diff --git a/backport-CVE-2023-48231.patch b/backport-CVE-2023-48231.patch deleted file mode 100644 index dc98657868a87e9440bfe3f2f16c569f695b2d2a..0000000000000000000000000000000000000000 --- a/backport-CVE-2023-48231.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 25aabc2b8ee1e19ced6f4da9d866cf9378fc4c5a Mon Sep 17 00:00:00 2001 -From: Christian Brabandt -Date: Tue, 14 Nov 2023 19:31:34 +0100 -Subject: [PATCH] patch 9.0.2106: [security]: Use-after-free in win_close() - -Problem: [security]: Use-after-free in win_close() -Solution: Check window is valid, before accessing it - -If the current window structure is no longer valid (because a previous -autocommand has already freed this window), fail and return before -attempting to set win->w_closing variable. - -Add a test to trigger ASAN in CI - -Signed-off-by: Christian Brabandt ---- - src/window.c | 2 ++ - 1 files changed, 2 insertions(+) - -diff --git a/src/window.c b/src/window.c -index f77ede330d304..55ce31c886437 100644 ---- a/src/window.c -+++ b/src/window.c -@@ -2682,6 +2682,8 @@ win_close(win_T *win, int free_buf) - reset_VIsual_and_resel(); // stop Visual mode - - other_buffer = TRUE; -+ if (!win_valid(win)) -+ return FAIL; - win->w_closing = TRUE; - apply_autocmds(EVENT_BUFLEAVE, NULL, NULL, FALSE, curbuf); - if (!win_valid(win)) diff --git a/backport-CVE-2023-48232.patch b/backport-CVE-2023-48232.patch deleted file mode 100644 index 78eea59865dbbed699088db3ca1f3cfcbd2dfd60..0000000000000000000000000000000000000000 --- a/backport-CVE-2023-48232.patch +++ /dev/null @@ -1,63 +0,0 @@ -From cb0b99f0672d8446585d26e998343dceca17d1ce Mon Sep 17 00:00:00 2001 -From: Christian Brabandt -Date: Tue, 14 Nov 2023 20:05:59 +0100 -Subject: [PATCH] patch 9.0.2107: [security]: FPE in adjust_plines_for_skipcol - -Problem: [security]: FPE in adjust_plines_for_skipcol -Solution: don't divide by zero, return zero - -Prevent a floating point exception when calculating w_skipcol (which can -happen with a small window when the number option is set and cpo+=n). - -Add a test to verify - -Signed-off-by: Christian Brabandt ---- - src/move.c | 5 +++-- - src/testdir/test_scroll_opt.vim | 19 +++++++++++++++++++ - 2 files changed, 22 insertions(+), 2 deletions(-) - -diff --git a/src/move.c b/src/move.c -index ce06dc3394689..fbb352a32e15a 100644 ---- a/src/move.c -+++ b/src/move.c -@@ -45,8 +45,9 @@ adjust_plines_for_skipcol(win_T *wp) - return 0; - - int width = wp->w_width - win_col_off(wp); -- if (wp->w_skipcol >= width) -- return (wp->w_skipcol - width) / (width + win_col_off2(wp)) + 1; -+ int w2 = width + win_col_off2(wp); -+ if (wp->w_skipcol >= width && w2 > 0) -+ return (wp->w_skipcol - width) / w2 + 1; - - return 0; - } -diff --git a/src/testdir/test_scroll_opt.vim b/src/testdir/test_scroll_opt.vim -index d5d08a24c20d4..342d382c20a5a 100644 ---- a/src/testdir/test_scroll_opt.vim -+++ b/src/testdir/test_scroll_opt.vim -@@ -926,4 +926,23 @@ func Test_smoothscroll_cursor_top() - call StopVimInTerminal(buf) - endfunc - -+" Division by zero, shouldn't crash -+func Test_smoothscroll_crash() -+ CheckScreendump -+ -+ let lines =<< trim END -+ 20 new -+ vsp -+ put =repeat('aaaa', 20) -+ set nu fdc=1 smoothscroll cpo+=n -+ vert resize 0 -+ exe "norm! 0\" -+ END -+ call writefile(lines, 'XSmoothScrollCrash', 'D') -+ let buf = RunVimInTerminal('-u NONE -S XSmoothScrollCrash', #{rows: 12, cols:40}) -+ call term_sendkeys(buf, "2\\") -+ -+ call StopVimInTerminal(buf) -+endfunc -+ - " vim: shiftwidth=2 sts=2 expandtab diff --git a/backport-CVE-2023-48233.patch b/backport-CVE-2023-48233.patch deleted file mode 100644 index dc189eb0a3fae6b28918211abc011b30f1b10e0c..0000000000000000000000000000000000000000 --- a/backport-CVE-2023-48233.patch +++ /dev/null @@ -1,112 +0,0 @@ -From ac63787734fda2e294e477af52b3bd601517fa78 Mon Sep 17 00:00:00 2001 -From: Christian Brabandt -Date: Tue, 14 Nov 2023 20:45:48 +0100 -Subject: [PATCH] patch 9.0.2108: [security]: overflow with count for :s - command - -Problem: [security]: overflow with count for :s command -Solution: Abort the :s command if the count is too large - -If the count after the :s command is larger than what fits into a -(signed) long variable, abort with e_value_too_large. - -Adds a test with INT_MAX as count and verify it correctly fails. - -It seems the return value on Windows using mingw compiler wraps around, -so the initial test using :s/./b/9999999999999999999999999990 doesn't -fail there, since the count is wrapping around several times and finally -is no longer larger than 2147483647. So let's just use 2147483647 in the -test, which hopefully will always cause a failure - ---- - runtime/doc/change.txt | 8 ++++---- - runtime/doc/cmdline.txt | 3 ++- - runtime/doc/tags | 1 + - src/ex_cmds.c | 7 +++++++ - src/testdir/test_substitute.vim | 1 + - 5 files changed, 15 insertions(+), 5 deletions(-) - -diff --git a/runtime/doc/change.txt b/runtime/doc/change.txt -index 65da9a7..dccaa44 100644 ---- a/runtime/doc/change.txt -+++ b/runtime/doc/change.txt -@@ -1,4 +1,4 @@ --*change.txt* For Vim version 9.0. Last change: 2023 Sep 19 -+*change.txt* For Vim version 9.0. Last change: 2023 Nov 15 - - - VIM REFERENCE MANUAL by Bram Moolenaar -@@ -644,9 +644,9 @@ For other systems the tmpnam() library function is used. - current line only. When [count] is given, replace in - [count] lines, starting with the last line in [range]. - When [range] is omitted start in the current line. -- *E939* -- [count] must be a positive number. Also see -- |cmdline-ranges|. -+ *E939* *E1510* -+ [count] must be a positive number (max 2147483647) -+ Also see |cmdline-ranges|. - - See |:s_flags| for [flags]. - The delimiter doesn't need to be /, see -diff --git a/runtime/doc/cmdline.txt b/runtime/doc/cmdline.txt -index c5d0096..cbcf0ad 100644 ---- a/runtime/doc/cmdline.txt -+++ b/runtime/doc/cmdline.txt -@@ -1,4 +1,4 @@ --*cmdline.txt* For Vim version 9.0. Last change: 2023 May 20 -+*cmdline.txt* For Vim version 9.0. Last change: 2023 Nov 15 - - - VIM REFERENCE MANUAL by Bram Moolenaar -@@ -362,6 +362,7 @@ terminals) - A positive number represents the absolute index of an entry - as it is given in the first column of a :history listing. - This number remains fixed even if other entries are deleted. -+ (see |E1510|) - - A negative number means the relative position of an entry, - counted from the newest entry (which has index -1) backwards. -diff --git a/runtime/doc/tags b/runtime/doc/tags -index f450288..b5b2a97 100644 ---- a/runtime/doc/tags -+++ b/runtime/doc/tags -@@ -4514,6 +4514,7 @@ E1507 builtin.txt /*E1507* - E1508 editing.txt /*E1508* - E1509 editing.txt /*E1509* - E151 helphelp.txt /*E151* -+E1510 change.txt /*E1510* - E152 helphelp.txt /*E152* - E153 helphelp.txt /*E153* - E154 helphelp.txt /*E154* -diff --git a/src/ex_cmds.c b/src/ex_cmds.c -index 3544092..c5f912e 100644 ---- a/src/ex_cmds.c -+++ b/src/ex_cmds.c -@@ -3993,6 +3993,13 @@ ex_substitute(exarg_T *eap) - emsg(_(e_positive_count_required)); - return; - } -+ else if (i >= INT_MAX) -+ { -+ char buf[20]; -+ vim_snprintf(buf, sizeof(buf), "%ld", i); -+ semsg(_(e_val_too_large), buf); -+ return; -+ } - eap->line1 = eap->line2; - eap->line2 += i - 1; - if (eap->line2 > curbuf->b_ml.ml_line_count) -diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim -index b99d0e0..3ed1597 100644 ---- a/src/testdir/test_substitute.vim -+++ b/src/testdir/test_substitute.vim -@@ -206,6 +206,7 @@ func Test_substitute_count() - call assert_equal(['foo foo', 'foo foo', 'foo foo', 'bar foo', 'bar foo'], - \ getline(1, '$')) - -+ call assert_fails('s/./b/2147483647', 'E1510:') - bwipe! - endfunc - --- diff --git a/backport-CVE-2023-48234.patch b/backport-CVE-2023-48234.patch deleted file mode 100644 index 1aa3049f6ebd37d468bb49cbf8a4061b1fbdfcf5..0000000000000000000000000000000000000000 --- a/backport-CVE-2023-48234.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 58f9befca1fa172068effad7f2ea5a9d6a7b0cca Mon Sep 17 00:00:00 2001 -From: Christian Brabandt -Date: Tue, 14 Nov 2023 21:02:30 +0100 -Subject: [PATCH] patch 9.0.2109: [security]: overflow in nv_z_get_count - -Problem: [security]: overflow in nv_z_get_count -Solution: break out, if count is too large - -When getting the count for a normal z command, it may overflow for large -counts given. So verify, that we can safely store the result in a long. - -Signed-off-by: Christian Brabandt ---- - src/normal.c | 7 +++++++ - src/testdir/test_normal.vim | 5 +++++ - 2 files changed, 12 insertions(+) - -diff --git a/src/normal.c b/src/normal.c -index a06d61e6fce7d..16b4b45069329 100644 ---- a/src/normal.c -+++ b/src/normal.c -@@ -2562,7 +2562,14 @@ nv_z_get_count(cmdarg_T *cap, int *nchar_arg) - if (nchar == K_DEL || nchar == K_KDEL) - n /= 10; - else if (VIM_ISDIGIT(nchar)) -+ { -+ if (n > LONG_MAX / 10) -+ { -+ clearopbeep(cap->oap); -+ break; -+ } - n = n * 10 + (nchar - '0'); -+ } - else if (nchar == CAR) - { - #ifdef FEAT_GUI -diff --git a/src/testdir/test_normal.vim b/src/testdir/test_normal.vim -index c7d37f066f208..6b889f46b3dd7 100644 ---- a/src/testdir/test_normal.vim -+++ b/src/testdir/test_normal.vim -@@ -4159,4 +4159,9 @@ func Test_normal33_g_cmd_nonblank() - bw! - endfunc - -+func Test_normal34_zet_large() -+ " shouldn't cause overflow -+ norm! z9765405999999999999 -+endfunc -+ - " vim: shiftwidth=2 sts=2 expandtab diff --git a/backport-CVE-2023-48235.patch b/backport-CVE-2023-48235.patch deleted file mode 100644 index 0076e732e48bbcd0957468842d72c76b5b063201..0000000000000000000000000000000000000000 --- a/backport-CVE-2023-48235.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 060623e4a3bc72b011e7cd92bedb3bfb64e06200 Mon Sep 17 00:00:00 2001 -From: Christian Brabandt -Date: Tue, 14 Nov 2023 21:33:29 +0100 -Subject: [PATCH] patch 9.0.2110: [security]: overflow in ex address parsing - -Problem: [security]: overflow in ex address parsing -Solution: Verify that lnum is positive, before substracting from - LONG_MAX - -[security]: overflow in ex address parsing - -When parsing relative ex addresses one may unintentionally cause an -overflow (because LONG_MAX - lnum will overflow for negative addresses). - -So verify that lnum is actually positive before doing the overflow -check. - -Signed-off-by: Christian Brabandt ---- - src/ex_docmd.c | 2 +- - src/testdir/test_excmd.vim | 4 ++++ - 2 files changed, 5 insertions(+), 1 deletion(-) - -diff --git a/src/ex_docmd.c b/src/ex_docmd.c -index 06837ac92c55c..01d411a632ccf 100644 ---- a/src/ex_docmd.c -+++ b/src/ex_docmd.c -@@ -4644,7 +4644,7 @@ get_address( - lnum -= n; - else - { -- if (n >= LONG_MAX - lnum) -+ if (lnum >= 0 && n >= LONG_MAX - lnum) - { - emsg(_(e_line_number_out_of_range)); - goto error; -diff --git a/src/testdir/test_excmd.vim b/src/testdir/test_excmd.vim -index 3637351f636c0..47fc26726d5e6 100644 ---- a/src/testdir/test_excmd.vim -+++ b/src/testdir/test_excmd.vim -@@ -724,5 +724,9 @@ func Test_write_after_rename() - bwipe! - endfunc - -+" catch address lines overflow -+func Test_ex_address_range_overflow() -+ call assert_fails(':--+foobar', 'E492:') -+endfunc - - " vim: shiftwidth=2 sts=2 expandtab diff --git a/backport-CVE-2023-48236.patch b/backport-CVE-2023-48236.patch deleted file mode 100644 index 98728b3ce61f6a88c3ed264a69029c3b478c792d..0000000000000000000000000000000000000000 --- a/backport-CVE-2023-48236.