c
+index 95209985e..f5d93e664 100644
+--- a/src/ex_cmds.c
++++ b/src/ex_cmds.c
+@@ -866,6 +866,8 @@ ex_copy(linenr_T line1, linenr_T line2, linenr_T n)
      }
  
      appended_lines_mark(n, count);
@@ -10,14 +25,14 @@ diff -up vim80/src/ex_cmds.c.cve0361 vim80/src/ex_cmds.c
  
      msgmore((long)count);
  }
-diff -up vim80/src/testdir/test_visual.vim.cve0361 vim80/src/testdir/test_visual.vim
---- vim80/src/testdir/test_visual.vim.cve0361	2022-02-08 12:20:51.280666209 +0100
-+++ vim80/src/testdir/test_visual.vim	2022-02-08 12:21:44.530356814 +0100
-@@ -263,3 +263,17 @@ func Test_visual_block_append_invalid_ch
-   call assert_equal(['	-   let xxx', 'xxxxx   -ˆ', 'xxxxxxxx-xxx'], getline(1, 3))
+diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
+index 72f5388b9..9b322fd21 100644
+--- a/src/testdir/test_visual.vim
++++ b/src/testdir/test_visual.vim
+@@ -1328,5 +1328,16 @@ func Test_visual_exchange_windows()
    bwipe!
  endfunc
-+
+ 
 +" this was leaving the end of the Visual area beyond the end of a line
 +func Test_visual_ex_copy_line()
 +  new
@@ -29,5 +44,8 @@ diff -up vim80/src/testdir/test_visual.vim.cve0361 vim80/src/testdir/test_visual
 +  bwipe!
 +endfunc
 +
-+
-+" vim: shiftwidth=2 sts=2 expandtab
+ 
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+2.34.1
+

SOURCES/0001-patch-8.2.4217-illegal-memory-access-when-undo-makes.patch

@@ -0,0 +1,55 @@
+From 8d02ce1ed75d008c34a5c9aaa51b67cbb9d33baa Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Tue, 25 Jan 2022 18:24:00 +0000
+Subject: [PATCH] patch 8.2.4217: illegal memory access when undo makes Visual
+ area invalid
+
+Problem:    Illegal memory access when undo makes Visual area invalid.
+Solution:   Correct the Visual area after undo.
+---
+ src/testdir/test_visual.vim | 15 +++++++++++++++
+ src/undo.c                  |  2 ++
+ src/version.c               |  2 ++
+ 3 files changed, 19 insertions(+)
+
+diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
+index 9b322fd21..b2beda08d 100644
+--- a/src/testdir/test_visual.vim
++++ b/src/testdir/test_visual.vim
+@@ -1339,5 +1339,20 @@ func Test_visual_ex_copy_line()
+   bwipe!
+ endfunc
+ 
++" This was leaving the end of the Visual area beyond the end of a line.
++" Set 'undolevels' to start a new undo block.
++func Test_visual_undo_deletes_last_line()
++  new
++  call setline(1, ["aaa", "ccc", "dyd"])
++  set undolevels=100
++  exe "normal obbbbbbbbbxbb\<Esc>"
++  set undolevels=100
++  /y
++  exe "normal ggvjfxO"
++  undo
++  normal gNU
++  bwipe!
++endfunc
++
+ 
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/undo.c b/src/undo.c
+index 4d186d453..636144aef 100644
+--- a/src/undo.c
++++ b/src/undo.c
+@@ -3029,6 +3029,8 @@ u_undo_end(
+ 	}
+     }
+ #endif
++    if (VIsual_active)
++	check_pos(curbuf, &VIsual);
+ 
+     smsg_attr_keep(0, _("%ld %s; %s #%ld  %s"),
+ 	    u_oldcount < 0 ? -u_oldcount : u_oldcount,
+-- 
+2.34.1
+

SOURCES/0001-patch-8.2.4218-illegal-memory-access-with-bracketed-.patch

@@ -1,56 +1,22 @@
-commit ec45bc7682fd698d8d39f43732129c4d092355f3
-Author: Tomas Korbar <tkorbar@redhat.com>
-Date:   Wed Feb 2 16:30:11 2022 +0100
+From 806d037671e133bd28a7864248763f643967973a Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Tue, 25 Jan 2022 20:45:16 +0000
+Subject: [PATCH] patch 8.2.4218: illegal memory access with bracketed paste in
+ Ex mode
 
-    Fix illegal memory access with bracketed paste in Ex mode
+Problem:    Illegal memory access with bracketed paste in Ex mode.
+Solution:   Reserve space for the trailing NUL.
+---
+ src/edit.c                 | 3 ++-
+ src/testdir/test_paste.vim | 3 +++
+ src/version.c              | 2 ++
+ 3 files changed, 7 insertions(+), 1 deletion(-)
 
 diff --git a/src/edit.c b/src/edit.c
-index f29fbc7..57b8dce 100644
+index ee3caf0da..2b5301100 100644
 --- a/src/edit.c
 +++ b/src/edit.c
-@@ -9519,27 +9519,33 @@ bracketed_paste(paste_mode_T mode, int drop, garray_T *gap)
-     int		ret_char = -1;
-     int		save_allow_keys = allow_keys;
-     int		save_paste = p_paste;
--    int		save_ai = curbuf->b_p_ai;
- 
--    /* If the end code is too long we can't detect it, read everything. */
--    if (STRLEN(end) >= NUMBUFLEN)
-+    // If the end code is too long we can't detect it, read everything.
-+    if (end != NULL && STRLEN(end) >= NUMBUFLEN)
- 	end = NULL;
-     ++no_mapping;
-     allow_keys = 0;
--    p_paste = TRUE;
--    curbuf->b_p_ai = FALSE;
-+    if (!p_paste)
-+	// Also have the side effects of setting 'paste' to make it work much
-+	// faster.
-+	set_option_value((char_u *)"paste", TRUE, NULL, 0);
- 
-     for (;;)
-     {
- 	/* When the end is not defined read everything. */
- 	if (end == NULL && vpeekc() == NUL)
- 	    break;
--	c = plain_vgetc();
--#ifdef FEAT_MBYTE
-+	do
-+	    c = vgetc();
-+	while (c == K_IGNORE || c == K_VER_SCROLLBAR || c == K_HOR_SCROLLBAR);
-+	if (c == NUL || got_int || (ex_normal_busy > 0 && c == Ctrl_C))
-+	    // When CTRL-C was encountered the typeahead will be flushed and we
-+	    // won't get the end sequence.  Except when using ":normal".
-+	    break;
-+
- 	if (has_mbyte)
- 	    idx += (*mb_char2bytes)(c, buf + idx);
- 	else
--#endif
- 	    buf[idx++] = c;
- 	buf[idx] = NUL;
- 	if (end != NULL && STRNCMP(buf, end, idx) == 0)
-@@ -9557,7 +9563,8 @@ bracketed_paste(paste_mode_T mode, int drop, garray_T *gap)
+@@ -4452,7 +4452,8 @@ bracketed_paste(paste_mode_T mode, int drop, garray_T *gap)
  		    break;
  
  		case PASTE_EX:
@@ -60,26 +26,20 @@ index f29fbc7..57b8dce 100644
  		    {
  			mch_memmove((char *)gap->ga_data + gap->ga_len,
  							     buf, (size_t)idx);
-@@ -9582,11 +9589,9 @@ bracketed_paste(paste_mode_T mode, int drop, garray_T *gap)
- 		case PASTE_ONE_CHAR:
- 		    if (ret_char == -1)
- 		    {
--#ifdef FEAT_MBYTE
- 			if (has_mbyte)
- 			    ret_char = (*mb_ptr2char)(buf);
- 			else
--#endif
- 			    ret_char = buf[0];
- 		    }
- 		    break;
-@@ -9597,8 +9602,8 @@ bracketed_paste(paste_mode_T mode, int drop, garray_T *gap)
+diff --git a/src/testdir/test_paste.vim b/src/testdir/test_paste.vim
+index c94fe7c35..5b8d8a0e3 100644
+--- a/src/testdir/test_paste.vim
++++ b/src/testdir/test_paste.vim
+@@ -90,6 +90,9 @@ func Test_paste_ex_mode()
+   unlet! foo
+   call feedkeys("Qlet foo=\"\<Esc>[200~foo\<CR>bar\<Esc>[201~\"\<CR>vi\<CR>", 'xt')
+   call assert_equal("foo\rbar", foo)
++
++  " pasting more than 40 bytes
++  exe "norm Q\<PasteStart>0000000000000000000000000000000000000000000000000000000000000000000000\<C-C>"
+ endfunc
  
-     --no_mapping;
-     allow_keys = save_allow_keys;
--    p_paste = save_paste;
--    curbuf->b_p_ai = save_ai;
-+    if (!save_paste)
-+	set_option_value((char_u *)"paste", FALSE, NULL, 0);
- 
-     return ret_char;
- }
+ func Test_paste_onechar()
+-- 
+2.34.1
+

SOURCES/0001-patch-8.2.4245-retab-0-may-cause-illegal-memory-acce.patch

@@ -0,0 +1,95 @@
+diff -up vim82/src/indent.c.cve0417 vim82/src/indent.c
+--- vim82/src/indent.c.cve0417	2022-02-09 10:01:34.250009316 +0100
++++ vim82/src/indent.c	2022-02-09 10:02:54.802588536 +0100
+@@ -71,7 +71,7 @@ tabstop_set(char_u *var, int **array)
+ 	int n = atoi((char *)cp);
+ 
+ 	// Catch negative values, overflow and ridiculous big values.
+-	if (n < 0 || n > 9999)
++	if (n < 0 || n > TABSTOP_MAX)
+ 	{
+ 	    semsg(_(e_invarg2), cp);
+ 	    vim_free(*array);
+@@ -1595,7 +1595,7 @@ ex_retab(exarg_T *eap)
+ 	emsg(_(e_positive));
+ 	return;
+     }
+-    if (new_ts < 0 || new_ts > 9999)
++    if (new_ts < 0 || new_ts > TABSTOP_MAX)
+     {
+ 	semsg(_(e_invarg2), eap->arg);
+ 	return;
+diff -up vim82/src/option.c.cve0417 vim82/src/option.c
+--- vim82/src/option.c.cve0417	2022-02-09 10:01:34.196009598 +0100
++++ vim82/src/option.c	2022-02-09 10:28:10.398548161 +0100
+@@ -3640,6 +3640,11 @@ set_num_option(
+ 	errmsg = e_positive;
+ 	curbuf->b_p_ts = 8;
+     }
++    else if (curbuf->b_p_ts > TABSTOP_MAX)
++    {
++	errmsg = e_invarg;
++	curbuf->b_p_ts = 8;
++    }
+     if (p_tm < 0)
+     {
+ 	errmsg = e_positive;
+@@ -5830,7 +5835,7 @@ buf_copy_options(buf_T *buf, int flags)
+ 	    if (p_vsts && p_vsts != empty_option)
+ 		(void)tabstop_set(p_vsts, &buf->b_p_vsts_array);
+ 	    else
+-		buf->b_p_vsts_array = 0;
++		buf->b_p_vsts_array = NULL;
+ 	    buf->b_p_vsts_nopaste = p_vsts_nopaste
+ 				 ? vim_strsave(p_vsts_nopaste) : NULL;
+ #endif
+@@ -6649,9 +6654,7 @@ paste_option_changed(void)
+ 	    if (buf->b_p_vsts)
+ 		free_string_option(buf->b_p_vsts);
+ 	    buf->b_p_vsts = empty_option;
+-	    if (buf->b_p_vsts_array)
+-		vim_free(buf->b_p_vsts_array);
+-	    buf->b_p_vsts_array = 0;
++	    VIM_CLEAR(buf->b_p_vsts_array);
+ #endif
+ 	}
+ 
+@@ -6697,12 +6700,11 @@ paste_option_changed(void)
+ 		free_string_option(buf->b_p_vsts);
+ 	    buf->b_p_vsts = buf->b_p_vsts_nopaste
+ 			 ? vim_strsave(buf->b_p_vsts_nopaste) : empty_option;
+-	    if (buf->b_p_vsts_array)
+-		vim_free(buf->b_p_vsts_array);
++	    vim_free(buf->b_p_vsts_array);
+ 	    if (buf->b_p_vsts && buf->b_p_vsts != empty_option)
+ 		(void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
+ 	    else
+-		buf->b_p_vsts_array = 0;
++		buf->b_p_vsts_array = NULL;
+ #endif
+ 	}
+ 
+diff -up vim82/src/testdir/test_options.vim.cve0417 vim82/src/testdir/test_options.vim
+--- vim82/src/testdir/test_options.vim.cve0417	2021-03-22 10:02:42.000000000 +0100
++++ vim82/src/testdir/test_options.vim	2022-02-09 10:01:34.251009311 +0100
+@@ -362,6 +362,8 @@ func Test_set_errors()
+   call assert_fails('set shiftwidth=-1', 'E487:')
+   call assert_fails('set sidescroll=-1', 'E487:')
+   call assert_fails('set tabstop=-1', 'E487:')
++  call assert_fails('set tabstop=10000', 'E474:')
++  call assert_fails('set tabstop=5500000000', 'E474:')
+   call assert_fails('set textwidth=-1', 'E487:')
+   call assert_fails('set timeoutlen=-1', 'E487:')
+   call assert_fails('set updatecount=-1', 'E487:')
+diff -up vim82/src/vim.h.cve0417 vim82/src/vim.h
+--- vim82/src/vim.h.cve0417	2021-03-22 10:02:42.000000000 +0100
++++ vim82/src/vim.h	2022-02-09 10:01:34.252009306 +0100
+@@ -2032,6 +2032,8 @@ typedef int sock_T;
+ 
+ #define DICT_MAXNEST 100	// maximum nesting of lists and dicts
+ 
++#define TABSTOP_MAX 9999
++
+ #ifdef FEAT_CLIPBOARD
+ 
+ // VIM_ATOM_NAME is the older Vim-specific selection type for X11.  Still

SOURCES/0001-patch-8.2.4247-stack-corruption-when-looking-for-spe.patch

@@ -0,0 +1,75 @@
+diff --git a/src/spellsuggest.c b/src/spellsuggest.c
+index 3de9ff2..5462583 100644
+--- a/src/spellsuggest.c
++++ b/src/spellsuggest.c
+@@ -1200,7 +1200,7 @@ suggest_try_change(suginfo_T *su)
+ 
+ // Check the maximum score, if we go over it we won't try this change.
+ #define TRY_DEEPER(su, stack, depth, add) \
+-		(stack[depth].ts_score + (add) < su->su_maxscore)
++       (depth < MAXWLEN - 1 && stack[depth].ts_score + (add) < su->su_maxscore)
+ 
+ /*
+  * Try finding suggestions by adding/removing/swapping letters.
+@@ -1272,6 +1272,9 @@ suggest_trie_walk(
+     char_u	changename[MAXWLEN][80];
+ #endif
+     int		breakcheckcount = 1000;
++#ifdef FEAT_RELTIME
++    proftime_T	time_limit;
++#endif
+     int		compound_ok;
+ 
+     // Go through the whole case-fold tree, try changes at each node.
+@@ -1316,6 +1319,11 @@ suggest_trie_walk(
+ 	    sp->ts_state = STATE_START;
+ 	}
+     }
++#ifdef FEAT_RELTIME
++    // The loop may take an indefinite amount of time. Break out after five
++    // sectonds. TODO: add an option for the time limit.
++    profile_setlimit(5000, &time_limit);
++#endif
+ 
+     // Loop to find all suggestions.  At each round we either:
+     // - For the current state try one operation, advance "ts_curi",
+@@ -1350,7 +1358,8 @@ suggest_trie_walk(
+ 
+ 		// At end of a prefix or at start of prefixtree: check for
+ 		// following word.
+-		if (byts[arridx] == 0 || n == (int)STATE_NOPREFIX)
++		if (depth < MAXWLEN - 1
++			    && (byts[arridx] == 0 || n == (int)STATE_NOPREFIX))
+ 		{
+ 		    // Set su->su_badflags to the caps type at this position.
+ 		    // Use the caps type until here for the prefix itself.
+@@ -2644,6 +2653,10 @@ suggest_trie_walk(
+ 	    {
+ 		ui_breakcheck();
+ 		breakcheckcount = 1000;
++#ifdef FEAT_RELTIME
++		if (profile_passed_limit(&time_limit))
++		    got_int = TRUE;
++#endif
+ 	    }
+ 	}
+     }
+diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
+index a3a9621..35035a2 100644
+--- a/src/testdir/test_spell.vim
++++ b/src/testdir/test_spell.vim
+@@ -768,6 +768,14 @@ func Test_spell_long_word()
+   set nospell
+ endfunc
+ 
++func Test_spellsuggest_too_deep()
++  " This was incrementing "depth" over MAXWLEN.
++  new
++  norm s000G00ý000000000000
++  sil norm ..vzG................vvzG0     v z=
++  bwipe!
++endfunc
++
+ func LoadAffAndDic(aff_contents, dic_contents)
+   set enc=latin1
+   set spellfile=

SOURCES/0001-patch-8.2.4253-using-freed-memory-when-substitute-wi.patch

@@ -1,22 +1,15 @@
-commit c604f3ad4782fde770617ff688e1ceac0dc1bd7c
-Author: Tomas Korbar <tkorbar@redhat.com>
-Date:   Thu Feb 3 10:14:42 2022 +0100
-
-    Fix using freed memory when substitute with function call
-
-diff --git a/src/ex_cmds.c b/src/ex_cmds.c
-index e69fbd3..0788573 100644
---- a/src/ex_cmds.c
-+++ b/src/ex_cmds.c
-@@ -4767,6 +4767,7 @@ do_sub(exarg_T *eap)
-     int		save_do_all;		/* remember user specified 'g' flag */
-     int		save_do_ask;		/* remember user specified 'c' flag */
-     char_u	*pat = NULL, *sub = NULL;	/* init for GCC */
-+	char_u	*sub_copy = NULL;
+diff -up vim82/src/ex_cmds.c.cve0413 vim82/src/ex_cmds.c
+--- vim82/src/ex_cmds.c.cve0413	2022-02-10 08:09:27.644493218 +0100
++++ vim82/src/ex_cmds.c	2022-02-10 08:09:27.653493168 +0100
+@@ -3627,6 +3627,7 @@ ex_substitute(exarg_T *eap)
+     int		save_do_all;		// remember user specified 'g' flag
+     int		save_do_ask;		// remember user specified 'c' flag
+     char_u	*pat = NULL, *sub = NULL;	// init for GCC
++    char_u	*sub_copy = NULL;
      int		delimiter;
      int		sublen;
      int		got_quit = FALSE;
-@@ -5062,11 +5063,20 @@ do_sub(exarg_T *eap)
+@@ -3928,11 +3929,20 @@ ex_substitute(exarg_T *eap)
      sub_firstline = NULL;
  
      /*
@@ -38,14 +31,39 @@ index e69fbd3..0788573 100644
 +	sub_copy = sub;
 +    }
 +    else
- 	sub = regtilde(sub, p_magic);
+ 	sub = regtilde(sub, magic_isset());
  
      /*
-@@ -5825,6 +5835,7 @@ outofmem:
+@@ -4737,6 +4747,7 @@ outofmem:
  #endif
  
      vim_regfree(regmatch.regprog);
-+	vim_free(sub_copy);
++    vim_free(sub_copy);
  
-     /* Restore the flag values, they can be used for ":&&". */
+     // Restore the flag values, they can be used for ":&&".
      subflags.do_all = save_do_all;
+diff -up vim82/src/testdir/test_substitute.vim.cve0413 vim82/src/testdir/test_substitute.vim
+--- vim82/src/testdir/test_substitute.vim.cve0413	2022-02-10 08:09:27.654493162 +0100
++++ vim82/src/testdir/test_substitute.vim	2022-02-10 08:10:14.392230843 +0100
+@@ -926,4 +926,21 @@ func Test_substitute_multiline_submatch(
+   close!
+ endfunc
+ 
++" This was using "old_sub" after it was freed.
++func Test_using_old_sub()
++  set compatible maxfuncdepth=10
++  new
++  call setline(1, 'some text.')
++  func Repl()
++    ~
++    s/
++  endfunc
++  silent!  s/\%')/\=Repl()
++
++  delfunc Repl
++  bwipe!
++  set nocompatible
++endfunc
++
++
+ " vim: shiftwidth=2 sts=2 expandtab

SOURCES/0001-patch-8.2.4281-using-freed-memory-with-lopen-and-bwi.patch

@@ -0,0 +1,75 @@
+diff -up vim82/src/buffer.c.cve0443 vim82/src/buffer.c
+--- vim82/src/buffer.c.cve0443	2021-03-22 10:02:42.000000000 +0100
++++ vim82/src/buffer.c	2022-02-10 08:33:19.159488384 +0100
+@@ -1710,6 +1710,7 @@ set_curbuf(buf_T *buf, int action)
+ #endif
+     bufref_T	newbufref;
+     bufref_T	prevbufref;
++    int		valid;
+ 
+     setpcmark();
+     if ((cmdmod.cmod_flags & CMOD_KEEPALT) == 0)
+@@ -1763,13 +1764,19 @@ set_curbuf(buf_T *buf, int action)
+     // An autocommand may have deleted "buf", already entered it (e.g., when
+     // it did ":bunload") or aborted the script processing.
+     // If curwin->w_buffer is null, enter_buffer() will make it valid again
+-    if ((buf_valid(buf) && buf != curbuf
++    valid = buf_valid(buf);
++    if ((valid && buf != curbuf
+ #ifdef FEAT_EVAL
+ 		&& !aborting()
+ #endif
+ 	) || curwin->w_buffer == NULL)
+     {
+-	enter_buffer(buf);
++	// If the buffer is not valid but curwin->w_buffer is NULL we must
++	// enter some buffer.  Using the last one is hopefully OK.
++	if (!valid)
++	    enter_buffer(lastbuf);
++	else
++	    enter_buffer(buf);
+ #ifdef FEAT_SYN_HL
+ 	if (old_tw != curbuf->b_p_tw)
+ 	    check_colorcolumn(curwin);
+@@ -2286,8 +2293,7 @@ free_buf_options(
+     clear_string_option(&buf->b_p_vsts);
+     vim_free(buf->b_p_vsts_nopaste);
+     buf->b_p_vsts_nopaste = NULL;
+-    vim_free(buf->b_p_vsts_array);
+-    buf->b_p_vsts_array = NULL;
++    VIM_CLEAR(buf->b_p_vsts_array);
+     clear_string_option(&buf->b_p_vts);
+     VIM_CLEAR(buf->b_p_vts_array);
+ #endif
+diff -up vim82/src/testdir/test_quickfix.vim.cve0443 vim82/src/testdir/test_quickfix.vim
+--- vim82/src/testdir/test_quickfix.vim.cve0443	2021-03-22 10:02:42.000000000 +0100
++++ vim82/src/testdir/test_quickfix.vim	2022-02-10 08:34:10.288204457 +0100
+@@ -923,6 +923,7 @@ func Test_locationlist_curwin_was_closed
+   call assert_fails('lrewind', 'E924:')
+ 
+   augroup! testgroup
++  delfunc R
+ endfunc
+ 
+ func Test_locationlist_cross_tab_jump()
+@@ -5372,4 +5373,20 @@ func Test_vimgrep_noswapfile()
+   set swapfile
+ endfunc
+ 
++" Weird sequence of commands that caused entering a wiped-out buffer
++func Test_lopen_bwipe()
++  func R()
++    silent! tab lopen
++    e x
++    silent! lfile
++  endfunc
++
++  cal R()
++  cal R()
++  cal R()
++  bw!
++  delfunc R
++endfunc
++
++
+ " vim: shiftwidth=2 sts=2 expandtab

SOURCES/0001-patch-8.2.4327-may-end-up-with-no-current-buffer.patch

@@ -0,0 +1,110 @@
+From e3537aec2f8d6470010547af28dcbd83d41461b8 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Tue, 8 Feb 2022 15:05:20 +0000
+Subject: [PATCH] patch 8.2.4327: may end up with no current buffer
+
+Problem:    May end up with no current buffer.
+Solution:   When deleting the current buffer to not pick a quickfix buffer as
+            the new current buffer.
+---
+ src/buffer.c                  | 26 ++++++++++++++++++++++----
+ src/testdir/test_quickfix.vim | 25 +++++++++++++++++++++++++
+ src/version.c                 |  2 ++
+ 3 files changed, 49 insertions(+), 4 deletions(-)
+
+diff --git a/src/buffer.c b/src/buffer.c
+index 81bdb31ca..b3e2bc3f9 100644
+--- a/src/buffer.c
++++ b/src/buffer.c
+@@ -1430,8 +1430,14 @@ do_buffer_ext(
+ 		buf = buflist_findnr(curwin->w_jumplist[jumpidx].fmark.fnum);
+ 		if (buf != NULL)
+ 		{
+-		    if (buf == curbuf || !buf->b_p_bl)
+-			buf = NULL;	// skip current and unlisted bufs
++		    // Skip current and unlisted bufs.  Also skip a quickfix
++		    // buffer, it might be deleted soon.
++		    if (buf == curbuf || !buf->b_p_bl
++#if defined(FEAT_QUICKFIX)
++			    || bt_quickfix(buf)
++#endif
++			    )
++			buf = NULL;
+ 		    else if (buf->b_ml.ml_mfp == NULL)
+ 		    {
+ 			// skip unloaded buf, but may keep it for later
+@@ -1467,7 +1473,11 @@ do_buffer_ext(
+ 		    continue;
+ 		}
+ 		// in non-help buffer, try to skip help buffers, and vv
+-		if (buf->b_help == curbuf->b_help && buf->b_p_bl)
++		if (buf->b_help == curbuf->b_help && buf->b_p_bl
++#if defined(FEAT_QUICKFIX)
++			    && !bt_quickfix(buf)
++#endif
++			   )
+ 		{
+ 		    if (buf->b_ml.ml_mfp != NULL)   // found loaded buffer
+ 			break;
+@@ -1485,7 +1495,11 @@ do_buffer_ext(
+ 	if (buf == NULL)	// No loaded buffer, find listed one
+ 	{
+ 	    FOR_ALL_BUFFERS(buf)
+-		if (buf->b_p_bl && buf != curbuf)
++		if (buf->b_p_bl && buf != curbuf
++#if defined(FEAT_QUICKFIX)
++			    && !bt_quickfix(buf)
++#endif
++		       )
+ 		    break;
+ 	}
+ 	if (buf == NULL)	// Still no buffer, just take one
+@@ -1494,6 +1508,10 @@ do_buffer_ext(
+ 		buf = curbuf->b_next;
+ 	    else
+ 		buf = curbuf->b_prev;
++#if defined(FEAT_QUICKFIX)
++	    if (bt_quickfix(buf))
++		buf = NULL;
++#endif
+ 	}
+     }
+ 
+diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
+index 07fdb9644..adb0ea4fd 100644
+--- a/src/testdir/test_quickfix.vim
++++ b/src/testdir/test_quickfix.vim
+@@ -5851,5 +5851,30 @@ func Test_lopen_bwipe()
+   delfunc R
+ endfunc
+ 
++" Another sequence of commands that caused all buffers to be wiped out
++func Test_lopen_bwipe_all()
++  let lines =<< trim END
++    func R()
++      silent! tab lopen
++      e foo
++      silent! lfile
++    endfunc
++    cal R()
++    exe "norm \<C-W>\<C-V>0"
++    cal R()
++    bwipe
++
++    call writefile(['done'], 'Xresult')
++    qall!
++  END
++  call writefile(lines, 'Xscript')
++  if RunVim([], [], '-u NONE -n -X -Z -e -m -s -S Xscript')
++    call assert_equal(['done'], readfile('Xresult'))
++  endif
++
++  call delete('Xscript')
++  call delete('Xresult')
++endfunc
++
+ 
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+2.35.1
+

SOURCES/0001-patch-8.2.4359-crash-when-repeatedly-using-retab.patch

@@ -0,0 +1,61 @@
+diff --git a/src/errors.h b/src/errors.h
+index 3008020..3daf1a6 100644
+--- a/src/errors.h
++++ b/src/errors.h
+@@ -381,3 +381,5 @@ EXTERN char e_missing_end_block[]
+ 	INIT(= N_("E1171: Missing } after inline function"));
+ EXTERN char e_cannot_use_default_values_in_lambda[]
+ 	INIT(= N_("E1172: Cannot use default values in a lambda"));
++EXTERN char e_resulting_text_too_long[]
++	INIT(= N_("E1240: Resulting text too long"));
+diff --git a/src/indent.c b/src/indent.c
+index 4f909d0..77d8b0a 100644
+--- a/src/indent.c
++++ b/src/indent.c
+@@ -1696,6 +1696,11 @@ ex_retab(exarg_T *eap)
+ 	    if (ptr[col] == NUL)
+ 		break;
+ 	    vcol += chartabsize(ptr + col, (colnr_T)vcol);
++	    if (vcol >= MAXCOL)
++	    {
++		emsg(_(e_resulting_text_too_long));
++		break;
++	    }
+ 	    if (has_mbyte)
+ 		col += (*mb_ptr2len)(ptr + col);
+ 	    else
+diff --git a/src/testdir/test_retab.vim b/src/testdir/test_retab.vim
+index c7190aa..6133e8f 100644
+--- a/src/testdir/test_retab.vim
++++ b/src/testdir/test_retab.vim
+@@ -70,6 +70,8 @@ func Test_retab()
+   call assert_equal("    a       b        c    ",         Retab('!', 3))
+   call assert_equal("    a       b        c    ",         Retab('',  5))
+   call assert_equal("    a       b        c    ",         Retab('!', 5))
++
++  set tabstop& expandtab&
+ endfunc
+ 
+ func Test_retab_error()
+@@ -80,4 +82,21 @@ func Test_retab_error()
+   call assert_fails('ret 80000000000000000000', 'E475:')
+ endfunc
+ 
++func Test_retab_endless()
++  new
++  call setline(1, "\t0\t")
++  let caught = 'no'
++  try
++    while 1
++      set ts=4000
++      retab 4
++    endwhile
++  catch /E1240/
++    let caught = 'yes'
++  endtry
++  bwipe!
++  set tabstop&
++endfunc
++
++
+ " vim: shiftwidth=2 sts=2 expandtab