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 73b2d3790cad5694fc0ed0db2926e4220c48d968 Mon Sep 17 00:00:00 2001 -From: Christian Brabandt -Date: Tue, 14 Nov 2023 21:58:26 +0100 -Subject: [PATCH] patch 9.0.2111: [security]: overflow in get_number - -Problem: [security]: overflow in get_number -Solution: Return 0 when the count gets too large - -[security]: overflow in get_number - -When using the z= command, we may overflow the count with values larger -than MAX_INT. So verify that we do not overflow and in case when an -overflow is detected, simply return 0 - -Signed-off-by: Christian Brabandt ---- - src/misc1.c | 2 ++ - src/testdir/test_spell.vim | 9 +++++++++ - 2 files changed, 11 insertions(+) - -diff --git a/src/misc1.c b/src/misc1.c -index 5b008c614a9bb..5f9828ebe9544 100644 ---- a/src/misc1.c -+++ b/src/misc1.c -@@ -975,6 +975,8 @@ get_number( - c = safe_vgetc(); - if (VIM_ISDIGIT(c)) - { -+ if (n > INT_MAX / 10) -+ return 0; - n = n * 10 + c - '0'; - msg_putchar(c); - ++typed; -diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim -index be0bc55810f0e..1ddcd83d5117e 100644 ---- a/src/testdir/test_spell.vim -+++ b/src/testdir/test_spell.vim -@@ -1077,6 +1077,15 @@ func Test_spell_compatible() - call StopVimInTerminal(buf) - endfunc - -+func Test_z_equal_with_large_count() -+ split -+ set spell -+ call setline(1, "ff") -+ norm 0z=337203685477580 -+ set nospell -+ bwipe! -+endfunc -+ - let g:test_data_aff1 = [ - \"SET ISO8859-1", - \"TRY esianrtolcdugmphbyfvkwjkqxz-\xEB\xE9\xE8\xEA\xEF\xEE\xE4\xE0\xE2\xF6\xFC\xFB'ESIANRTOLCDUGMPHBYFVKWJKQXZ", diff --git a/backport-CVE-2023-48237.patch b/backport-CVE-2023-48237.patch deleted file mode 100644 index a5cde61bf4fd59c2dbd5b529579308fba4619cd6..0000000000000000000000000000000000000000 --- a/backport-CVE-2023-48237.patch +++ /dev/null @@ -1,97 +0,0 @@ -From 6bf131888a3d1de62bbfa8a7ea03c0ddccfd496e Mon Sep 17 00:00:00 2001 -From: Christian Brabandt -Date: Tue, 14 Nov 2023 22:42:59 +0100 -Subject: [PATCH] patch 9.0.2112: [security]: overflow in shift_line - -Problem: [security]: overflow in shift_line -Solution: allow a max indent of INT_MAX - -[security]: overflow in shift_line - -When shifting lines in operator pending mode and using a very large -value, we may overflow the size of integer. Fix this by using a long -variable, testing if the result would be larger than INT_MAX and if so, -indent by INT_MAX value. - -Special case: We cannot use long here, since on 32bit architectures (or -on Windows?), it typically cannot take larger values than a plain int, -so we have to use long long count, decide whether the resulting -multiplication of the shiftwidth value * amount is larger than INT_MAX -and if so, we will store INT_MAX as possible larges value in the long -long count variable. - -Then we can safely cast it back to int when calling the functions to set -the indent (set_indent() or change_indent()). So this should be safe. - -Add a test that when using a huge value in operator pending mode for -shifting, we will shift by INT_MAX - -closes: #13535 - -Signed-off-by: Christian Brabandt ---- - src/ops.c | 15 ++++++++++----- - src/testdir/test_indent.vim | 11 +++++++++++ - 2 files changed, 21 insertions(+), 5 deletions(-) - -diff --git a/src/ops.c b/src/ops.c -index c0a2981d68770..ecd7fc2170c58 100644 ---- a/src/ops.c -+++ b/src/ops.c -@@ -229,11 +229,11 @@ shift_line( - int amount, - int call_changed_bytes) // call changed_bytes() - { -- int count; -+ long long count; - int i, j; - int sw_val = (int)get_sw_value_indent(curbuf); - -- count = get_indent(); // get current indent -+ count = (long long)get_indent(); // get current indent - - if (round) // round off indent - { -@@ -260,14 +260,19 @@ shift_line( - count = 0; - } - else -- count += sw_val * amount; -+ { -+ if ((long long)sw_val * (long long)amount > INT_MAX - count) -+ count = INT_MAX; -+ else -+ count += (long long)sw_val * (long long)amount; -+ } - } - - // Set new indent - if (State & VREPLACE_FLAG) -- change_indent(INDENT_SET, count, FALSE, NUL, call_changed_bytes); -+ change_indent(INDENT_SET, (int)count, FALSE, NUL, call_changed_bytes); - else -- (void)set_indent(count, call_changed_bytes ? SIN_CHANGED : 0); -+ (void)set_indent((int)count, call_changed_bytes ? SIN_CHANGED : 0); - } - - /* -diff --git a/src/testdir/test_indent.vim b/src/testdir/test_indent.vim -index 96e9d2300883c..217a7ae625072 100644 ---- a/src/testdir/test_indent.vim -+++ b/src/testdir/test_indent.vim -@@ -275,4 +275,15 @@ func Test_formatting_keeps_first_line_indent() - bwipe! - endfunc - -+" Test for indenting with large amount, causes overflow -+func Test_indent_overflow_count() -+ new -+ setl sw=8 -+ call setline(1, "abc") -+ norm! V2147483647> -+ " indents by INT_MAX -+ call assert_equal(2147483647, indent(1)) -+ close! -+endfunc -+ - " vim: shiftwidth=2 sts=2 expandtab diff --git a/backport-CVE-2023-48706.patch b/backport-CVE-2023-48706.patch deleted file mode 100644 index 86354d347f67a257676db5f0bc25923ba0a79b11..0000000000000000000000000000000000000000 --- a/backport-CVE-2023-48706.patch +++ /dev/null @@ -1,294 +0,0 @@ -From 26c11c56888d01e298cd8044caf860f3c26f57bb Mon Sep 17 00:00:00 2001 -From: Christian Brabandt -Date: Wed, 22 Nov 2023 21:26:41 +0100 -Subject: [PATCH] patch 9.0.2121: [security]: use-after-free in ex_substitute - -Problem: [security]: use-after-free in ex_substitute -Solution: always allocate memory - -closes: #13552 - -A recursive :substitute command could cause a heap-use-after free in Vim -(CVE-2023-48706). - -The whole reproducible test is a bit tricky, I can only reproduce this -reliably when no previous substitution command has been used yet -(which is the reason, the test needs to run as first one in the -test_substitute.vim file) and as a combination of the `:~` command -together with a :s command that contains the special substitution atom `~\=` -which will make use of a sub-replace special atom and calls a vim script -function. - -There was a comment in the existing :s code, that already makes the -`sub` variable allocate memory so that a recursive :s call won't be able -to cause any issues here, so this was known as a potential problem -already. But for the current test-case that one does not work, because -the substitution does not start with `\=` but with `~\=` (and since -there does not yet exist a previous substitution atom, Vim will simply -increment the `sub` pointer (which then was not allocated dynamically) -and later one happily use a sub-replace special expression (which could -then free the `sub` var). - -The following commit fixes this, by making the sub var always using -allocated memory, which