SOURCES/0001-patch-8.2.4397-crash-when-using-many-composing-chara.patch

@@ -0,0 +1,49 @@
+From 34f8117dec685ace52cd9e578e2729db278163fc Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Wed, 16 Feb 2022 12:16:19 +0000
+Subject: [PATCH] patch 8.2.4397: crash when using many composing characters in
+ error message
+
+Problem:    Crash when using many composing characters in error message.
+Solution:   Use mb_cptr2char_adv() instead of mb_ptr2char_adv().
+---
+ src/testdir/test_assert.vim | 8 ++++++++
+ src/testing.c               | 2 +-
+ src/version.c               | 2 ++
+ 3 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/src/testdir/test_assert.vim b/src/testdir/test_assert.vim
+index 8987f3f8d..27b2d73fb 100644
+--- a/src/testdir/test_assert.vim
++++ b/src/testdir/test_assert.vim
+@@ -53,6 +53,14 @@ func Test_assert_equal()
+   call assert_equal("\b\e\f\n\t\r\\\x01\x7f", 'x')
+   call assert_match('Expected ''\\b\\e\\f\\n\\t\\r\\\\\\x01\\x7f'' but got ''x''', v:errors[0])
+   call remove(v:errors, 0)
++
++  " many composing characters are handled properly
++  call setline(1, ' ')
++  norm 100gr݀
++  call assert_equal(1, getline(1))
++  call assert_match("Expected 1 but got '.* occurs 100 times]'", v:errors[0])
++  call remove(v:errors, 0)
++  bwipe!
+ endfunc
+ 
+ func Test_assert_equal_dict()
+diff --git a/src/testing.c b/src/testing.c
+index 448c01c1e..48ba14d2c 100644
+--- a/src/testing.c
++++ b/src/testing.c
+@@ -101,7 +101,7 @@ ga_concat_shorten_esc(garray_T *gap, char_u *str)
+     {
+ 	same_len = 1;
+ 	s = p;
+-	c = mb_ptr2char_adv(&s);
++	c = mb_cptr2char_adv(&s);
+ 	clen = s - p;
+ 	while (*s != NUL && c == mb_ptr2char(s))
+ 	{
+-- 
+2.35.1
+

SOURCES/0001-patch-8.2.4436-crash-with-weird-vartabstop-value.patch

@@ -0,0 +1,35 @@
+diff --git a/src/indent.c b/src/indent.c
+index 77d8b0a..9830685 100644
+--- a/src/indent.c
++++ b/src/indent.c
+@@ -1284,6 +1284,8 @@ change_indent(
+ 		new_cursor_col += (*mb_ptr2len)(ptr + new_cursor_col);
+ 	    else
+ 		++new_cursor_col;
++	    if (ptr[new_cursor_col] == NUL)
++		break;
+ 	    vcol += lbr_chartabsize(ptr, ptr + new_cursor_col, (colnr_T)vcol);
+ 	}
+ 	vcol = last_vcol;
+diff --git a/src/testdir/test_vartabs.vim b/src/testdir/test_vartabs.vim
+index 0ff1ea8..a613510 100644
+--- a/src/testdir/test_vartabs.vim
++++ b/src/testdir/test_vartabs.vim
+@@ -419,4 +419,17 @@ func Test_varsofttabstop()
+   close!
+ endfunc
+ 
++func Test_vartabstop_latin1()
++  let save_encoding = &encoding
++  new
++  set encoding=iso8859-1
++  set compatible linebreak list revins smarttab
++  set vartabstop=400
++  exe "norm i00\t\<C-D>"
++  bwipe!
++  let &encoding = save_encoding
++  set nocompatible linebreak& list& revins& smarttab& vartabstop&
++endfunc
++
++
+ " vim: shiftwidth=2 sts=2 expandtab

SOURCES/0001-patch-8.2.4563-z-in-Visual-mode-may-go-beyond-the-en.patch

@@ -0,0 +1,39 @@
+diff -up vim82/src/spellsuggest.c.cve0943 vim82/src/spellsuggest.c
+--- vim82/src/spellsuggest.c.cve0943	2022-03-28 20:48:07.079197805 +0200
++++ vim82/src/spellsuggest.c	2022-03-28 20:48:07.101197522 +0200
+@@ -501,6 +501,10 @@ spell_suggest(int count)
+ 	    curwin->w_cursor.col = VIsual.col;
+ 	++badlen;
+ 	end_visual_mode();
++	// make sure we don't include the NUL at the end of the line
++	line = ml_get_curline();
++	if (badlen > STRLEN(line) - curwin->w_cursor.col)
++	    badlen = STRLEN(line) - curwin->w_cursor.col;
+     }
+     // Find the start of the badly spelled word.
+     else if (spell_move_to(curwin, FORWARD, TRUE, TRUE, NULL) == 0
+diff -up vim82/src/testdir/test_spell.vim.cve0943 vim82/src/testdir/test_spell.vim
+--- vim82/src/testdir/test_spell.vim.cve0943	2022-03-28 20:48:07.102197509 +0200
++++ vim82/src/testdir/test_spell.vim	2022-03-28 20:49:05.038452974 +0200
+@@ -441,6 +441,21 @@ func Test_spellsuggest_expr_errors()
+   delfunc MySuggest3
+ endfunc
+ 
++func Test_spellsuggest_visual_end_of_line()
++  let enc_save = &encoding
++  set encoding=iso8859
++
++  " This was reading beyond the end of the line.
++  norm R00000000000
++  sil norm 0
++  sil! norm i00000)
++  sil! norm i00000)
++  call feedkeys("\<CR>")
++  norm z=
++
++  let &encoding = enc_save
++endfunc
++
+ func Test_spellinfo()
+   new
+   let runtime = substitute($VIMRUNTIME, '\\', '/', 'g')

SOURCES/0001-patch-8.2.4646-using-buffer-line-after-it-has-been-f.patch

@@ -1,22 +1,44 @@
-diff -up vim80/src/regexp.c.cve1154 vim80/src/regexp.c
---- vim80/src/regexp.c.cve1154	2022-04-09 12:01:30.054452927 +0200
-+++ vim80/src/regexp.c	2022-04-09 12:02:48.987999877 +0200
-@@ -4415,8 +4415,17 @@ regmatch(
+diff -up vim82/src/regexp_bt.c.cve1154 vim82/src/regexp_bt.c
+--- vim82/src/regexp_bt.c.cve1154	2022-04-25 15:22:28.367621755 +0200
++++ vim82/src/regexp_bt.c	2022-04-25 15:25:13.726340728 +0200
+@@ -3188,8 +3188,17 @@ regmatch(
  		int	mark = OPERAND(scan)[0];
  		int	cmp = OPERAND(scan)[1];
  		pos_T	*pos;
-+		size_t	col = REG_MULTI ? reginput - regline : 0;
++		size_t	col = REG_MULTI ? rex.input - rex.line : 0;
  
  		pos = getmark_buf(rex.reg_buf, mark, FALSE);
 +
 +		// Line may have been freed, get it again.
 +		if (REG_MULTI)
 +		{
-+		    regline = reg_getline(reglnum);
-+		    reginput = regline + col;
++		    rex.line = reg_getline(rex.lnum);
++		    rex.input = rex.line + col;
 +		}
 +
- 		if (pos == NULL		     /* mark doesn't exist */
- 			|| pos->lnum <= 0    /* mark isn't set in reg_buf */
- 			|| (pos->lnum == reglnum + rex.reg_firstlnum
-diff -up vim80/src/testdir/test_regexp_latin.vim.cve1154 vim80/src/testdir/test_regexp_latin.vim
+ 		if (pos == NULL		     // mark doesn't exist
+ 			|| pos->lnum <= 0    // mark isn't set in reg_buf
+ 			|| (pos->lnum == rex.lnum + rex.reg_firstlnum
+diff -up vim82/src/testdir/test_regexp_latin.vim.cve1154 vim82/src/testdir/test_regexp_latin.vim
+--- vim82/src/testdir/test_regexp_latin.vim.cve1154	2022-04-25 15:22:28.368621752 +0200
++++ vim82/src/testdir/test_regexp_latin.vim	2022-04-25 15:26:57.515227712 +0200
+@@ -954,4 +954,19 @@ func Test_using_visual_position()
+   bwipe!
+ endfunc
+ 
++func Test_using_mark_position()
++  " this was using freed memory
++  " new engine
++  new
++  norm O0
++  call assert_fails("s/\\%')", 'E486:')
++  bwipe!
++
++  " old engine
++  new
++  norm O0
++  call assert_fails("s/\\%#=1\\%')", 'E486:')
++  bwipe!
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab

SOURCES/0001-patch-8.2.4774-crash-when-using-a-number-for-lambda-.patch

@@ -0,0 +1,51 @@
+diff -up vim82/src/errors.h.cve1420 vim82/src/errors.h
+--- vim82/src/errors.h.cve1420	2022-04-25 16:01:03.559985019 +0200
++++ vim82/src/errors.h	2022-04-25 16:01:58.113332024 +0200
+@@ -383,3 +383,7 @@ EXTERN char e_cannot_use_default_values_
+ 	INIT(= N_("E1172: Cannot use default values in a lambda"));
+ EXTERN char e_resulting_text_too_long[]
+ 	INIT(= N_("E1240: Resulting text too long"));
++#ifdef FEAT_EVAL
++EXTERN char e_string_or_function_required_for_arrow_parens_expr[]
++	INIT(= N_("E1275: String or function required for ->(expr)"));
++#endif
+diff -up vim82/src/eval.c.cve1420 vim82/src/eval.c
+--- vim82/src/eval.c.cve1420	2022-04-25 16:01:03.560985007 +0200
++++ vim82/src/eval.c	2022-04-25 16:14:11.746600369 +0200
+@@ -3718,13 +3718,20 @@ eval_lambda(
+ 	if (**arg != ')')
+ 	{
+ 	    emsg(_(e_missing_close));
+-	    ret = FAIL;
++	    return FAIL;
++	}
++	if (rettv->v_type != VAR_STRING && rettv->v_type != VAR_FUNC
++					       && rettv->v_type != VAR_PARTIAL)
++	{
++	    emsg(_(e_string_or_function_required_for_arrow_parens_expr));
++	    return FAIL;
+ 	}
+ 	++*arg;
+     }
+     if (ret != OK)
+ 	return FAIL;
+-    else if (**arg != '(')
++
++    if (**arg != '(')
+     {
+ 	if (verbose)
+ 	{
+diff -up vim82/src/testdir/test_lambda.vim.cve1420 vim82/src/testdir/test_lambda.vim
+--- vim82/src/testdir/test_lambda.vim.cve1420	2022-04-25 16:01:03.560985007 +0200
++++ vim82/src/testdir/test_lambda.vim	2022-04-25 16:17:01.694886566 +0200
+@@ -64,6 +64,10 @@ function Test_lambda_fails()
+   call assert_fails('echo {a, a -> a + a}(1, 2)', 'E853:')
+   call assert_fails('echo {a, b -> a + b)}(1, 2)', 'E451:')
+   echo assert_fails('echo 10->{a -> a + 2}', 'E107:')
++  call assert_fails('eval 0->(3)()', "E1275:")
++  call assert_fails('eval 0->([3])()', "E1275:")
++  call assert_fails('eval 0->({"a": 3})()', "E1275:")
++  call assert_fails('eval 0->(xxx)()', "E121:")
+ endfunc
+ 
+ func Test_not_lamda()

SOURCES/0001-patch-8.2.4919-can-add-invalid-bytes-with-spellgood.patch

@@ -1,24 +1,18 @@
-diff --git a/src/globals.h b/src/globals.h
-index d5320d7..968ba33 100644
---- a/src/globals.h
-+++ b/src/globals.h
-@@ -1657,6 +1657,11 @@ EXTERN int *eval_lavars_used INIT(= NULL);
- EXTERN int ctrl_break_was_pressed INIT(= FALSE);
+diff -up vim82/src/errors.h.cve1621 vim82/src/errors.h
+--- vim82/src/errors.h.cve1621	2022-05-24 13:36:23.883370040 +0200
++++ vim82/src/errors.h	2022-05-24 13:36:47.665487703 +0200
+@@ -387,3 +387,7 @@ EXTERN char e_resulting_text_too_long[]
+ EXTERN char e_string_or_function_required_for_arrow_parens_expr[]
+ 	INIT(= N_("E1275: String or function required for ->(expr)"));
  #endif
- 
 +#ifdef FEAT_SPELL
 +EXTERN char e_illegal_character_in_word[]
 +	INIT(= N_("E1280: Illegal character in word"));
 +#endif
-+
- /*
-  * Optional Farsi support.  Include it here, so EXTERN and INIT are defined.
-  */
-diff --git a/src/mbyte.c b/src/mbyte.c
-index 6d21f11..a7531f1 100644
---- a/src/mbyte.c
-+++ b/src/mbyte.c
-@@ -4034,7 +4034,7 @@ theend:
+diff -up vim82/src/mbyte.c.cve1621 vim82/src/mbyte.c
+--- vim82/src/mbyte.c.cve1621	2021-03-22 10:02:42.000000000 +0100
++++ vim82/src/mbyte.c	2022-05-24 13:36:23.884370045 +0200
+@@ -4181,7 +4181,7 @@ theend:
      convert_setup(&vimconv, NULL, NULL);
  }
  
@@ -27,11 +21,10 @@ index 6d21f11..a7531f1 100644
  /*
   * Return TRUE if string "s" is a valid utf-8 string.
   * When "end" is NULL stop at the first NUL.
-diff --git a/src/spellfile.c b/src/spellfile.c
-index 496e07f..92997ef 100644
---- a/src/spellfile.c
-+++ b/src/spellfile.c
-@@ -4441,6 +4441,10 @@ store_word(
+diff -up vim82/src/spellfile.c.cve1621 vim82/src/spellfile.c
+--- vim82/src/spellfile.c.cve1621	2021-03-22 10:02:42.000000000 +0100
++++ vim82/src/spellfile.c	2022-05-24 13:36:23.885370049 +0200
+@@ -4391,6 +4391,10 @@ store_word(
      int		res = OK;
      char_u	*p;
  
@@ -42,16 +35,16 @@ index 496e07f..92997ef 100644
      (void)spell_casefold(word, len, foldword, MAXWLEN);
      for (p = pfxlist; res == OK; ++p)
      {
-@@ -6251,6 +6255,12 @@ spell_add_word(
+@@ -6191,6 +6195,12 @@ spell_add_word(
      int		i;
      char_u	*spf;
  
 +    if (enc_utf8 && !utf_valid_string(word, NULL))
 +    {
-+	EMSG(_(e_illegal_character_in_word));
++	emsg(_(e_illegal_character_in_word));
 +	return;
 +    }
 +
-     if (idx == 0)	    /* use internal wordlist */
+     if (idx == 0)	    // use internal wordlist
      {
  	if (int_wordlist == NULL)

SOURCES/0001-patch-8.2.4925-trailing-backslash-may-cause-reading-.patch

@@ -1,7 +1,22 @@
-diff -up vim80/src/search.c.cve1629 vim80/src/search.c
---- vim80/src/search.c.cve1629	2022-05-24 13:55:06.789859865 +0200
-+++ vim80/src/search.c	2022-05-24 13:56:31.889218958 +0200
-@@ -4349,7 +4349,11 @@ find_next_quote(
+From 53a70289c2712808e6d4e88927e03cac01b470dd Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Mon, 9 May 2022 13:15:07 +0100
+Subject: [PATCH] patch 8.2.4925: trailing backslash may cause reading past end
+ of line
+
+Problem:    Trailing backslash may cause reading past end of line.
+Solution:   Check for NUL after backslash.
+---
+ src/testdir/test_textobjects.vim | 10 +++++++++-
+ src/textobject.c                 |  4 ++++
+ src/version.c                    |  2 ++
+ 3 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/src/textobject.c b/src/textobject.c
+index e4a7db38e..edaa64c51 100644
+--- a/src/textobject.c
++++ b/src/textobject.c
+@@ -1664,7 +1664,11 @@ find_next_quote(
  	if (c == NUL)
  	    return -1;
  	else if (escape != NULL && vim_strchr(escape, c))
@@ -12,4 +27,7 @@ diff -up vim80/src/search.c.cve1629 vim80/src/search.c
 +	}
  	else if (c == quotechar)
  	    break;
- #ifdef FEAT_MBYTE
+ 	if (has_mbyte)
+-- 
+2.36.1
+

SOURCES/0001-patch-8.2.4977-memory-access-error-when-substitute-e.patch

@@ -1,48 +1,47 @@
-diff -up vim80/src/ex_cmds.c.cve1785 vim80/src/ex_cmds.c
---- vim80/src/ex_cmds.c.cve1785	2022-06-10 10:46:33.818286626 +0200
-+++ vim80/src/ex_cmds.c	2022-06-10 10:58:04.009515524 +0200
-@@ -5486,12 +5486,17 @@ do_sub(exarg_T *eap)
- 		/* Save flags for recursion.  They can change for e.g.
- 		 * :s/^/\=execute("s#^##gn") */
+diff -up vim82/src/ex_cmds.c.cve1785 vim82/src/ex_cmds.c
+--- vim82/src/ex_cmds.c.cve1785	2022-06-10 10:26:16.883312704 +0200
++++ vim82/src/ex_cmds.c	2022-06-10 10:26:16.910312568 +0200
+@@ -4356,12 +4356,17 @@ ex_substitute(exarg_T *eap)
+ 		// Save flags for recursion.  They can change for e.g.
+ 		// :s/^/\=execute("s#^##gn")
  		subflags_save = subflags;
 +
 +		// Disallow changing text or switching window in an expression.
-+		++textlock;
++		++textwinlock;
  #endif
- 		/* get length of substitution part */
+ 		// get length of substitution part
  		sublen = vim_regsub_multi(&regmatch,
  				    sub_firstlnum - regmatch.startpos[0].lnum,
- 				    sub, sub_firstline, FALSE, p_magic, TRUE);
+ 			       sub, sub_firstline, FALSE, magic_isset(), TRUE);
  #ifdef FEAT_EVAL
-+		--textlock;
++		--textwinlock;
 +
- 		/* Don't keep flags set by a recursive call. */
- 		subflags = subflags_save;
- 		if (subflags.do_count)
-@@ -5570,9 +5575,15 @@ do_sub(exarg_T *eap)
+ 		// If getting the substitute string caused an error, don't do
+ 		// the replacement.
+ 		// Don't keep flags set by a recursive call.
+@@ -4462,9 +4467,15 @@ ex_substitute(exarg_T *eap)
  		mch_memmove(new_end, sub_firstline + copycol, (size_t)copy_len);
  		new_end += copy_len;
  
 +#ifdef FEAT_EVAL
-+		++textlock;
++		++textwinlock;
 +#endif
  		(void)vim_regsub_multi(&regmatch,
  				    sub_firstlnum - regmatch.startpos[0].lnum,
- 					   sub, new_end, TRUE, p_magic, TRUE);
+ 				      sub, new_end, TRUE, magic_isset(), TRUE);
 +#ifdef FEAT_EVAL
-+		--textlock;
++		--textwinlock;
 +#endif
  		sub_nsubs++;
  		did_sub = TRUE;
  
-diff -up vim80/src/testdir/test_substitute.vim.cve1785 vim80/src/testdir/test_substitute.vim
---- vim80/src/testdir/test_substitute.vim.cve1785	2022-06-10 10:46:33.818286626 +0200
-+++ vim80/src/testdir/test_substitute.vim	2022-06-10 10:59:17.168437630 +0200
-@@ -500,3 +500,16 @@ func Test_sub_cmd_8()
-   enew!
-   set titlestring&
+diff -up vim82/src/testdir/test_substitute.vim.cve1785 vim82/src/testdir/test_substitute.vim
+--- vim82/src/testdir/test_substitute.vim.cve1785	2022-06-10 10:26:16.910312568 +0200
++++ vim82/src/testdir/test_substitute.vim	2022-06-10 10:27:02.166084629 +0200
+@@ -942,5 +942,18 @@ func Test_using_old_sub()
+   set nocompatible
  endfunc
-+
+ 
 +" This was switching windows in between computing the length and using it.
 +func Test_sub_change_window()
 +  silent! lfile
@@ -55,3 +54,6 @@ diff -up vim80/src/testdir/test_substitute.vim.cve1785 vim80/src/testdir/test_su
 +  bwipe!
 +  delfunc Repl
 +endfunc
++
+ 
+ " vim: shiftwidth=2 sts=2 expandtab

SOURCES/0001-patch-8.2.5023-substitute-overwrites-allocated-buffe.patch

@@ -1,7 +1,7 @@
-diff -up vim80/src/normal.c.cve1897 vim80/src/normal.c
---- vim80/src/normal.c.cve1897	2022-06-13 14:50:22.800290132 +0200
-+++ vim80/src/normal.c	2022-06-13 14:55:06.082861349 +0200
-@@ -532,6 +532,22 @@ find_command(int cmdchar)
+diff -up vim82/src/normal.c.cve1897 vim82/src/normal.c
+--- vim82/src/normal.c.cve1897	2022-06-13 09:31:42.880768567 +0200
++++ vim82/src/normal.c	2022-06-13 09:35:38.560084927 +0200
+@@ -479,6 +479,22 @@ find_command(int cmdchar)
  }
  
  /*
@@ -24,13 +24,13 @@ diff -up vim80/src/normal.c.cve1897 vim80/src/normal.c
   * Execute a command in Normal mode.
   */
      void
-@@ -792,14 +808,9 @@ getcount:
+@@ -742,14 +758,9 @@ getcount:
  	goto normal_end;
      }
  
 -    if (text_locked() && (nv_cmds[idx].cmd_flags & NV_NCW))
 -    {
--	/* This command is not allowed while editing a cmdline: beep. */
+-	// This command is not allowed while editing a cmdline: beep.
 -	clearopbeep(oap);
 -	text_locked_msg();
 -	goto normal_end;
@@ -42,7 +42,7 @@ diff -up vim80/src/normal.c.cve1897 vim80/src/normal.c
  	goto normal_end;
  
      /*
-@@ -6234,12 +6245,8 @@ nv_gotofile(cmdarg_T *cap)
+@@ -4212,12 +4223,8 @@ nv_gotofile(cmdarg_T *cap)
      char_u	*ptr;
      linenr_T	lnum = -1;
  
@@ -56,9 +56,9 @@ diff -up vim80/src/normal.c.cve1897 vim80/src/normal.c
      if (curbuf_locked())
      {
  	clearop(cap->oap);
-@@ -8420,14 +8427,7 @@ nv_g_cmd(cmdarg_T *cap)
+@@ -6343,14 +6350,7 @@ nv_g_cmd(cmdarg_T *cap)
  
-     /* "gQ": improved Ex mode */
+     // "gQ": improved Ex mode
      case 'Q':
 -	if (text_locked())
 -	{
@@ -72,14 +72,13 @@ diff -up vim80/src/normal.c.cve1897 vim80/src/normal.c
  	    do_exmode(TRUE);
  	break;
  
-diff -up vim80/src/testdir/test_substitute.vim.cve1897 vim80/src/testdir/test_substitute.vim
---- vim80/src/testdir/test_substitute.vim.cve1897	2022-06-13 14:50:22.849290402 +0200
-+++ vim80/src/testdir/test_substitute.vim	2022-06-13 14:55:50.370111134 +0200
-@@ -513,3 +513,26 @@ func Test_sub_change_window()
-   bwipe!
+diff -up vim82/src/testdir/test_substitute.vim.cve1897 vim82/src/testdir/test_substitute.vim
+--- vim82/src/testdir/test_substitute.vim.cve1897	2022-06-13 09:31:42.938768884 +0200
++++ vim82/src/testdir/test_substitute.vim	2022-06-13 09:36:39.013406036 +0200
+@@ -955,5 +955,27 @@ func Test_sub_change_window()
    delfunc Repl
  endfunc
-+
+ 
 +" This was undoign a change in between computing the length and using it.
 +func Do_Test_sub_undo_change()
 +  new
@@ -102,12 +101,14 @@ diff -up vim80/src/testdir/test_substitute.vim.cve1897 vim80/src/testdir/test_su
 +  delfunc Repl
 +endfunc
 +
-diff -up vim80/src/undo.c.cve1897 vim80/src/undo.c
---- vim80/src/undo.c.cve1897	2022-06-13 14:50:22.849290402 +0200
-+++ vim80/src/undo.c	2022-06-13 14:56:57.916492090 +0200
-@@ -2283,6 +2283,12 @@ undo_time(
-     if (curbuf->b_u_synced == FALSE)
- 	u_sync(TRUE);
+ 
+ " vim: shiftwidth=2 sts=2 expandtab
+diff -up vim82/src/undo.c.cve1897 vim82/src/undo.c
+--- vim82/src/undo.c.cve1897	2022-06-13 09:31:42.904768698 +0200
++++ vim82/src/undo.c	2022-06-13 09:31:42.938768884 +0200
+@@ -2323,6 +2323,12 @@ undo_time(
+     int		    above = FALSE;
+     int		    did_undo = TRUE;
  
 +    if (text_locked())
 +    {
@@ -115,6 +116,6 @@ diff -up vim80/src/undo.c.cve1897 vim80/src/undo.c
 +	return;
 +    }
 +
-     u_newcount = 0;
-     u_oldcount = 0;
-     if (curbuf->b_ml.ml_flags & ML_EMPTY)
+     // First make sure the current undoable change is synced.
+     if (curbuf->b_u_synced == FALSE)
+ 	u_sync(TRUE);

SOURCES/0001-patch-8.2.5037-cursor-position-may-be-invalid-after-.patch

@@ -1,85 +1,106 @@
-diff -up vim80/src/ex_docmd.c.cve1927 vim80/src/ex_docmd.c
---- vim80/src/ex_docmd.c.cve1927	2022-06-13 16:31:41.841068554 +0200
-+++ vim80/src/ex_docmd.c	2022-06-13 16:37:02.789876973 +0200
-@@ -1720,6 +1720,8 @@ do_one_cmd(
-     int			ni;			/* set when Not Implemented */
-     char_u		*cmd;
-     int			address_count = 1;
-+    int			need_check_cursor = FALSE;
-+    int			ret_addr = FAIL;
+diff -up vim82/src/ex_docmd.c.cve1927 vim82/src/ex_docmd.c
+--- vim82/src/ex_docmd.c.cve1927	2021-03-22 10:02:42.000000000 +0100
++++ vim82/src/ex_docmd.c	2022-06-13 15:29:45.099472751 +0200
+@@ -3081,6 +3081,8 @@ parse_cmd_address(exarg_T *eap, char **e
+ {
+     int		address_count = 1;
+     linenr_T	lnum;
++    int		need_check_cursor = FALSE;
++    int		ret = FAIL;
  
-     vim_memset(&ea, 0, sizeof(ea));
-     ea.line1 = 1;
-@@ -2084,7 +2086,7 @@ do_one_cmd(
- 	lnum = get_address(&ea, &ea.cmd, ea.addr_type, ea.skip,
- 					  ea.addr_count == 0, address_count++);
- 	if (ea.cmd == NULL)		    /* error detected */
--	    goto doend;
-+	    goto addr_end;
+     // Repeat for all ',' or ';' separated addresses.
+     for (;;)
+@@ -3091,7 +3093,7 @@ parse_cmd_address(exarg_T *eap, char **e
+ 	lnum = get_address(eap, &eap->cmd, eap->addr_type, eap->skip, silent,
+ 					eap->addr_count == 0, address_count++);
+ 	if (eap->cmd == NULL)	// error detected
+-	    return FAIL;
++	    goto theend;
  	if (lnum == MAXLNUM)
  	{
- 	    if (*ea.cmd == '%')		    /* '%' - all lines */
-@@ -2128,12 +2130,12 @@ do_one_cmd(
- 			    /* there is no Vim command which uses '%' and
- 			     * ADDR_WINDOWS or ADDR_TABS */
- 			    errormsg = (char_u *)_(e_invrange);
--			    goto doend;
-+			    goto addr_end;
+ 	    if (*eap->cmd == '%')   // '%' - all lines
+@@ -3136,14 +3138,14 @@ parse_cmd_address(exarg_T *eap, char **e
+ 			    // there is no Vim command which uses '%' and
+ 			    // ADDR_WINDOWS or ADDR_TABS
+ 			    *errormsg = _(e_invrange);
+-			    return FAIL;
++			    goto theend;
  			}
  			break;
  		    case ADDR_TABS_RELATIVE:
- 			errormsg = (char_u *)_(e_invrange);
--			goto doend;
-+			goto addr_end;
- 			break;
+ 		    case ADDR_UNSIGNED:
+ 		    case ADDR_QUICKFIX:
+ 			*errormsg = _(e_invrange);
+-			return FAIL;
++			goto theend;
  		    case ADDR_ARGUMENTS:
  			if (ARGCOUNT == 0)
-@@ -2163,7 +2165,7 @@ do_one_cmd(
- 		if (ea.addr_type != ADDR_LINES)
+ 			    eap->line1 = eap->line2 = 0;
+@@ -3175,7 +3177,7 @@ parse_cmd_address(exarg_T *eap, char **e
+ 		if (eap->addr_type != ADDR_LINES)
  		{
- 		    errormsg = (char_u *)_(e_invrange);
--		    goto doend;
-+		    goto addr_end;
+ 		    *errormsg = _(e_invrange);
+-		    return FAIL;
++		    goto theend;
  		}
  
- 		++ea.cmd;
-@@ -2171,11 +2173,11 @@ do_one_cmd(
+ 		++eap->cmd;
+@@ -3183,11 +3185,11 @@ parse_cmd_address(exarg_T *eap, char **e
  		{
  		    fp = getmark('<', FALSE);
  		    if (check_mark(fp) == FAIL)
--			goto doend;
-+			goto addr_end;
- 		    ea.line1 = fp->lnum;
+-			return FAIL;
++			goto theend;
+ 		    eap->line1 = fp->lnum;
  		    fp = getmark('>', FALSE);
  		    if (check_mark(fp) == FAIL)
--			goto doend;
-+			goto addr_end;
- 		    ea.line2 = fp->lnum;
- 		    ++ea.addr_count;
+-			return FAIL;
++			goto theend;
+ 		    eap->line2 = fp->lnum;
+ 		    ++eap->addr_count;
  		}
-@@ -2190,8 +2192,11 @@ do_one_cmd(
- 	    if (!ea.skip)
+@@ -3202,10 +3204,13 @@ parse_cmd_address(exarg_T *eap, char **e
+ 	    if (!eap->skip)
  	    {
- 		curwin->w_cursor.lnum = ea.line2;
+ 		curwin->w_cursor.lnum = eap->line2;
 +
- 		/* don't leave the cursor on an illegal line or column */
+ 		// Don't leave the cursor on an illegal line or column, but do
+ 		// accept zero as address, so 0;/PATTERN/ works correctly.
 +		// Check the cursor position before returning.
- 		check_cursor();
+ 		if (eap->line2 > 0)
+ 		    check_cursor();
 +		need_check_cursor = TRUE;
  	    }
  	}
- 	else if (*ea.cmd != ',')
-@@ -2208,6 +2213,13 @@ do_one_cmd(
- 	    ea.addr_count = 0;
+ 	else if (*eap->cmd != ',')
+@@ -3221,7 +3226,12 @@ parse_cmd_address(exarg_T *eap, char **e
+ 	if (lnum == MAXLNUM)
+ 	    eap->addr_count = 0;
      }
- 
-+    ret_addr = OK;
+-    return OK;
++    ret = OK;
 +
-+addr_end:
++theend:
 +    if (need_check_cursor)
 +	check_cursor();
-+    if (ret_addr == FAIL)
-+	goto doend;
++    return ret;
+ }
+ 
  /*
-  * 5. Parse the command.
-  */
+diff -up vim82/src/testdir/test_excmd.vim.cve1927 vim82/src/testdir/test_excmd.vim
+--- vim82/src/testdir/test_excmd.vim.cve1927	2022-06-13 15:26:53.941517542 +0200
++++ vim82/src/testdir/test_excmd.vim	2022-06-13 15:30:53.972860361 +0200
+@@ -536,4 +536,13 @@ func Test_sandbox()
+   sandbox call Sandbox_tests()
+ endfunc
+ 
++" This was leaving the cursor in line zero
++func Test_using_zero_in_range()
++  new
++  norm o00
++  silent!  0;s/\%')
++  bwipe!
++endfunc
++
++
+ " vim: shiftwidth=2 sts=2 expandtab