also means we need to free the pointer whenever -we leave the function. Since sub is now always an allocated variable, -we also do no longer need the sub_copy variable anymore, since this one -was used to indicated when sub pointed to allocated memory (and had -therefore to be freed on exit) and when not. - -Github Security Advisory: -https://github.com/vim/vim/security/advisories/GHSA-c8qm-x72m-q53q - -Signed-off-by: Christian Brabandt ---- - src/ex_cmds.c | 50 ++++++++++++++++++++++++--------- - src/testdir/test_substitute.vim | 48 +++++++++++++++++++++++++++++-- - 2 files changed, 83 insertions(+), 15 deletions(-) - -diff --git a/src/ex_cmds.c b/src/ex_cmds.c -index c5f912e7ee57f..a08682b071fb5 100644 ---- a/src/ex_cmds.c -+++ b/src/ex_cmds.c -@@ -3737,13 +3737,13 @@ ex_substitute(exarg_T *eap) - int save_do_all; // remember user specified 'g' flag - int save_do_ask; // remember user specified 'c' flag - char_u *pat = NULL, *sub = NULL; // init for GCC -- char_u *sub_copy = NULL; - int delimiter; - int sublen; - int got_quit = FALSE; - int got_match = FALSE; - int which_pat; - char_u *cmd; -+ char_u *p; - int save_State; - linenr_T first_line = 0; // first changed line - linenr_T last_line= 0; // below last changed line AFTER the -@@ -3827,8 +3827,12 @@ ex_substitute(exarg_T *eap) - * Small incompatibility: vi sees '\n' as end of the command, but in - * Vim we want to use '\n' to find/substitute a NUL. - */ -- sub = cmd; // remember the start of the substitution -+ p = cmd; // remember the start of the substitution - cmd = skip_substitute(cmd, delimiter); -+ sub = vim_strsave(p); -+ if (sub == NULL) -+ // out of memory -+ return; - - if (!eap->skip) - { -@@ -3839,14 +3843,22 @@ ex_substitute(exarg_T *eap) - if (old_sub == NULL) // there is no previous command - { - emsg(_(e_no_previous_substitute_regular_expression)); -+ vim_free(sub); - return; - } -- sub = old_sub; -+ vim_free(sub); -+ sub = vim_strsave(old_sub); -+ if (sub == NULL) -+ // out of memory -+ return; - } - else - { - vim_free(old_sub); - old_sub = vim_strsave(sub); -+ if (old_sub == NULL) -+ // out of memory -+ return; - } - } - } -@@ -3858,7 +3870,7 @@ ex_substitute(exarg_T *eap) - return; - } - pat = NULL; // search_regcomp() will use previous pattern -- sub = old_sub; -+ sub = vim_strsave(old_sub); - - // Vi compatibility quirk: repeating with ":s" keeps the cursor in the - // last column after using "$". -@@ -3877,7 +3889,10 @@ ex_substitute(exarg_T *eap) - linenr_T joined_lines_count; - - if (eap->skip) -+ { -+ vim_free(sub); - return; -+ } - curwin->w_cursor.lnum = eap->line1; - if (*cmd == 'l') - eap->flags = EXFLAG_LIST; -@@ -3904,6 +3919,7 @@ ex_substitute(exarg_T *eap) - save_re_pat(RE_SUBST, pat, magic_isset()); - // put pattern in history - add_to_history(HIST_SEARCH, pat, TRUE, NUL); -+ vim_free(sub); - - return; - } -@@ -3991,6 +4007,7 @@ ex_substitute(exarg_T *eap) - if (i <= 0 && !eap->skip && subflags.do_error) - { - emsg(_(e_positive_count_required)); -+ vim_free(sub); - return; - } - else if (i >= INT_MAX) -@@ -3998,6 +4015,7 @@ ex_substitute(exarg_T *eap) - char buf[20]; - vim_snprintf(buf, sizeof(buf), "%ld", i); - semsg(_(e_val_too_large), buf); -+ vim_free(sub); - return; - } - eap->line1 = eap->line2; -@@ -4016,17 +4034,22 @@ ex_substitute(exarg_T *eap) - if (eap->nextcmd == NULL) - { - semsg(_(e_trailing_characters_str), cmd); -+ vim_free(sub); - return; - } - } - - if (eap->skip) // not executing commands, only parsing -+ { -+ vim_free(sub); - return; -+ } - - if (!subflags.do_count && !curbuf->b_p_ma) - { - // Substitution is not allowed in non-'modifiable' buffer - emsg(_(e_cannot_make_changes_modifiable_is_off)); -+ vim_free(sub); - return; - } - -@@ -4034,6 +4057,7 @@ ex_substitute(exarg_T *eap) - { - if (subflags.do_error) - emsg(_(e_invalid_command)); -+ vim_free(sub); - return; - } - -@@ -4054,20 +4078,20 @@ ex_substitute(exarg_T *eap) - */ - if (sub[0] == '\\' && sub[1] == '=') - { -- sub = vim_strsave(sub); -- if (sub == NULL) -+ p = vim_strsave(sub); -+ vim_free(sub); -+ if (p == NULL) - return; -- sub_copy = sub; -+ sub = p; - } - else - { -- char_u *newsub = regtilde(sub, magic_isset()); -+ p = regtilde(sub, magic_isset()); - -- if (newsub != sub) -+ if (p != sub) - { -- // newsub was allocated, free it later. -- sub_copy = newsub; -- sub = newsub; -+ vim_free(sub); -+ sub = p; - } - } - -@@ -4965,7 +4989,7 @@ ex_substitute(exarg_T *eap) - #endif - - vim_regfree(regmatch.regprog); -- vim_free(sub_copy); -+ vim_free(sub); - - // Restore the flag values, they can be used for ":&&". - subflags.do_all = save_do_all; -diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim -index 3ed159799f5cc..7c2bbb4767705 100644 ---- a/src/testdir/test_substitute.vim -+++ b/src/testdir/test_substitute.vim -@@ -4,6 +4,32 @@ source shared.vim - source check.vim - source screendump.vim - -+" NOTE: This needs to be the first test to be -+" run in the file, since it depends on -+" that the previous substitution atom -+" was not yet set. -+" -+" recursive call of :s and sub-replace special -+" (did cause heap-use-after free in < v9.0.2121) -+func Test_aaaa_substitute_expr_recursive_special() -+ func R() -+ " FIXME: leaving out the 'n' flag leaks memory, why? -+ %s/./\='.'