SOURCES/0001-patch-9.0.0339-no-check-if-the-return-value-of-XChan.patch

@@ -0,0 +1,38 @@
+From a63ad78ed31e36dbdf3a9cd28071dcdbefce7d19 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Wed, 31 Aug 2022 12:01:54 +0100
+Subject: [PATCH] patch 9.0.0339: no check if the return value of XChangeGC()
+ is NULL
+
+Problem:    No check if the return value of XChangeGC() is NULL.
+Solution:   Only use the return value when it is not NULL. (closes #11020)
+---
+ src/gui_x11.c | 10 +++++++---
+ src/version.c |  2 ++
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/src/gui_x11.c b/src/gui_x11.c
+index 6e3e903be..7293ac490 100644
+--- a/src/gui_x11.c
++++ b/src/gui_x11.c
+@@ -2231,10 +2231,14 @@ gui_x11_create_blank_mouse(void)
+ {
+     Pixmap blank_pixmap = XCreatePixmap(gui.dpy, gui.wid, 1, 1, 1);
+     GC gc = XCreateGC(gui.dpy, blank_pixmap, (unsigned long)0, (XGCValues*)0);
+-    XDrawPoint(gui.dpy, blank_pixmap, gc, 0, 0);
+-    XFreeGC(gui.dpy, gc);
++
++    if (gc != NULL)
++    {
++	XDrawPoint(gui.dpy, blank_pixmap, gc, 0, 0);
++	XFreeGC(gui.dpy, gc);
++    }
+     return XCreatePixmapCursor(gui.dpy, blank_pixmap, blank_pixmap,
+-	    (XColor*)&gui.norm_pixel, (XColor*)&gui.norm_pixel, 0, 0);
++		     (XColor*)&gui.norm_pixel, (XColor*)&gui.norm_pixel, 0, 0);
+ }
+ 
+ /*
+-- 
+2.39.1
+

SOURCES/spec-template

@@ -1,42 +0,0 @@
-Name:		
-Version:	
-Release:	1%{?dist}
-Summary:	
-
-Group:		
-License:	
-URL:		
-Source0:	
-BuildRoot:	%(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
-
-BuildRequires:	
-Requires:	
-
-%description
-
-
-%prep
-%setup -q
-
-
-%build
-%configure
-make %{?_smp_mflags}
-
-
-%install
-rm -rf $RPM_BUILD_ROOT
-make install DESTDIR=$RPM_BUILD_ROOT
-
-
-%clean
-rm -rf $RPM_BUILD_ROOT
-
-
-%files
-%defattr(-,root,root,-)
-%doc
-
-
-
-%changelog

SOURCES/spec-template.new

@@ -1,15 +1,20 @@
-Name:		
-Version:	
-Release:	1%{?dist}
-Summary:	
+# SPEC file overview:
+# https://docs.fedoraproject.org/en-US/quick-docs/creating-rpm-packages/#con_rpm-spec-file-overview
+# Fedora packaging guidelines:
+# https://docs.fedoraproject.org/en-US/packaging-guidelines/
 
-Group:		
-License:	
-URL:		
-Source0:	
 
-BuildRequires:	
-Requires:	
+Name:
+Version:
+Release: 0%{?dist}
+Summary:
+
+License:
+URL:
+Source0:
+
+BuildRequires:
+Requires:
 
 %description
 
@@ -29,6 +34,7 @@ make %{?_smp_mflags}
 
 %files
 %doc
+%license
 
 
 

SOURCES/vi_wrapper

@@ -0,0 +1,23 @@
+#!/usr/bin/sh
+
+# run vim if:
+# - 'vi' command is used and 'vim' binary is available
+# - 'vim' command is used
+# NOTE: Set up a local alias if you want vim -> vi functionality. We will not
+# do it globally, because it messes up with available startup options (see 
+# ':help starting', 'vi' is not capable of '-d'). The introducing an environment
+# variable, which an user must set to get the feature, will do the same trick
+# as setting an alias (needs user input, does not work with sudo), so it is left
+# on user whether he decides to use an alias:
+#
+# alias vim=vi
+#
+# in bashrc file.
+
+if test -f /usr/bin/vim
+then
+  exec /usr/bin/vim "$@"
+fi
+
+# run vi otherwise
+exec /usr/libexec/vi "$@"

SOURCES/view_wrapper

@@ -0,0 +1,10 @@
+#!/usr/bin/sh
+
+# run vim -R if available
+if test -f /usr/bin/vim
+then
+  exec /usr/bin/vim -R "$@"
+fi
+
+# run vi otherwise
+exec /usr/libexec/vi -R "$@"

SOURCES/vim-7.0-fixkeys.patch

@@ -1,9 +1,10 @@
---- vim70aa/src/term.c.orig	2006-03-01 23:07:55.000000000 +0100
-+++ vim70aa/src/term.c	2006-03-14 15:39:12.000000000 +0100
-@@ -1008,14 +1008,14 @@
-     {K_XRIGHT,		IF_EB("\033[1;*C", ESC_STR "[1;*C")},
-     {K_XLEFT,		IF_EB("\033[1;*D", ESC_STR "[1;*D")},
-     /* An extra set of function keys for vt100 mode */
+diff -up vim82/src/term.c.fixkeys vim82/src/term.c
+--- vim82/src/term.c.fixkeys	2021-01-08 10:12:59.191309539 +0100
++++ vim82/src/term.c	2021-01-08 10:18:05.410470981 +0100
+@@ -919,14 +919,14 @@ static struct builtin_term builtin_termc
+     {K_XRIGHT,		IF_EB("\033[@;*C", ESC_STR "[@;*C")},
+     {K_XLEFT,		IF_EB("\033[@;*D", ESC_STR "[@;*D")},
+     // An extra set of function keys for vt100 mode
 -    {K_XF1,		IF_EB("\033O*P", ESC_STR "O*P")},
 -    {K_XF2,		IF_EB("\033O*Q", ESC_STR "O*Q")},
 -    {K_XF3,		IF_EB("\033O*R", ESC_STR "O*R")},

SOURCES/vim-7.0-specedit.patch

@@ -1,64 +0,0 @@
---- vim70/runtime/ftplugin/spec.vim.rh1	2006-05-10 19:37:45.000000000 +0200
-+++ vim70/runtime/ftplugin/spec.vim	2006-11-13 12:21:32.000000000 +0100
-@@ -18,11 +18,18 @@
- 
- if !exists("*s:SpecChangelog")
- 	function s:SpecChangelog(format)
-+        let save_time = v:lc_time
- 		if strlen(a:format) == 0
- 			if !exists("g:spec_chglog_format")
--				let email = input("Email address: ")
--				let g:spec_chglog_format = "%a %b %d %Y " . l:email
--				echo "\r"
-+                if !exists("g:packager")
-+                    let email = input("Email address: ")
-+                    let g:spec_chglog_format = "%a %b %d %Y " . l:email
-+                    echo "\r"
-+                else
-+                    let email = g:packager
-+                    let g:spec_chglog_format = "%a %b %d %Y " . l:email
-+                    echo "\r"
-+                endif
- 			endif
- 			let format = g:spec_chglog_format
- 		else
-@@ -58,7 +65,7 @@
- 			let line = line+1
- 		endwhile
- 		if (nameline != -1 && verline != -1 && relline != -1)
--			let include_release_info = exists("g:spec_chglog_release_info")
-+			let include_release_info = 1
- 			let name = s:ParseRpmVars(name, nameline)
- 			let ver = s:ParseRpmVars(ver, verline)
- 			let rel = s:ParseRpmVars(rel, relline)
-@@ -79,8 +86,10 @@
- 			endif
- 		endif
- 		if (chgline != -1)
-+            execute "language time C"
- 			let parsed_format = "* ".strftime(format)
--			let release_info = "+ ".name."-".ver."-".rel
-+            execute "language time " . save_time
-+			let release_info = ver."-".rel
- 			let wrong_format = 0
- 			let wrong_release = 0
- 			let insert_line = 0
-@@ -97,15 +106,14 @@
- 						execute relline
- 						normal 

- 						let rel = substitute(strpart(getline(relline),8), '^[	 ]*\([^ 	]\+\)[		]*$','\1','')
--						let release_info = "+ ".name."-".ver."-".rel
-+						let release_info = ver."-".rel
- 					endif
- 				endif
- 				let n = 0
--				call append(chgline+n, parsed_format)
- 				if include_release_info
--					let n = n + 1
--					call append(chgline+n, release_info)
-+                    let parsed_format = parsed_format." ".release_info
- 				endif
-+				call append(chgline+n, parsed_format)
- 				let n = n + 1
- 				call append(chgline+n,"- ")
- 				let n = n + 1

SOURCES/vim-7.4-checkhl.patch

@@ -1,12 +0,0 @@
-diff -up vim74/runtime/syntax/spec.vim.kh1 vim74/runtime/syntax/spec.vim
---- vim74/runtime/syntax/spec.vim.kh1	2016-08-04 15:23:25.275955301 +0200
-+++ vim74/runtime/syntax/spec.vim	2016-08-04 15:24:56.699417602 +0200
-@@ -114,7 +114,7 @@ syn region specDescriptionArea matchgrou
- syn region specPackageArea matchgroup=specSection start='^%package' end='^%'me=e-1 contains=specPackageOpts,specPreAmble,specComment
- 
- "%% Scripts Section %%
--syn region specScriptArea matchgroup=specSection start='^%\(prep\|build\|install\|clean\|pre\|postun\|preun\|post\|posttrans\)\>' skip='^%{\|^%\(define\|patch\d*\|configure\|GNUconfigure\|setup\|autosetup\|autopatch\|find_lang\|make_build\|makeinstall\|make_install\)\>' end='^%'me=e-1 contains=specSpecialVariables,specVariables,@specCommands,specVariables,shDo,shFor,shCaseEsac,specNoNumberHilite,specCommandOpts,shComment,shIf,specSpecialChar,specMacroIdentifier,specSectionMacroArea,specSectionMacroBracketArea,shOperator,shQuote1,shQuote2
-+syn region specScriptArea matchgroup=specSection start='^%\(prep\|build\|install\|check\|clean\|pre\|postun\|preun\|post\|posttrans\)\>' skip='^%{\|^%\(define\|patch\d*\|configure\|GNUconfigure\|setup\|find_lang\|makeinstall\|make_install\)\>' end='^%'me=e-1 contains=specSpecialVariables,specVariables,@specCommands,specVariables,shDo,shFor,shCaseEsac,specNoNumberHilite,specCommandOpts,shComment,shIf,specSpecialChar,specMacroIdentifier,specSectionMacroArea,specSectionMacroBracketArea,shOperator,shQuote1,shQuote2
- 
- "%% Changelog Section %%
- syn region specChangelogArea matchgroup=specSection start='^%changelog' end='^%'me=e-1 contains=specEmail,specURL,specWeekday,specMonth,specNumber,specComment,specLicense

SOURCES/vim-7.4-fstabsyntax.patch

@@ -1,6 +1,6 @@
-diff -up vim80/runtime/syntax/fstab.vim.fstabsyntax vim80/runtime/syntax/fstab.vim
---- vim80/runtime/syntax/fstab.vim.fstabsyntax	2017-11-19 20:32:49.000000000 +0100
-+++ vim80/runtime/syntax/fstab.vim	2017-11-20 16:01:31.494316342 +0100
+diff -up vim82/runtime/syntax/fstab.vim.fstabsyntax vim82/runtime/syntax/fstab.vim
+--- vim82/runtime/syntax/fstab.vim.fstabsyntax	2020-08-10 12:08:01.000000000 +0200
++++ vim82/runtime/syntax/fstab.vim	2020-08-10 12:17:22.540855735 +0200
 @@ -56,7 +56,7 @@ syn keyword fsMountPointKeyword containe
  " Type
  syn cluster fsTypeCluster contains=fsTypeKeyword,fsTypeUnknown
@@ -14,8 +14,8 @@ diff -up vim80/runtime/syntax/fstab.vim.fstabsyntax vim80/runtime/syntax/fstab.v
  syn keyword fsOptionsYesNo yes no
  syn cluster fsOptionsCheckCluster contains=fsOptionsExt2Check,fsOptionsFatCheck
  syn keyword fsOptionsSize 512 1024 2048
--syn keyword fsOptionsGeneral async atime auto bind current defaults dev devgid devmode devmtime devuid dirsync exec force fstab kudzu loop mand move noatime noauto noclusterr noclusterw nodev nodevmtime nodiratime noexec nomand norelatime nosuid nosymfollow nouser owner rbind rdonly relatime remount ro rq rw suid suiddir supermount sw sync union update user users wxallowed xx
-+syn keyword fsOptionsGeneral async atime auto bind current defaults dev devgid devmode devmtime devuid dirsync exec force fstab kudzu loop managed mand move noatime noauto noclusterr noclusterw nodev nodevmtime nodiratime noexec nomand norelatime nosuid nosymfollow nouser owner pamconsole rbind rdonly relatime remount ro rq rw suid suiddir supermount sw sync union update user users wxallowed xx
+-syn keyword fsOptionsGeneral async atime auto bind current defaults dev devgid devmode devmtime devuid dirsync exec force fstab kudzu loop mand move noatime noauto noclusterr noclusterw nodev nodevmtime nodiratime noexec nomand norelatime nosuid nosymfollow nouser owner rbind rdonly relatime remount ro rq rw suid suiddir supermount sw sync union update user users wxallowed xx nofail failok
++syn keyword fsOptionsGeneral async atime auto bind current defaults dev devgid devmode devmtime devuid dirsync exec force fstab kudzu loop managed mand move noatime noauto noclusterr noclusterw nodev nodevmtime nodiratime noexec nomand norelatime nosuid nosymfollow nouser owner pamconsole rbind rdonly relatime remount ro rq rw suid suiddir supermount sw sync union update user users wxallowed xx nofail
  syn match fsOptionsGeneral /_netdev/
  
  " Options: adfs

SOURCES/vim-7.4-globalsyntax.patch

@@ -1,12 +1,13 @@
-diff -up vim74/runtime/syntax/spec.vim.orig vim74/runtime/syntax/spec.vim
---- vim74/runtime/syntax/spec.vim.orig	2016-01-12 13:51:55.727569873 +0100
-+++ vim74/runtime/syntax/spec.vim	2016-01-12 13:53:08.124991178 +0100
-@@ -114,7 +114,7 @@ syn region specDescriptionArea matchgrou
+diff --git a/runtime/syntax/spec.vim b/runtime/syntax/spec.vim
+index 1a5a108..b709d20 100644
+--- a/runtime/syntax/spec.vim
++++ b/runtime/syntax/spec.vim
+@@ -111,7 +111,7 @@ syn region specDescriptionArea matchgroup=specSection start='^%description' end=
  syn region specPackageArea matchgroup=specSection start='^%package' end='^%'me=e-1 contains=specPackageOpts,specPreAmble,specComment
  
  "%% Scripts Section %%
--syn region specScriptArea matchgroup=specSection start='^%\(prep\|build\|install\|check\|clean\|pre\|postun\|preun\|post\|posttrans\)\>' skip='^%{\|^%\(define\|patch\d*\|configure\|GNUconfigure\|setup\|find_lang\|makeinstall\|make_install\)\>' end='^%'me=e-1 contains=specSpecialVariables,specVariables,@specCommands,specVariables,shDo,shFor,shCaseEsac,specNoNumberHilite,specCommandOpts,shComment,shIf,specSpecialChar,specMacroIdentifier,specSectionMacroArea,specSectionMacroBracketArea,shOperator,shQuote1,shQuote2
-+syn region specScriptArea matchgroup=specSection start='^%\(prep\|build\|install\|check\|clean\|pre\|postun\|preun\|post\|posttrans\)\>' skip='^%{\|^%\(define\|global\|patch\d*\|configure\|GNUconfigure\|setup\|find_lang\|makeinstall\|make_install\)\>' end='^%'me=e-1 contains=specSpecialVariables,specVariables,@specCommands,specVariables,shDo,shFor,shCaseEsac,specNoNumberHilite,specCommandOpts,shComment,shIf,specSpecialChar,specMacroIdentifier,specSectionMacroArea,specSectionMacroBracketArea,shOperator,shQuote1,shQuote2
+-syn region specScriptArea matchgroup=specSection start='^%\(prep\|build\|install\|clean\|check\|pre\|postun\|preun\|post\|posttrans\)\>' skip='^%{\|^%\(define\|patch\d*\|configure\|GNUconfigure\|setup\|autosetup\|autopatch\|find_lang\|make_build\|makeinstall\|make_install\)\>' end='^%'me=e-1 contains=specSpecialVariables,specVariables,@specCommands,specVariables,shDo,shFor,shCaseEsac,specNoNumberHilite,specCommandOpts,shComment,shIf,specSpecialChar,specMacroIdentifier,specSectionMacroArea,specSectionMacroBracketArea,shOperator,shQuote1,shQuote2
++syn region specScriptArea matchgroup=specSection start='^%\(prep\|build\|install\|clean\|check\|pre\|postun\|preun\|post\|posttrans\)\>' skip='^%{\|^%\(define\|global\|patch\d*\|configure\|GNUconfigure\|setup\|autosetup\|autopatch\|find_lang\|make_build\|makeinstall\|make_install\)\>' end='^%'me=e-1 contains=specSpecialVariables,specVariables,@specCommands,specVariables,shDo,shFor,shCaseEsac,specNoNumberHilite,specCommandOpts,shComment,shIf,specSpecialChar,specMacroIdentifier,specSectionMacroArea,specSectionMacroBracketArea,shOperator,shQuote1,shQuote2
  
  "%% Changelog Section %%
  syn region specChangelogArea matchgroup=specSection start='^%changelog' end='^%'me=e-1 contains=specEmail,specURL,specWeekday,specMonth,specNumber,specComment,specLicense

SOURCES/vim-7.4-licensemacro-1151450.patch

@@ -1,15 +0,0 @@
-diff -up vim74_new/runtime/syntax/spec.vim.1151450 vim74_new/runtime/syntax/spec.vim
---- vim74_new/runtime/syntax/spec.vim.1151450	2014-10-13 10:45:07.570944538 +0200
-+++ vim74_new/runtime/syntax/spec.vim	2014-10-13 10:44:09.046945965 +0200
-@@ -88,9 +88,9 @@ syn region specSectionMacroBracketArea o
- "%% Files Section %%
- "TODO %config valid parameters: missingok\|noreplace
- "TODO %verify valid parameters: \(not\)\= \(md5\|atime\|...\)
--syn region specFilesArea matchgroup=specSection start='^%[Ff][Ii][Ll][Ee][Ss]\>' skip='%\(attrib\|defattr\|attr\|dir\|config\|docdir\|doc\|lang\|verify\|ghost\)\>' end='^%[a-zA-Z]'me=e-2 contains=specFilesOpts,specFilesDirective,@specListedFiles,specComment,specCommandSpecial,specMacroIdentifier
-+syn region specFilesArea matchgroup=specSection start='^%[Ff][Ii][Ll][Ee][Ss]\>' skip='%\(attrib\|defattr\|attr\|dir\|config\|docdir\|doc\|lang\|verify\|ghost\|license\)\>' end='^%[a-zA-Z]'me=e-2 contains=specFilesOpts,specFilesDirective,@specListedFiles,specComment,specCommandSpecial,specMacroIdentifier
- "tip: remember to include new itens in specFilesArea above
--syn match  specFilesDirective contained '%\(attrib\|defattr\|attr\|dir\|config\|docdir\|doc\|lang\|verify\|ghost\)\>'
-+syn match  specFilesDirective contained '%\(attrib\|defattr\|attr\|dir\|config\|docdir\|doc\|lang\|verify\|ghost\|license\)\>'
- 
- "valid options for certain section headers
- syn match specDescriptionOpts contained '\s-[ln]\s*\a'ms=s+1,me=e-1

SOURCES/vim-7.4-nowarnings.patch

@@ -1,11 +0,0 @@
-diff -up vim74/src/ex_docmd.c.e319 vim74/src/ex_docmd.c
---- vim74/src/ex_docmd.c.e319	2016-02-17 14:48:23.033995923 +0100
-+++ vim74/src/ex_docmd.c	2016-02-17 14:48:03.712890575 +0100
-@@ -4630,6 +4630,7 @@ get_flags(exarg_T *eap)
-     void
- ex_ni(exarg_T *eap)
- {
-+    return;
-     if (!eap->skip)
- 	eap->errmsg = (char_u *)N_("E319: Sorry, the command is not available in this version");
- }

SOURCES/vim-7.4-syncolor.patch

@@ -1,25 +0,0 @@
-diff -up vim80/src/syntax.c.syncolor vim80/src/syntax.c
---- vim80/src/syntax.c.syncolor	2017-08-15 12:14:21.716020676 +0200
-+++ vim80/src/syntax.c	2017-08-15 12:30:31.380158974 +0200
-@@ -6972,8 +6972,8 @@ static char *(highlight_init_light[]) =
-     CENT("Visual term=reverse",
- 	 "Visual term=reverse guibg=LightGrey"),
- #ifdef FEAT_DIFF
--    CENT("DiffAdd term=bold ctermbg=LightBlue",
--	 "DiffAdd term=bold ctermbg=LightBlue guibg=LightBlue"),
-+    CENT("DiffAdd term=bold ctermbg=LightRed",
-+         "DiffAdd term=bold ctermbg=LightRed guibg=LightBlue"),
-     CENT("DiffChange term=bold ctermbg=LightMagenta",
- 	 "DiffChange term=bold ctermbg=LightMagenta guibg=LightMagenta"),
-     CENT("DiffDelete term=bold ctermfg=Blue ctermbg=LightCyan",
-@@ -7066,8 +7066,8 @@ static char *(highlight_init_dark[]) = {
-     CENT("Visual term=reverse",
- 	 "Visual term=reverse guibg=DarkGrey"),
- #ifdef FEAT_DIFF
--    CENT("DiffAdd term=bold ctermbg=DarkBlue",
--	 "DiffAdd term=bold ctermbg=DarkBlue guibg=DarkBlue"),
-+    CENT("DiffAdd term=bold ctermbg=DarkRed",
-+	 "DiffAdd term=bold ctermbg=DarkRed guibg=DarkBlue"),
-     CENT("DiffChange term=bold ctermbg=DarkMagenta",
- 	 "DiffChange term=bold ctermbg=DarkMagenta guibg=DarkMagenta"),
-     CENT("DiffDelete term=bold ctermfg=Blue ctermbg=DarkCyan",

SOURCES/vim-7.4-syntax.patch

@@ -1,11 +1,43 @@
---- vim74/runtime/filetype.vim.orig	2013-08-12 14:51:58.669350813 +0200
-+++ vim74/runtime/filetype.vim	2013-08-12 14:56:12.432540523 +0200
-@@ -2475,7 +2475,7 @@
+From c669d497d34e4b57f40c19d58e3703401075a6d5 Mon Sep 17 00:00:00 2001
+From: Zdenek Dohnal <zdohnal@redhat.com>
+Date: Fri, 17 Sep 2021 07:54:56 +0200
+Subject: [PATCH] runtime/filetype.vim: Register more httpd files as apache
+ filetype
+
+Several files under /etc/httpd wasn't recognized as 'apache' filetype -
+add them to filetype.vim and add tests for checking if recognizition
+works.
+---
+ runtime/filetype.vim          | 2 +-
+ src/testdir/test_filetype.vim | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/runtime/filetype.vim b/runtime/filetype.vim
+index d0d40539d..39a772740 100644
+--- a/runtime/filetype.vim
++++ b/runtime/filetype.vim
+@@ -2138,7 +2138,7 @@ au BufNewFile,BufRead proftpd.conf*					call s:StarSetf('apachestyle')
  
  " More Apache config files
  au BufNewFile,BufRead access.conf*,apache.conf*,apache2.conf*,httpd.conf*,srm.conf*	call s:StarSetf('apache')
 -au BufNewFile,BufRead */etc/apache2/*.conf*,*/etc/apache2/conf.*/*,*/etc/apache2/mods-*/*,*/etc/apache2/sites-*/*,*/etc/httpd/conf.d/*.conf*		call s:StarSetf('apache')
-+au BufNewFile,BufRead */etc/apache2/*.conf*,*/etc/httpd/conf.*/*,*/etc/httpd/mods-*/*,*/etc/httpd/sites-*/*,*/etc/httpd/conf.d/*.conf*,auth_mysql.conf*,auth_pgsql.conf*,ssl.conf*,perl.conf*,php.conf*,python.conf*,squirrelmail.conf*		call s:StarSetf('apache')
++au BufNewFile,BufRead */etc/apache2/*.conf*,*/etc/apache2/conf.*/*,*/etc/apache2/mods-*/*,*/etc/apache2/sites-*/*,*/etc/httpd/conf.*/*,*/etc/httpd/mods-*/*,*/etc/httpd/sites-*/*,*/etc/httpd/conf.d/*.conf*		call s:StarSetf('apache')
  
  " Asterisk config file
  au BufNewFile,BufRead *asterisk/*.conf*		call s:StarSetf('asterisk')
+diff --git a/src/testdir/test_filetype.vim b/src/testdir/test_filetype.vim
+index cd6e71d1b..f1404808f 100644
+--- a/src/testdir/test_filetype.vim
++++ b/src/testdir/test_filetype.vim
+@@ -59,7 +59,7 @@ let s:filename_checks = {
+     \ 'aml': ['file.aml'],
+     \ 'ampl': ['file.run'],
+     \ 'ant': ['build.xml'],
+-    \ 'apache': ['.htaccess', '/etc/httpd/file.conf', '/etc/apache2/sites-2/file.com', '/etc/apache2/some.config', '/etc/apache2/conf.file/conf', '/etc/apache2/mods-some/file', '/etc/apache2/sites-some/file', '/etc/httpd/conf.d/file.config', '/etc/apache2/conf.file/file', '/etc/apache2/file.conf', '/etc/apache2/file.conf-file', '/etc/apache2/mods-file/file', '/etc/apache2/sites-file/file', '/etc/apache2/sites-file/file.com', '/etc/httpd/conf.d/file.conf', '/etc/httpd/conf.d/file.conf-file', 'access.conf', 'access.conf-file', 'any/etc/apache2/conf.file/file', 'any/etc/apache2/file.conf', 'any/etc/apache2/file.conf-file', 'any/etc/apache2/mods-file/file', 'any/etc/apache2/sites-file/file', 'any/etc/apache2/sites-file/file.com', 'any/etc/httpd/conf.d/file.conf', 'any/etc/httpd/conf.d/file.conf-file', 'any/etc/httpd/file.conf', 'apache.conf', 'apache.conf-file', 'apache2.conf', 'apache2.conf-file', 'httpd.conf', 'httpd.conf-file', 'srm.conf', 'srm.conf-file'],
++    \ 'apache': ['.htaccess', '/etc/httpd/file.conf', '/etc/apache2/sites-2/file.com', '/etc/apache2/some.config', '/etc/apache2/conf.file/conf', '/etc/apache2/mods-some/file', '/etc/apache2/sites-some/file', '/etc/httpd/conf.d/file.config', '/etc/apache2/conf.file/file', '/etc/apache2/file.conf', '/etc/apache2/file.conf-file', '/etc/apache2/mods-file/file', '/etc/apache2/sites-file/file', '/etc/apache2/sites-file/file.com', '/etc/httpd/conf.d/file.conf', '/etc/httpd/conf.d/file.conf-file', 'access.conf', 'access.conf-file', 'any/etc/apache2/conf.file/file', 'any/etc/apache2/file.conf', 'any/etc/apache2/file.conf-file', 'any/etc/apache2/mods-file/file', 'any/etc/apache2/sites-file/file', 'any/etc/apache2/sites-file/file.com', 'any/etc/httpd/conf.d/file.conf', 'any/etc/httpd/conf.d/file.conf-file', 'any/etc/httpd/file.conf', 'apache.conf', 'apache.conf-file', 'apache2.conf', 'apache2.conf-file', 'httpd.conf', 'httpd.conf-file', 'srm.conf', 'srm.conf-file', '/etc/httpd/mods-some/file', '/etc/httpd/sites-some/file', '/etc/httpd/conf.file/conf'],
+     \ 'apachestyle': ['/etc/proftpd/file.config,/etc/proftpd/conf.file/file', '/etc/proftpd/conf.file/file', '/etc/proftpd/file.conf', '/etc/proftpd/file.conf-file', 'any/etc/proftpd/conf.file/file', 'any/etc/proftpd/file.conf', 'any/etc/proftpd/file.conf-file', 'proftpd.conf', 'proftpd.conf-file'],
+     \ 'applescript': ['file.scpt'],
+     \ 'aptconf': ['apt.conf', '/.aptitude/config', 'any/.aptitude/config'],
+-- 
+2.31.1
+

SOURCES/vim-8.0-copy-paste.patch

@@ -1,16 +1,79 @@
-diff -up vim80/runtime/defaults.vim.copy-paste vim80/runtime/defaults.vim
---- vim80/runtime/defaults.vim.copy-paste	2016-12-19 09:01:20.351119199 +0100
-+++ vim80/runtime/defaults.vim	2016-12-19 09:01:53.735738941 +0100
-@@ -64,12 +64,6 @@ map Q gq
+diff --git a/runtime/defaults.vim b/runtime/defaults.vim
+index f3c639b..20637e2 100644
+--- a/runtime/defaults.vim
++++ b/runtime/defaults.vim
+@@ -73,18 +73,6 @@ map Q gq
  " Revert with ":iunmap <C-U>".
  inoremap <C-U> <C-G>u<C-U>
  