/gn -+ endfunc -+ new Xfoobar_UAF -+ put ='abcdef' -+ let bufnr = bufnr('%') -+ try -+ silent! :s/./~\=R()/0 -+ "call assert_fails(':s/./~\=R()/0', 'E939:') -+ let @/='.' -+ ~g -+ catch /^Vim\%((\a\+)\)\=:E565:/ -+ endtry -+ delfunc R -+ exe bufnr .. "bw!" -+endfunc -+ - func Test_multiline_subst() - enew! - call append(0, ["1 aa", -@@ -147,7 +173,6 @@ func Test_substitute_repeat() - call feedkeys("Qsc\y", 'tx') - bwipe! - endfunc -- - " Test %s/\n// which is implemented as a special case to use a - " more efficient join rather than doing a regular substitution. - func Test_substitute_join() -@@ -1447,11 +1472,30 @@ func Test_substitute_expr_switch_win() - endfunc - new Xfoobar - let bufnr = bufnr('%') -- put ="abcdef" -+ put ='abcdef' - silent! s/\%')/\=R() - call assert_fails(':%s/./\=R()/g', 'E565:') - delfunc R - exe bufnr .. "bw!" - endfunc - -+" recursive call of :s using test-replace special -+func Test_substitute_expr_recursive() -+ func Q() -+ %s/./\='foobar'/gn -+ return "foobar" -+ endfunc -+ func R() -+ %s/./\=Q()/g -+ endfunc -+ new Xfoobar_UAF -+ let bufnr = bufnr('%') -+ put ='abcdef' -+ silent! s/./\=R()/g -+ call assert_fails(':%s/./\=R()/g', 'E565:') -+ delfunc R -+ delfunc Q -+ exe bufnr .. "bw!" -+endfunc -+ - " vim: shiftwidth=2 sts=2 expandtab diff --git a/backport-CVE-2024-22667.patch b/backport-CVE-2024-22667.patch deleted file mode 100644 index bde5c35719886f9e5b1693f94c9d4aad76578391..0000000000000000000000000000000000000000 --- a/backport-CVE-2024-22667.patch +++ /dev/null @@ -1,370 +0,0 @@ -From b39b240c386a5a29241415541f1c99e2e6b8ce47 Mon Sep 17 00:00:00 2001 -From: Christian Brabandt -Date: Wed, 29 Nov 2023 11:34:05 +0100 -Subject: [PATCH] patch 9.0.2142: [security]: stack-buffer-overflow in option - callback functions - -Problem: [security]: stack-buffer-overflow in option callback functions -Solution: pass size of errbuf down the call stack, use snprintf() - instead of sprintf() - -We pass the error buffer down to the option callback functions, but in -some parts of the code, we simply use sprintf(buf) to write into the error -buffer, which can overflow. - -So let's pass down the length of the error buffer and use sprintf(buf, size) -instead. - -Reported by @henices, thanks! - -Signed-off-by: Christian Brabandt ---- - src/map.c | 2 +- - src/option.c | 14 ++++--- - src/option.h | 2 + - src/optionstr.c | 59 +++++++++++++++++---------- - src/proto/optionstr.pro | 4 +- - src/structs.h | 2 + - 6 files changed, 52 insertions(+), 31 deletions(-) - -diff --git a/src/map.c b/src/map.c -index 5988445bd1588..98785e722ce53 100644 ---- a/src/map.c -+++ b/src/map.c -@@ -3114,7 +3114,7 @@ did_set_langmap(optset_T *args UNUSED) - { - if (p[0] != ',') - { -- sprintf(args->os_errbuf, -+ snprintf(args->os_errbuf, args->os_errbuflen, - _(e_langmap_extra_characters_after_semicolon_str), - p); - return args->os_errbuf; -diff --git a/src/option.c b/src/option.c -index d5d20d7674aa6..572788559cdfd 100644 ---- a/src/option.c -+++ b/src/option.c -@@ -1932,6 +1932,7 @@ do_set_option_string( - int cp_val, - char_u *varp_arg, - char *errbuf, -+ int errbuflen, - int *value_checked, - char **errmsg) - { -@@ -2030,7 +2031,7 @@ do_set_option_string( - // be triggered that can cause havoc. - *errmsg = did_set_string_option( - opt_idx, (char_u **)varp, oldval, newval, errbuf, -- opt_flags, op, value_checked); -+ errbuflen, opt_flags, op, value_checked); - - secure = secure_saved; - } -@@ -2287,7 +2288,7 @@ do_set_option_value( - { - // string option - if (do_set_option_string(opt_idx, opt_flags, &arg, nextchar, op, -- flags, cp_val, varp, errbuf, -+ flags, cp_val, varp, errbuf, errbuflen, - &value_checked, &errmsg) == FAIL) - { - if (errmsg != NULL) -@@ -2579,12 +2580,12 @@ do_set( - { - int stopopteval = FALSE; - char *errmsg = NULL; -- char errbuf[80]; -+ char errbuf[ERR_BUFLEN]; - char_u *startarg = arg; - - errmsg = do_set_option(opt_flags, &arg, arg_start, &startarg, - &did_show, &stopopteval, errbuf, -- sizeof(errbuf)); -+ ERR_BUFLEN); - if (stopopteval) - break; - -@@ -5347,7 +5348,8 @@ set_option_value( - int opt_idx; - char_u *varp; - long_u flags; -- static char errbuf[80]; -+ static char errbuf[ERR_BUFLEN]; -+ int errbuflen = ERR_BUFLEN; - - opt_idx = findoption(name); - if (opt_idx < 0) -@@ -5390,7 +5392,7 @@ set_option_value( - } - #endif - if (flags & P_STRING) -- return set_string_option(opt_idx, string, opt_flags, errbuf); -+ return set_string_option(opt_idx, string, opt_flags, errbuf, errbuflen); - - varp = get_varp_scope(&(options[opt_idx]), opt_flags); - if (varp != NULL) // hidden option is not changed -diff --git a/src/option.h b/src/option.h -index 2d1ca2cdeaf66..646056bf111b4 100644 ---- a/src/option.h -+++ b/src/option.h -@@ -1321,4 +1321,6 @@ enum - // Value for b_p_ul indicating the global value must be used. - #define NO_LOCAL_UNDOLEVEL (-123456) - -+#define ERR_BUFLEN 80 -+ - #endif // _OPTION_H_ -diff --git a/src/optionstr.c b/src/optionstr.c -index b7cdcc4511c7c..84c77cb0a0e25 100644 ---- a/src/optionstr.c -+++ b/src/optionstr.c -@@ -229,11 +229,12 @@ trigger_optionset_string( - #endif - - static char * --illegal_char(char *errbuf, int c) -+illegal_char(char *errbuf, int errbuflen, int c) - { - if (errbuf == NULL) - return ""; -- sprintf((char *)errbuf, _(e_illegal_character_str), (char *)transchar(c)); -+ snprintf((char *)errbuf, errbuflen, _(e_illegal_character_str), -+ (char *)transchar(c)); - return errbuf; - } - -@@ -525,7 +526,8 @@ set_string_option( - int opt_idx, - char_u *value, - int opt_flags, // OPT_LOCAL and/or OPT_GLOBAL -- char *errbuf) -+ char *errbuf, -+ int errbuflen) - { - char_u *s; - char_u **varp; -@@ -579,7 +581,7 @@ set_string_option( - } - #endif - if ((errmsg = did_set_string_option(opt_idx, varp, oldval, value, errbuf, -- opt_flags, OP_NONE, &value_checked)) == NULL) -+ errbuflen, opt_flags, OP_NONE, &value_checked)) == NULL) - did_set_option(opt_idx, opt_flags, TRUE, value_checked); - - #if defined(FEAT_EVAL) -@@ -615,7 +617,8 @@ valid_filetype(char_u *val) - check_stl_option(char_u *s) - { - int groupdepth = 0; -- static char errbuf[80]; -+ static char errbuf[ERR_BUFLEN]; -+ int errbuflen = ERR_BUFLEN; - - while (*s) - { -@@ -656,7 +659,7 @@ check_stl_option(char_u *s) - } - if (vim_strchr(STL_ALL, *s) == NULL) - { -- return illegal_char(errbuf, *s); -+ return illegal_char(errbuf, errbuflen, *s); - } - if (*s == '{') - { -@@ -664,7 +667,7 @@ check_stl_option(char_u *s) - - if (reevaluate && *++s == '}') - // "}" is not allowed immediately after "%{%" -- return illegal_char(errbuf, '}'); -+ return illegal_char(errbuf, errbuflen, '}'); - while ((*s != '}' || (reevaluate && s[-1] != '%')) && *s) - s++; - if (*s != '}') -@@ -719,13 +722,17 @@ did_set_opt_strings(char_u *val, char **values, int list) - * An option which is a list of flags is set. Valid values are in 'flags'. - */ - static char * --did_set_option_listflag(char_u *val, char_u *flags, char *errbuf) -+did_set_option_listflag( -+ char_u *val, -+ char_u *flags, -+ char *errbuf, -+ int errbuflen) - { - char_u *s; - - for (s = val; *s; ++s) - if (vim_strchr(flags, *s) == NULL) -- return illegal_char(errbuf, *s); -+ return illegal_char(errbuf, errbuflen, *s); - - return NULL; - } -@@ -1461,7 +1468,7 @@ did_set_comments(optset_T *args) - if (vim_strchr((char_u *)COM_ALL, *s) == NULL - && !VIM_ISDIGIT(*s) && *s != '-') - { -- errmsg = illegal_char(args->os_errbuf, *s); -+ errmsg = illegal_char(args->os_errbuf, args->os_errbuflen, *s); - break; - } - ++s; -@@ -1517,7 +1524,7 @@ did_set_complete(optset_T *args) - if (!*s) - break; - if (vim_strchr((char_u *)".wbuksid]tU", *s) == NULL) -- return illegal_char(args->os_errbuf, *s); -+ return illegal_char(args->os_errbuf, args->os_errbuflen, *s); - if (*++s != NUL && *s != ',' && *s != ' ') - { - if (s[-1] == 'k' || s[-1] == 's') -@@ -1534,7 +1541,7 @@ did_set_complete(optset_T *args) - { - if (args->os_errbuf != NULL) - { -- sprintf((char *)args->os_errbuf, -+ snprintf((char *)args->os_errbuf, args->os_errbuflen, - _(e_illegal_character_after_chr), *--s); - return args->os_errbuf; - } -@@ -1634,7 +1641,8 @@ did_set_concealcursor(optset_T *args) - { - char_u **varp = (char_u **)args->os_varp; - -- return did_set_option_listflag(*varp, (char_u *)COCU_ALL, args->os_errbuf); -+ return did_set_option_listflag(*varp, (char_u *)COCU_ALL, args->os_errbuf, -+ args->os_errbuflen); - } - - int -@@ -1652,7 +1660,8 @@ did_set_cpoptions(optset_T *args) - { - char_u **varp = (char_u **)args->os_varp; - -- return did_set_option_listflag(*varp, (char_u *)CPO_ALL, args->os_errbuf); -+ return did_set_option_listflag(*varp, (char_u *)CPO_ALL, args->os_errbuf, -+ args->os_errbuflen); - } - - int -@@ -2281,7 +2290,8 @@ did_set_formatoptions(optset_T *args) - { - char_u **varp = (char_u **)args->os_varp; - -- return did_set_option_listflag(*varp, (char_u *)FO_ALL, args->os_errbuf); -+ return did_set_option_listflag(*varp, (char_u *)FO_ALL, args->os_errbuf, -+ args->os_errbuflen); - } - - int -@@ -2422,7 +2432,8 @@ did_set_guioptions(optset_T *args) - char_u **varp = (char_u **)args->os_varp; - char *errmsg; - -- errmsg = did_set_option_listflag(*varp, (char_u *)GO_ALL, args->os_errbuf); -+ errmsg = did_set_option_listflag(*varp, (char_u *)GO_ALL, args->os_errbuf, -+ args->os_errbuflen); - if (errmsg != NULL) - return errmsg; - -@@ -2926,8 +2937,8 @@ did_set_mouse(optset_T *args) - { - char_u **varp = (char_u **)args->os_varp; - -- return did_set_option_listflag(*varp, (char_u *)MOUSE_ALL, -- args->os_errbuf); -+ return did_set_option_listflag(*varp, (char_u *)MOUSE_ALL, args->os_errbuf, -+ args->os_errbuflen); - } - - int -@@ -3364,7 +3375,8 @@ did_set_shortmess(optset_T *args) - { - char_u **varp = (char_u **)args->os_varp; - -- return did_set_option_listflag(*varp, (char_u *)SHM_ALL, args->os_errbuf); -+ return did_set_option_listflag(*varp, (char_u *)SHM_ALL, args->os_errbuf, -+ args->os_errbuflen); - } - - int -@@ -4030,7 +4042,7 @@ did_set_viminfo(optset_T *args) - // Check it's a valid character - if (vim_strchr((char_u *)"!\"%'/:<@cfhnrs", *s) == NULL) - { -- errmsg = illegal_char(args->os_errbuf, *s); -+ errmsg = illegal_char(args->os_errbuf, args->os_errbuflen, *s); - break; - } - if (*s == 'n') // name is always last one -@@ -4057,7 +4069,7 @@ did_set_viminfo(optset_T *args) - { - if (args->os_errbuf != NULL) - { -- sprintf(args->os_errbuf, -+ snprintf(args->os_errbuf, args->os_errbuflen, - _(e_missing_number_after_angle_str_angle), - transchar_byte(*(s - 1))); - errmsg = args->os_errbuf; -@@ -4140,7 +4152,8 @@ did_set_whichwrap(optset_T *args) - - // Add ',' to the list flags because 'whichwrap' is a flag - // list that is comma-separated. -- return did_set_option_listflag(*varp, (char_u *)(WW_ALL ","), args->os_errbuf); -+ return did_set_option_listflag(*varp, (char_u *)(WW_ALL ","), -+ args->os_errbuf, args->os_errbuflen); - } - - int -@@ -4341,6 +4354,7 @@ did_set_string_option( - char_u *oldval, // previous value of the option - char_u *value, // new value of the option - char *errbuf, // buffer for errors, or NULL -+ int errbuflen, // length of error buffer - int opt_flags, // OPT_LOCAL and/or OPT_GLOBAL - set_op_T op, // OP_ADDING/OP_PREPENDING/OP_REMOVING - int *value_checked) // value was checked to be safe, no -@@ -4385,6 +4399,7 @@ did_set_string_option( - args.os_oldval.string = oldval; - args.os_newval.string = value; - args.os_errbuf = errbuf; -+ args.os_errbuflen = errbuflen; - // Invoke the option specific callback function to validate and apply - // the new option value. - errmsg = did_set_cb(&args); -diff --git a/src/proto/optionstr.pro b/src/proto/optionstr.pro -index 22601ba996b8f..4ce93212dd948 100644 ---- a/src/proto/optionstr.pro -+++ b/src/proto/optionstr.pro -@@ -8,7 +8,7 @@ void check_string_option(char_u **pp); - void set_string_option_direct(char_u *name, int opt_idx, char_u *val, int opt_flags, int set_sid); - void set_string_option_direct_in_win(win_T *wp, char_u *name, int opt_idx, char_u *val, int opt_flags, int set_sid); - void set_string_option_direct_in_buf(buf_T *buf, char_u *name, int opt_idx, char_u *val, int opt_flags, int set_sid); --char *set_string_option(int opt_idx, char_u *value, int opt_flags, char *errbuf); -+char *set_string_option(int opt_idx, char_u *value, int opt_flags, char *errbuf, int errbuflen); - char *did_set_ambiwidth(optset_T *args); - char *did_set_background(optset_T *args); - char *did_set_backspace(optset_T *args); -@@ -121,7 +121,7 @@ char *did_set_wildmode(optset_T *args); - char *did_set_wildoptions(optset_T *args); - char *did_set_winaltkeys(optset_T *args); - char *did_set_wincolor(optset_T *args); --char *did_set_string_option(int opt_idx, char_u **varp, char_u *oldval, char_u *value, char *errbuf, int opt_flags, set_op_T op, int *value_checked); -+char *did_set_string_option(int opt_idx, char_u **varp, char_u *oldval, char_u *value, char *errbuf, int errbuflen, int opt_flags, set_op_T op, int *value_checked); - int expand_set_ambiwidth(optexpand_T *args, int *numMatches, char_u ***matches); - int expand_set_background(optexpand_T *args, int *numMatches, char_u ***matches); - int expand_set_backspace(optexpand_T *args, int *numMatches, char_u ***matches); -diff --git a/src/structs.h b/src/structs.h -index 4e081b860ef45..6d9dcbb2ab17d 100644 ---- a/src/structs.h -+++ b/src/structs.h -@@ -4968,6 +4968,8 @@ typedef struct - // is parameterized, then the "os_errbuf" buffer is used to store the error - // message (when it is not NULL). - char *os_errbuf; -+ // length of the error buffer -+ int os_errbuflen; - } optset_T; - - /* diff --git a/backport-CVE-2024-41957.patch b/backport-CVE-2024-41957.patch deleted file mode 100644 index 2eec8afcaca2f44da3116e544c9db122bc29e2f1..0000000000000000000000000000000000000000 --- a/backport-CVE-2024-41957.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 8a0bbe7b8aad6f8da28dee218c01bc8a0185a2d5 Mon Sep 17 00:00:00 2001 -From: Christian Brabandt -Date: Thu, 1 Aug 2024 20:16:51 +0200 -Subject: [PATCH] patch 9.1.0647: [security] use-after-free in - tagstack_clear_entry - -Problem: [security] use-after-free in tagstack_clear_entry - (Suyue Guo ) -Solution: Instead of manually calling vim_free() on each of the tagstack - entries, let's use tagstack_clear_entry(), which will - also free the stack, but using the VIM_CLEAR macro, - which prevents a use-after-free by setting those pointers - to NULL - -This addresses CVE-2024-41957 - -Github advisory: -https://github.com/vim/vim/security/advisories/GHSA-f9cr-gv85-hcr4 - -Signed-off-by: Christian Brabandt ---- - src/window.c | 5 +---- - 1 file changed, 1 insertion(+), 4 deletions(-) - -diff --git a/src/window.c b/src/window.c -index 7ca29d46a..70c72bca7 100644 ---- a/src/window.c -+++ b/src/window.c -@@ -5661,10 +5661,7 @@ win_free( - win_free_lsize(wp); - - for (i = 0; i < wp->w_tagstacklen; ++i) -- { -- vim_free(wp->w_tagstack[i].tagname); -- vim_free(wp->w_tagstack[i].user_data); -- } -+ tagstack_clear_entry(&wp->w_tagstack[i]); - vim_free(wp->w_localdir); - vim_free(wp->w_prevdir); - --- -2.33.0 - diff --git a/backport-CVE-2024-41965.patch b/backport-CVE-2024-41965.patch deleted file mode 100644 index ca2766d7ad139f8306847ae964ba9ff33a223587..0000000000000000000000000000000000000000 --- a/backport-CVE-2024-41965.patch +++ /dev/null @@ -1,42 +0,0 @@ -From b29f4abcd4b3382fa746edd1d0562b7b48c9de60 Mon Sep 17 00:00:00 2001 -From: Christian Brabandt -Date: Thu, 1 Aug 2024 22:10:28 +0200 -Subject: [PATCH] patch 9.1.0648: [security] double-free in dialog_changed() - -Problem: [security] double-free in dialog_changed() - (SuyueGuo) -Solution: Only clear pointer b_sfname pointer, if it is different - than the b_ffname pointer. Don't try to free b_fname, - set it to NULL instead. - -fixes: #15403 - -Github Advisory: -https://github.com/vim/vim/security/advisories/GHSA-46pw-v7qw-xc2f - -Signed-off-by: Christian Brabandt ---- - src/ex_cmds2.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/src/ex_cmds2.c b/src/ex_cmds2.c -index ce30b8d39..0d76b3b27 100644 ---- a/src/ex_cmds2.c -+++ b/src/ex_cmds2.c -@@ -197,9 +197,11 @@ dialog_changed( - // restore to empty when write failed - if (empty_bufname) - { -- VIM_CLEAR(buf->b_fname); -+ // prevent double free -+ if (buf->b_sfname != buf->b_ffname) -+ VIM_CLEAR(buf->b_sfname); -+ buf->b_fname = NULL; - VIM_CLEAR(buf->b_ffname); -- VIM_CLEAR(buf->b_sfname); - unchanged(buf, TRUE, FALSE); - } - } --- -2.33.0 - diff --git a/backport-CVE-2024-43374.patch b/backport-CVE-2024-43374.patch deleted file mode 100644 index fb118a5cbc7799d32400cf01ea2f40c79131b745..0000000000000000000000000000000000000000 --- a/backport-CVE-2024-43374.patch +++ /dev/null @@ -1,300 +0,0 @@ -From 0a6e57b09bc8c76691b367a5babfb79b31b770e8 Mon Sep 17 00:00:00 2001 -From: Christian Brabandt -Date: Thu, 15 Aug 2024 22:15:28 +0200 -Subject: [PATCH] patch 9.1.0678: [security]: use-after-free in alist_add() -https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8 - -Problem: [security]: use-after-free in alist_add() - (SuyueGuo) -Solution: Lock the current window, so that the reference to - the argument list remains valid. - -This fixes CVE-2024-43374 - -Signed-off-by: Christian Brabandt ---- - src/arglist.c | 6 ++++++ - src/buffer.c | 4 ++-- - src/ex_cmds.c | 4 ++-- - src/proto/window.pro | 1 + - src/structs.h | 2 +- - src/terminal.c | 4 ++-- - src/testdir/test_arglist.vim | 23 +++++++++++++++++++++++ - src/version.c | 2 ++ - src/window.c | 29 +++++++++++++++++++---------- - 9 files changed, 58 insertions(+), 17 deletions(-) - -diff --git a/src/arglist.c b/src/arglist.c -index a63f6c7..050f96f 100644 ---- a/src/arglist.c -+++ b/src/arglist.c -@@ -184,6 +184,8 @@ alist_set( - /* - * Add file "fname" to argument list "al". - * "fname" must have been allocated and "al" must have been checked for room. -+ * -+ * May trigger Buf* autocommands - */ - void - alist_add( -@@ -196,6 +198,7 @@ alist_add( - if (check_arglist_locked() == FAIL) - return; - arglist_locked = TRUE; -+ curwin->w_locked = TRUE; - - #ifdef BACKSLASH_IN_FILENAME - slash_adjust(fname); -@@ -207,6 +210,7 @@ alist_add( - ++al->al_ga.ga_len; - - arglist_locked = FALSE; -+ curwin->w_locked = FALSE; - } - - #if defined(BACKSLASH_IN_FILENAME) || defined(PROTO) -@@ -365,6 +369,7 @@ alist_add_list( - mch_memmove(&(ARGLIST[after + count]), &(ARGLIST[after]), - (ARGCOUNT - after) * sizeof(aentry_T)); - arglist_locked = TRUE; -+ curwin->w_locked = TRUE; - for (i = 0; i < count; ++i) - { - int flags = BLN_LISTED | (will_edit ? BLN_CURBUF : 0); -@@ -373,6 +378,7 @@ alist_add_list( - ARGLIST[after + i].ae_fnum = buflist_add(files[i], flags); - } - arglist_locked = FALSE; -+ curwin->w_locked = FALSE; - ALIST(curwin)->al_ga.ga_len += count; - if (old_argcount > 0 && curwin->w_arg_idx >= after) - curwin->w_arg_idx += count; -diff --git a/src/buffer.c b/src/buffer.c -index ccd095b..260d22e 100644 ---- a/src/buffer.c -+++ b/src/buffer.c -@@ -1456,7 +1456,7 @@ do_buffer_ext( - // (unless it's the only window). Repeat this so long as we end up in - // a window with this buffer. - while (buf == curbuf -- && !