 -" In many terminal emulators the mouse works just fine.  By enabling it you
 -" can position the cursor, Visually select and scroll with the mouse.
+-" Only xterm can grab the mouse events when using the shift key, for other
+-" terminals use ":", select text and press Esc.
 -if has('mouse')
--  set mouse=a
+-  if &term =~ 'xterm'
+-    set mouse=a
+-  else
+-    set mouse=nvi
+-  endif
 -endif
 -
- " Switch syntax highlighting on when the terminal has colors or when using the
- " GUI (which always has colors).
- if &t_Co > 2 || has("gui_running")
+ " Only do this part when Vim was compiled with the +eval feature.
+ if 1
+ 
+diff --git a/src/testdir/test_balloon.vim b/src/testdir/test_balloon.vim
+index 319e546..8fcf63c 100644
+--- a/src/testdir/test_balloon.vim
++++ b/src/testdir/test_balloon.vim
+@@ -9,6 +9,7 @@ source screendump.vim
+ CheckScreendump
+ 
+ let s:common_script =<< trim [CODE]
++  set mouse=a
+   call setline(1, ["one one one", "two tXo two", "three three three"])
+   set balloonevalterm balloonexpr=MyBalloonExpr() balloondelay=100
+   func MyBalloonExpr()
+diff --git a/src/testdir/test_popupwin.vim b/src/testdir/test_popupwin.vim
+index f13252b..ec755a4 100644
+--- a/src/testdir/test_popupwin.vim
++++ b/src/testdir/test_popupwin.vim
+@@ -553,6 +553,7 @@ func Test_popup_drag()
+   " create a popup that covers the command line
+   let lines =<< trim END
+ 	call setline(1, range(1, 20))
++	set mouse=a
+ 	split
+ 	vsplit
+ 	$wincmd w
+@@ -599,6 +600,7 @@ func Test_popup_drag_termwin()
+   let lines =<< trim END
+ 	set foldmethod=marker
+ 	call setline(1, range(100))
++  set mouse=a
+ 	for nr in range(7)
+ 	  call setline(nr * 12 + 1, "fold {{{")
+ 	  call setline(nr * 12 + 11, "end }}}")
+@@ -652,6 +654,7 @@ func Test_popup_close_with_mouse()
+ 
+   let lines =<< trim END
+ 	call setline(1, range(1, 20))
++	set mouse=a
+ 	" With border, can click on X
+ 	let winid = popup_create('foobar', #{
+ 	      \ close: 'button',
+@@ -1479,6 +1482,7 @@ func Test_popup_beval()
+   let lines =<< trim END
+ 	call setline(1, range(1, 20))
+ 	call setline(5, 'here is some text to hover over')
++	set mouse=a
+ 	set balloonevalterm
+ 	set balloonexpr=BalloonExpr()
+ 	set balloondelay=100
+@@ -2170,6 +2174,7 @@ func Test_popup_scrollbar()
+ 
+   let lines =<< trim END
+     call setline(1, range(1, 20))
++    set mouse=a
+     hi ScrollThumb ctermbg=blue
+     hi ScrollBar ctermbg=red
+     let winid = popup_create(['one', 'two', 'three', 'four', 'five',

SOURCES/vim-covscan.patch

@@ -1,51 +0,0 @@
-diff --git a/src/ex_getln.c b/src/ex_getln.c
-index 9fdfac5..6451378 100644
---- a/src/ex_getln.c
-+++ b/src/ex_getln.c
-@@ -797,6 +797,7 @@ getcmdline(
- 			    redrawcmd();
- 			    goto cmdline_changed;
- 			}
-+			vim_free(p);
- 		    }
- 		}
- 		beep_flush();
-diff --git a/src/memline.c b/src/memline.c
-index 4be1036..366de4c 100644
---- a/src/memline.c
-+++ b/src/memline.c
-@@ -344,7 +344,7 @@ ml_open(buf_T *buf)
-     b0p->b0_magic_int = (int)B0_MAGIC_INT;
-     b0p->b0_magic_short = (short)B0_MAGIC_SHORT;
-     b0p->b0_magic_char = B0_MAGIC_CHAR;
--    STRNCPY(b0p->b0_version, "VIM ", 4);
-+    mch_memmove(b0p->b0_version, "VIM ", 4);
-     STRNCPY(b0p->b0_version + 4, Version, 6);
-     long_to_char((long)mfp->mf_page_size, b0p->b0_page_size);
- 
-diff --git a/src/move.c b/src/move.c
-index a560030..2ea3975 100644
---- a/src/move.c
-+++ b/src/move.c
-@@ -1939,7 +1939,7 @@ scroll_cursor_bot(int min_scroll, int set_topbot)
- 	    scrolled += loff.height;
- 	    if (loff.lnum == curwin->w_botline
- #ifdef FEAT_DIFF
--			    && boff.fill == 0
-+			    && loff.fill == 0
- #endif
- 		    )
- 		scrolled -= curwin->w_empty_rows;
-diff --git a/src/term.c b/src/term.c
-index 9ac824f..89b663a 100644
---- a/src/term.c
-+++ b/src/term.c
-@@ -1460,7 +1460,7 @@ parse_builtin_tcap(char_u *term)
- 			    if (term_7to8bit(t))
- 			    {
- 				*t = term_7to8bit(t);
--				STRCPY(t + 1, t + 2);
-+				STRMOVE(t + 1, t + 2);
- 			    }
- 			term_strings[p->bt_entry] = s;
- 			set_term_option_alloced(&term_strings[p->bt_entry]);

SOURCES/vim-crypto-warning.patch

@@ -1,11 +1,10 @@
-diff --git a/src/config.h.in b/src/config.h.in
-index 7d61220..ca0b1a8 100644
---- a/src/config.h.in
-+++ b/src/config.h.in
-@@ -478,3 +478,12 @@
+diff -up vim82/src/config.h.in.fips-warning vim82/src/config.h.in
+--- vim82/src/config.h.in.fips-warning	2021-03-01 12:20:20.887162181 +0100
++++ vim82/src/config.h.in	2021-03-01 12:20:42.520977438 +0100
+@@ -499,3 +499,12 @@
  
- /* Define to inline symbol or empty */
- #undef inline
+ /* Define if _SC_SIGSTKSZ is available via sysconf() */
+ #undef HAVE_SYSCONF_SIGSTKSZ
 +
 +/* Do we need FIPS warning? */
 +#undef HAVE_FIPS_WARNING
@@ -15,11 +14,10 @@ index 7d61220..ca0b1a8 100644
 +
 +/* Link to fips_enabled file */
 +#undef FIPS_ENABLED_FILE_LINK
-diff --git a/src/configure.ac b/src/configure.ac
-index 1e7d444..5e45762 100644
---- a/src/configure.ac
-+++ b/src/configure.ac
-@@ -525,6 +525,38 @@ else
+diff -up vim82/src/configure.ac.fips-warning vim82/src/configure.ac
+--- vim82/src/configure.ac.fips-warning	2021-03-01 12:20:20.885162198 +0100
++++ vim82/src/configure.ac	2021-03-01 12:20:20.888162173 +0100
+@@ -541,6 +541,38 @@ else
    AC_MSG_RESULT(yes)
  fi
  
@@ -58,13 +56,12 @@ index 1e7d444..5e45762 100644
  dnl Check for Lua feature.
  AC_MSG_CHECKING(--enable-luainterp argument)
  AC_ARG_ENABLE(luainterp,
-diff --git a/src/crypt.c b/src/crypt.c
-index dfbf02c..c935bc0 100644
---- a/src/crypt.c
-+++ b/src/crypt.c
-@@ -501,6 +501,21 @@ crypt_check_method(int method)
+diff -up vim82/src/crypt.c.fips-warning vim82/src/crypt.c
+--- vim82/src/crypt.c.fips-warning	2021-03-01 12:13:11.000000000 +0100
++++ vim82/src/crypt.c	2021-03-01 12:20:20.888162173 +0100
+@@ -523,6 +523,21 @@ crypt_check_method(int method)
  	msg_scroll = TRUE;
- 	MSG(_("Warning: Using a weak encryption method; see :help 'cm'"));
+ 	msg(_("Warning: Using a weak encryption method; see :help 'cm'"));
      }
 +#ifdef HAVE_FIPS_WARNING
 +    FILE *fips_enable_fd = fopen(FIPS_ENABLED_FILE_LINK, "r");
@@ -76,7 +73,7 @@ index dfbf02c..c935bc0 100644
 +    if ( access(SYSTEM_FIPS_FILE_LINK, F_OK) != -1 && enabled == '1')
 +    {
 +	msg_scroll = TRUE;
-+	MSG(_("Warning: This cryptography is not FIPS 140-2 compliant."));
++	msg(_("Warning: This cryptography is not FIPS 140-2 compliant."));
 +    }
 +
 +    fclose(fips_enable_fd);

SOURCES/vim-cve-var-retab.patch

@@ -0,0 +1,200 @@
+diff --git a/src/indent.c b/src/indent.c
+index e1c6f52..a002b4b 100644
+--- a/src/indent.c
++++ b/src/indent.c
+@@ -18,18 +18,19 @@
+ /*
+  * Set the integer values corresponding to the string setting of 'vartabstop'.
+  * "array" will be set, caller must free it if needed.
++ * Return FAIL for an error.
+  */
+     int
+ tabstop_set(char_u *var, int **array)
+ {
+-    int valcount = 1;
+-    int t;
+-    char_u *cp;
++    int	    valcount = 1;
++    int	    t;
++    char_u  *cp;
+ 
+     if (var[0] == NUL || (var[0] == '0' && var[1] == NUL))
+     {
+ 	*array = NULL;
+-	return TRUE;
++	return OK;
+     }
+ 
+     for (cp = var; *cp != NUL; ++cp)
+@@ -43,8 +44,8 @@ tabstop_set(char_u *var, int **array)
+ 		if (cp != end)
+ 		    emsg(_(e_positive));
+ 		else
+-		    emsg(_(e_invarg));
+-		return FALSE;
++		    semsg(_(e_invarg2), cp);
++		return FAIL;
+ 	    }
+ 	}
+ 
+@@ -55,26 +56,36 @@ tabstop_set(char_u *var, int **array)
+ 	    ++valcount;
+ 	    continue;
+ 	}
+-	emsg(_(e_invarg));
+-	return FALSE;
++	semsg(_(e_invarg2), var);
++	return FAIL;
+     }
+ 
+     *array = ALLOC_MULT(int, valcount + 1);
+     if (*array == NULL)
+-	return FALSE;
++	return FAIL;
+     (*array)[0] = valcount;
+ 
+     t = 1;
+     for (cp = var; *cp != NUL;)
+     {
+-	(*array)[t++] = atoi((char *)cp);
+-	while (*cp  != NUL && *cp != ',')
++	int n = atoi((char *)cp);
++
++	// Catch negative values, overflow and ridiculous big values.
++	if (n < 0 || n > 9999)
++	{
++	    semsg(_(e_invarg2), cp);
++	    vim_free(*array);
++	    *array = NULL;
++	    return FAIL;
++	}
++	(*array)[t++] = n;
++	while (*cp != NUL && *cp != ',')
+ 	    ++cp;
+ 	if (*cp != NUL)
+ 	    ++cp;
+     }
+ 
+-    return TRUE;
++    return OK;
+ }
+ 
+ /*
+@@ -1561,7 +1572,7 @@ ex_retab(exarg_T *eap)
+ 
+ #ifdef FEAT_VARTABS
+     new_ts_str = eap->arg;
+-    if (!tabstop_set(eap->arg, &new_vts_array))
++    if (tabstop_set(eap->arg, &new_vts_array) == FAIL)
+ 	return;
+     while (vim_isdigit(*(eap->arg)) || *(eap->arg) == ',')
+ 	++(eap->arg);
+@@ -1577,12 +1588,18 @@ ex_retab(exarg_T *eap)
+     else
+ 	new_ts_str = vim_strnsave(new_ts_str, eap->arg - new_ts_str);
+ #else
+-    new_ts = getdigits(&(eap->arg));
+-    if (new_ts < 0)
++    ptr = eap->arg;
++    new_ts = getdigits(&ptr);
++    if (new_ts < 0 && *eap->arg == '-')
+     {
+ 	emsg(_(e_positive));
+ 	return;
+     }
++    if (new_ts < 0 || new_ts > 9999)
++    {
++	semsg(_(e_invarg2), eap->arg);
++	return;
++    }
+     if (new_ts == 0)
+ 	new_ts = curbuf->b_p_ts;
+ #endif
+diff --git a/src/option.c b/src/option.c
+index b9d7edb..9a3b71e 100644
+--- a/src/option.c
++++ b/src/option.c
+@@ -2349,9 +2349,9 @@ didset_options2(void)
+ #endif
+ #ifdef FEAT_VARTABS
+     vim_free(curbuf->b_p_vsts_array);
+-    tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
++    (void)tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
+     vim_free(curbuf->b_p_vts_array);
+-    tabstop_set(curbuf->b_p_vts,  &curbuf->b_p_vts_array);
++    (void)tabstop_set(curbuf->b_p_vts,  &curbuf->b_p_vts_array);
+ #endif
+ }
+ 
+@@ -5828,7 +5828,7 @@ buf_copy_options(buf_T *buf, int flags)
+ 	    buf->b_p_vsts = vim_strsave(p_vsts);
+ 	    COPY_OPT_SCTX(buf, BV_VSTS);
+ 	    if (p_vsts && p_vsts != empty_option)
+-		tabstop_set(p_vsts, &buf->b_p_vsts_array);
++		(void)tabstop_set(p_vsts, &buf->b_p_vsts_array);
+ 	    else
+ 		buf->b_p_vsts_array = 0;
+ 	    buf->b_p_vsts_nopaste = p_vsts_nopaste
+@@ -5988,7 +5988,7 @@ buf_copy_options(buf_T *buf, int flags)
+ 		buf->b_p_isk = save_p_isk;
+ #ifdef FEAT_VARTABS
+ 		if (p_vts && p_vts != empty_option && !buf->b_p_vts_array)
+-		    tabstop_set(p_vts, &buf->b_p_vts_array);
++		    (void)tabstop_set(p_vts, &buf->b_p_vts_array);
+ 		else
+ 		    buf->b_p_vts_array = NULL;
+ #endif
+@@ -6003,7 +6003,7 @@ buf_copy_options(buf_T *buf, int flags)
+ 		buf->b_p_vts = vim_strsave(p_vts);
+ 		COPY_OPT_SCTX(buf, BV_VTS);
+ 		if (p_vts && p_vts != empty_option && !buf->b_p_vts_array)
+-		    tabstop_set(p_vts, &buf->b_p_vts_array);
++		    (void)tabstop_set(p_vts, &buf->b_p_vts_array);
+ 		else
+ 		    buf->b_p_vts_array = NULL;
+ #endif
+@@ -6700,7 +6700,7 @@ paste_option_changed(void)
+ 	    if (buf->b_p_vsts_array)
+ 		vim_free(buf->b_p_vsts_array);
+ 	    if (buf->b_p_vsts && buf->b_p_vsts != empty_option)
+-		tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
++		(void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
+ 	    else
+ 		buf->b_p_vsts_array = 0;
+ #endif
+diff --git a/src/optionstr.c b/src/optionstr.c
+index 521242d..db015e8 100644
+--- a/src/optionstr.c
++++ b/src/optionstr.c
+@@ -2215,7 +2215,7 @@ ambw_end:
+ 	    if (errmsg == NULL)
+ 	    {
+ 		int *oldarray = curbuf->b_p_vsts_array;
+-		if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)))
++		if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)) == OK)
+ 		{
+ 		    if (oldarray)
+ 			vim_free(oldarray);
+@@ -2254,7 +2254,7 @@ ambw_end:
+ 	    {
+ 		int *oldarray = curbuf->b_p_vts_array;
+ 
+-		if (tabstop_set(*varp, &(curbuf->b_p_vts_array)))
++		if (tabstop_set(*varp, &(curbuf->b_p_vts_array)) == OK)
+ 		{
+ 		    vim_free(oldarray);
+ #ifdef FEAT_FOLDING
+diff --git a/src/testdir/test_retab.vim b/src/testdir/test_retab.vim
+index b792da5..c7190aa 100644
+--- a/src/testdir/test_retab.vim
++++ b/src/testdir/test_retab.vim
+@@ -75,6 +75,9 @@ endfunc
+ func Test_retab_error()
+   call assert_fails('retab -1',  'E487:')
+   call assert_fails('retab! -1', 'E487:')
++  call assert_fails('ret -1000', 'E487:')
++  call assert_fails('ret 10000', 'E475:')
++  call assert_fails('ret 80000000000000000000', 'E475:')
+ endfunc
+ 
+ " vim: shiftwidth=2 sts=2 expandtab

SOURCES/vim-cve3778-fix.patch

@@ -1,13 +0,0 @@
-diff -up vim80/src/regexp_nfa.c.cve3796-fix vim80/src/regexp_nfa.c
---- vim80/src/regexp_nfa.c.cve3796-fix	2021-09-20 08:27:13.752604505 +0200
-+++ vim80/src/regexp_nfa.c	2021-09-20 08:29:10.206546910 +0200
-@@ -5493,7 +5493,8 @@ find_match_text(colnr_T startcol, int re
- 		match = FALSE;
- 		break;
- 	    }
--	    len2 += MB_CHAR2LEN(c2);
-+	    len2 += enc_utf8 ? utf_ptr2len(regline + col + len2)
-+							     : MB_CHAR2LEN(c2);
- 	}
- 	if (match
- #ifdef FEAT_MBYTE

SOURCES/vim-default-editor.csh

@@ -0,0 +1,5 @@
+# Ensure vim is set as EDITOR if it isn't already set
+
+if ( ! ($?EDITOR) ) then
+    setenv EDITOR "/usr/bin/vim"
+endif

SOURCES/vim-default-editor.fish

@@ -0,0 +1,8 @@
+# Ensure vim is set as EDITOR if it isn't already set
+# This is set as a universal variable so that any other definition
+# by the user would win
+# Cf. https://fishshell.com/docs/current/index.html#variables-scope
+
+if ! set -q EDITOR;
+    set -x EDITOR /usr/bin/vim
+end

SOURCES/vim-default-editor.sh

@@ -0,0 +1,5 @@
+# Ensure vim is set as EDITOR if it isn't already set
+
+if [ -z "$EDITOR" ]; then
+    export EDITOR="/usr/bin/vim"
+fi

SOURCES/vim-python3-tests.patch

@@ -1,16 +1,16 @@
-diff -up vim80/runtime/tools/demoserver.py.python3-tests vim80/runtime/tools/demoserver.py
---- vim80/runtime/tools/demoserver.py.python3-tests	2018-05-11 08:24:41.774618804 +0200
-+++ vim80/runtime/tools/demoserver.py	2018-05-11 09:24:48.363309856 +0200
+diff -up vim82/runtime/tools/demoserver.py.python-tests vim82/runtime/tools/demoserver.py
+--- vim82/runtime/tools/demoserver.py.python-tests	2019-07-26 07:58:50.000000000 +0200
++++ vim82/runtime/tools/demoserver.py	2020-04-17 06:18:06.748977527 +0200
 @@ -1,4 +1,4 @@
 -#!/usr/bin/python
 +#!/usr/bin/python3
  #
  # Server that will accept connections from a Vim channel.
  # Run this server and then in Vim you can open the channel:
-diff -up vim80/src/auto/configure.python3-tests vim80/src/auto/configure
---- vim80/src/auto/configure.python3-tests	2018-05-11 08:25:03.632420873 +0200
-+++ vim80/src/auto/configure	2018-05-11 09:25:26.062000471 +0200
-@@ -6396,7 +6396,7 @@ eof
+diff -up vim82/src/auto/configure.python-tests vim82/src/auto/configure
+--- vim82/src/auto/configure.python-tests	2020-04-17 06:07:48.000000000 +0200
++++ vim82/src/auto/configure	2020-04-17 06:18:06.750977509 +0200
+@@ -6418,7 +6418,7 @@ eof
  	    if test "x$MACOS_X" = "xyes" && test -n "${python_PYTHONFRAMEWORK}" && ${vi_cv_path_python} -c \
  		"import sys; sys.exit(${vi_cv_var_python_version} < 2.3)"; then
  	      vi_cv_path_python_plibs="-framework Python"
@@ -19,10 +19,10 @@ diff -up vim80/src/auto/configure.python3-tests vim80/src/auto/configure
  		  vi_cv_path_python_plibs="-F${python_PYTHONFRAMEWORKPREFIX} -framework Python"
  	      fi
  	    else
-diff -up vim80/src/configure.ac.python3-tests vim80/src/configure.ac
---- vim80/src/configure.ac.python3-tests	2018-05-11 08:25:26.070218957 +0200
-+++ vim80/src/configure.ac	2018-05-11 09:26:01.603708243 +0200
-@@ -1248,7 +1248,7 @@ eof
+diff -up vim82/src/configure.ac.python-tests vim82/src/configure.ac
+--- vim82/src/configure.ac.python-tests	2020-04-17 06:07:48.000000000 +0200
++++ vim82/src/configure.ac	2020-04-17 06:18:06.750977509 +0200
+@@ -1263,7 +1263,7 @@ eof
  	    if test "x$MACOS_X" = "xyes" && test -n "${python_PYTHONFRAMEWORK}" && ${vi_cv_path_python} -c \
  		"import sys; sys.exit(${vi_cv_var_python_version} < 2.3)"; then
  	      vi_cv_path_python_plibs="-framework Python"
@@ -31,54 +31,54 @@ diff -up vim80/src/configure.ac.python3-tests vim80/src/configure.ac
  		  vi_cv_path_python_plibs="-F${python_PYTHONFRAMEWORKPREFIX} -framework Python"
  	      fi
  	    else
-diff -up vim80/src/testdir/test_channel_pipe.py.python3-tests vim80/src/testdir/test_channel_pipe.py
---- vim80/src/testdir/test_channel_pipe.py.python3-tests	2018-05-11 09:23:05.738146018 +0200
-+++ vim80/src/testdir/test_channel_pipe.py	2018-05-11 09:26:37.354413350 +0200
+diff -up vim82/src/testdir/test_channel_pipe.py.python-tests vim82/src/testdir/test_channel_pipe.py
+--- vim82/src/testdir/test_channel_pipe.py.python-tests	2019-07-26 07:58:53.000000000 +0200
++++ vim82/src/testdir/test_channel_pipe.py	2020-04-17 06:18:06.751977500 +0200
 @@ -1,4 +1,4 @@
 -#!/usr/bin/python
 +#!/usr/bin/python3
  #
  # Server that will communicate over stdin/stderr
  #
-diff -up vim80/src/testdir/test_channel.py.python3-tests vim80/src/testdir/test_channel.py
---- vim80/src/testdir/test_channel.py.python3-tests	2018-05-11 09:22:48.522284266 +0200
-+++ vim80/src/testdir/test_channel.py	2018-05-11 09:26:17.762574955 +0200
+diff -up vim82/src/testdir/test_channel.py.python-tests vim82/src/testdir/test_channel.py
+--- vim82/src/testdir/test_channel.py.python-tests	2020-04-17 06:18:06.751977500 +0200
++++ vim82/src/testdir/test_channel.py	2020-04-17 06:18:24.517813082 +0200
 @@ -1,4 +1,4 @@
--#!/usr/bin/python
+-#!/usr/bin/env python
 +#!/usr/bin/python3
  #
  # Server that will accept connections from a Vim channel.
  # Used by test_channel.vim.
-diff -up vim80/src/testdir/test_channel_write.py.python3-tests vim80/src/testdir/test_channel_write.py
---- vim80/src/testdir/test_channel_write.py.python3-tests	2018-05-11 09:23:21.254021422 +0200
-+++ vim80/src/testdir/test_channel_write.py	2018-05-11 09:26:54.952268193 +0200
+diff -up vim82/src/testdir/test_channel_write.py.python-tests vim82/src/testdir/test_channel_write.py
+--- vim82/src/testdir/test_channel_write.py.python-tests	2019-07-26 07:58:53.000000000 +0200
++++ vim82/src/testdir/test_channel_write.py	2020-04-17 06:18:06.751977500 +0200
 @@ -1,4 +1,4 @@
 -#!/usr/bin/python
 +#!/usr/bin/python3
  #
  # Program that writes a number to stdout repeatedly
  #
-diff -up vim80/src/testdir/test_makeencoding.py.python3-tests vim80/src/testdir/test_makeencoding.py
---- vim80/src/testdir/test_makeencoding.py.python3-tests	2018-05-11 09:23:38.990878990 +0200
-+++ vim80/src/testdir/test_makeencoding.py	2018-05-11 09:27:14.402107759 +0200
+diff -up vim82/src/testdir/test_makeencoding.py.python-tests vim82/src/testdir/test_makeencoding.py
+--- vim82/src/testdir/test_makeencoding.py.python-tests	2019-07-26 07:58:53.000000000 +0200
++++ vim82/src/testdir/test_makeencoding.py	2020-04-17 06:18:06.751977500 +0200
 @@ -1,4 +1,4 @@
 -#!/usr/bin/python
 +#!/usr/bin/python3
  # -*- coding: utf-8 -*-
  
  # Test program for :make, :grep and :cgetfile.
-diff -up vim80/src/testdir/test_netbeans.py.python3-tests vim80/src/testdir/test_netbeans.py
---- vim80/src/testdir/test_netbeans.py.python3-tests	2018-05-11 09:23:54.398752732 +0200
-+++ vim80/src/testdir/test_netbeans.py	2018-05-11 09:27:30.489975057 +0200
+diff -up vim82/src/testdir/test_netbeans.py.python-tests vim82/src/testdir/test_netbeans.py
+--- vim82/src/testdir/test_netbeans.py.python-tests	2019-07-26 07:58:53.000000000 +0200
++++ vim82/src/testdir/test_netbeans.py	2020-04-17 06:18:06.751977500 +0200
 @@ -1,4 +1,4 @@
 -#!/usr/bin/python
 +#!/usr/bin/python3
  #
  # Server that will communicate with Vim through the netbeans interface.
  # Used by test_netbeans.vim.
-diff -up vim80/src/testdir/test_short_sleep.py.python3-tests vim80/src/testdir/test_short_sleep.py
---- vim80/src/testdir/test_short_sleep.py.python3-tests	2018-05-11 09:24:09.134631798 +0200
-+++ vim80/src/testdir/test_short_sleep.py	2018-05-11 09:27:48.432827053 +0200
+diff -up vim82/src/testdir/test_short_sleep.py.python-tests vim82/src/testdir/test_short_sleep.py
+--- vim82/src/testdir/test_short_sleep.py.python-tests	2019-07-26 07:58:53.000000000 +0200
++++ vim82/src/testdir/test_short_sleep.py	2020-04-17 06:18:06.751977500 +0200
 @@ -1,4 +1,4 @@
 -#!/usr/bin/python
 +#!/usr/bin/python3

SOURCES/vim.csh

@@ -1,6 +0,0 @@
-if ( -x /usr/bin/id ) then
-    if ( "`/usr/bin/id -u`" > 200 ) then
-        alias vi vim
-    endif
-endif
-

SOURCES/vim.sh

@@ -1,5 +0,0 @@
-if [ -n "${BASH_VERSION-}" -o -n "${KSH_VERSION-}" -o -n "${ZSH_VERSION-}" ]; then
-  [ "`/usr/bin/id -u 2>/dev/null || echo 0`" -le 200 ] && return
-  # for bash and zsh, only if no alias is already set
-  alias vi >/dev/null 2>&1 || alias vi=vim
-fi

SOURCES/vimrc

@@ -1,15 +1,51 @@
-if v:lang =~ "utf8$" || v:lang =~ "UTF-8$"
-   set fileencodings=ucs-bom,utf-8,latin1
+" When started as "evim", evim.vim will already have done these settings.
+if v:progname =~? "evim"
+  finish
 endif
 
-set nocompatible	" Use Vim defaults (much better!)
-set bs=indent,eol,start		" allow backspacing over everything in insert mode
+" Use Vim settings, rather than Vi settings (much better!).
+" This must be first, because it changes other options as a side effect.
+" Avoid side effects when it was already reset.
+if &compatible
+  set nocompatible
+endif
+
+" When the +eval feature is missing, the set command above will be skipped.
+" Use a trick to reset compatible only when the +eval feature is missing.
+silent! while 0
+  set nocompatible
+silent! endwhile
+
+" Allow backspacing over everything in insert mode.
+set backspace=indent,eol,start
+
 "set ai			" always set autoindenting on
 "set backup		" keep a backup file
 set viminfo='20,\"50	" read/write a .viminfo file, don't store more
 			" than 50 lines of registers
 set history=50		" keep 50 lines of command line history
 set ruler		" show the cursor position all the time
+set showcmd		" display incomplete commands
+set wildmenu		" display completion matches in a status line
+
+set ttimeout		" time out for key codes
+set ttimeoutlen=100	" wait up to 100ms after Esc for special key
+
+" Show @@@ in the last line if it is truncated.
+set display=truncate
+
+" Show a few lines of context around the cursor.  Note that this makes the
+" text scroll if you mouse-click near the start or end of the window.
+set scrolloff=5
+
+" Do incremental searching when it's possible to timeout.
+if has('reltime')
+  set incsearch
+endif
+
+" Do not recognize octal numbers for Ctrl-A and Ctrl-X, most users find it
+" confusing.
+set nrformats-=octal
 
 " Only do this part when compiled with support for autocommands
 if has("autocmd")
@@ -25,7 +61,10 @@ if has("autocmd")
   " don't write swapfile on most commonly used directories for NFS mounts or USB sticks
   autocmd BufNewFile,BufReadPre /media/*,/run/media/*,/mnt/* set directory=~/tmp,/var/tmp,/tmp
   " start with spec file template
-  autocmd BufNewFile *.spec 0r /usr/share/vim/vimfiles/template.spec
+  " 1724126 - do not open new file with .spec suffix with spec file template
+  " apparently there are other file types with .spec suffix, so disable the
+  " template
+  " autocmd BufNewFile *.spec 0r /usr/share/vim/vimfiles/template.spec
   augroup END
 endif
 
@@ -47,7 +86,12 @@ endif
 " Switch syntax highlighting on, when the terminal has colors
 " Also switch on highlighting the last used search pattern.
 if &t_Co > 2 || has("gui_running")
+  " Revert with ":syntax off".
   syntax on
+
+  " I like highlighting strings inside C comments.
+  " Revert with ":unlet c_comment_strings".
+  let c_comment_strings=1
   set hlsearch
 endif
 
@@ -59,6 +103,26 @@ if &term=="xterm"
      set t_Sf=[3%dm
 endif
 
+" Convenient command to see the difference between the current buffer and the
+" file it was loaded from, thus the changes you made.
+" Only define it when not defined already.
+" Revert with: ":delcommand DiffOrig".
+if !exists(":DiffOrig")
+  command DiffOrig vert new | set bt=nofile | r ++edit # | 0d_ | diffthis
+		  \ | wincmd p | diffthis
+endif
+
+if has('langmap') && exists('+langremap')
+  " Prevent that the langmap option applies to characters that result from a
+  " mapping.  If set (default), this may break plugins (but it's backward
+  " compatible).
+  set nolangremap
+endif
+
 " Don't wake up system with blinking cursor:
-" http://www.linuxpowertop.org/known.php
 let &guicursor = &guicursor . ",a:blinkon0"
+
+" Source a global configuration file if available
+if filereadable("/etc/vimrc.local")
+  source /etc/vimrc.local
+endif

SOURCES/virc

@@ -28,8 +28,6 @@ if has("autocmd")
 endif
 
 
-filetype plugin on
-
 if &term=="xterm"
      set t_Co=8
      set t_Sb=[4%dm