(curwin->w_closing || curwin->w_buffer->b_locked > 0) -+ && !(win_locked(curwin) || curwin->w_buffer->b_locked > 0) - && (!ONE_WINDOW || first_tabpage->tp_next != NULL)) - { - if (win_close(curwin, FALSE) == FAIL) -@@ -5443,7 +5443,7 @@ ex_buffer_all(exarg_T *eap) - : wp->w_width != Columns) - || (had_tab > 0 && wp != firstwin)) - && !ONE_WINDOW -- && !(wp->w_closing || wp->w_buffer->b_locked > 0) -+ && !(win_locked(wp) || wp->w_buffer->b_locked > 0) - && !win_unlisted(wp)) - { - if (win_close(wp, FALSE) == FAIL) -diff --git a/src/ex_cmds.c b/src/ex_cmds.c -index a08682b..46c4503 100644 ---- a/src/ex_cmds.c -+++ b/src/ex_cmds.c -@@ -2827,7 +2827,7 @@ do_ecmd( - - // Set the w_closing flag to avoid that autocommands close the - // window. And set b_locked for the same reason. -- the_curwin->w_closing = TRUE; -+ the_curwin->w_locked = TRUE; - ++buf->b_locked; - - if (curbuf == old_curbuf.br_buf) -@@ -2841,7 +2841,7 @@ do_ecmd( - - // Autocommands may have closed the window. - if (win_valid(the_curwin)) -- the_curwin->w_closing = FALSE; -+ the_curwin->w_locked = FALSE; - --buf->b_locked; - - #ifdef FEAT_EVAL -diff --git a/src/proto/window.pro b/src/proto/window.pro -index cfb771d..12edf0b 100644 ---- a/src/proto/window.pro -+++ b/src/proto/window.pro -@@ -93,4 +93,5 @@ int win_hasvertsplit(void); - int get_win_number(win_T *wp, win_T *first_win); - int get_tab_number(tabpage_T *tp); - char *check_colorcolumn(win_T *wp); -+int win_locked(win_T *wp); - /* vim: set ft=c : */ -diff --git a/src/structs.h b/src/structs.h -index 6d9dcbb..1f4742b 100644 ---- a/src/structs.h -+++ b/src/structs.h -@@ -3740,7 +3740,7 @@ struct window_S - synblock_T *w_s; // for :ownsyntax - #endif - -- int w_closing; // window is being closed, don't let -+ int w_locked; // window is being closed, don't let - // autocommands close it too. - - frame_T *w_frame; // frame containing this window -diff --git a/src/terminal.c b/src/terminal.c -index f79d102..37cd0f2 100644 ---- a/src/terminal.c -+++ b/src/terminal.c -@@ -3669,10 +3669,10 @@ term_after_channel_closed(term_T *term) - if (is_aucmd_win(curwin)) - do_set_w_closing = TRUE; - if (do_set_w_closing) -- curwin->w_closing = TRUE; -+ curwin->w_locked = TRUE; - do_bufdel(DOBUF_WIPE, (char_u *)"", 1, fnum, fnum, FALSE); - if (do_set_w_closing) -- curwin->w_closing = FALSE; -+ curwin->w_locked = FALSE; - aucmd_restbuf(&aco); - } - #ifdef FEAT_PROP_POPUP -diff --git a/src/testdir/test_arglist.vim b/src/testdir/test_arglist.vim -index edc8b77..8d81a82 100644 ---- a/src/testdir/test_arglist.vim -+++ b/src/testdir/test_arglist.vim -@@ -359,6 +359,7 @@ func Test_argv() - call assert_equal('', argv(1, 100)) - call assert_equal([], argv(-1, 100)) - call assert_equal('', argv(10, -1)) -+ %argdelete - endfunc - - " Test for the :argedit command -@@ -744,4 +745,26 @@ func Test_all_command() - %bw! - endfunc - -+" Test for deleting buffer when creating an arglist. This was accessing freed -+" memory -+func Test_crash_arglist_uaf() -+ "%argdelete -+ new one -+ au BufAdd XUAFlocal :bw -+ "call assert_fails(':arglocal XUAFlocal', 'E163:') -+ arglocal XUAFlocal -+ au! BufAdd -+ bw! XUAFlocal -+ -+ au BufAdd XUAFlocal2 :bw -+ new two -+ new three -+ arglocal -+ argadd XUAFlocal2 Xfoobar -+ bw! XUAFlocal2 -+ bw! two -+ -+ au! BufAdd -+endfunc -+ - " vim: shiftwidth=2 sts=2 expandtab -diff --git a/src/version.c b/src/version.c -index 555ef9f..10916ed 100644 ---- a/src/version.c -+++ b/src/version.c -@@ -704,6 +704,8 @@ static char *(features[]) = - - static int included_patches[] = - { /* Add new patch number below this line */ -+/**/ -+ 678, - /**/ - 2092, - /**/ -diff --git a/src/window.c b/src/window.c -index 2afa28d..e2a7393 100644 ---- a/src/window.c -+++ b/src/window.c -@@ -2441,7 +2441,7 @@ close_windows( - for (wp = firstwin; wp != NULL && !ONE_WINDOW; ) - { - if (wp->w_buffer == buf && (!keep_curwin || wp != curwin) -- && !(wp->w_closing || wp->w_buffer->b_locked > 0)) -+ && !(win_locked(wp) || wp->w_buffer->b_locked > 0)) - { - if (win_close(wp, FALSE) == FAIL) - // If closing the window fails give up, to avoid looping -@@ -2462,7 +2462,7 @@ close_windows( - if (tp != curtab) - FOR_ALL_WINDOWS_IN_TAB(tp, wp) - if (wp->w_buffer == buf -- && !(wp->w_closing || wp->w_buffer->b_locked > 0)) -+ && !(win_locked(wp) || wp->w_buffer->b_locked > 0)) - { - win_close_othertab(wp, FALSE, tp); - -@@ -2584,10 +2584,10 @@ win_close_buffer(win_T *win, int action, int abort_if_last) - bufref_T bufref; - - set_bufref(&bufref, curbuf); -- win->w_closing = TRUE; -+ win->w_locked = TRUE; - close_buffer(win, win->w_buffer, action, abort_if_last, TRUE); - if (win_valid_any_tab(win)) -- win->w_closing = FALSE; -+ win->w_locked = FALSE; - // Make sure curbuf is valid. It can become invalid if 'bufhidden' is - // "wipe". - if (!bufref_valid(&bufref)) -@@ -2635,7 +2635,7 @@ win_close(win_T *win, int free_buf) - if (window_layout_locked(CMD_close)) - return FAIL; - -- if (win->w_closing || (win->w_buffer != NULL -+ if (win_locked(win) || (win->w_buffer != NULL - && win->w_buffer->b_locked > 0)) - return FAIL; // window is already being closed - if (win_unlisted(win)) -@@ -2684,19 +2684,19 @@ win_close(win_T *win, int free_buf) - other_buffer = TRUE; - if (!win_valid(win)) - return FAIL; -- win->w_closing = TRUE; -+ win->w_locked = TRUE; - apply_autocmds(EVENT_BUFLEAVE, NULL, NULL, FALSE, curbuf); - if (!win_valid(win)) - return FAIL; -- win->w_closing = FALSE; -+ win->w_locked = FALSE; - if (last_window()) - return FAIL; - } -- win->w_closing = TRUE; -+ win->w_locked = TRUE; - apply_autocmds(EVENT_WINLEAVE, NULL, NULL, FALSE, curbuf); - if (!win_valid(win)) - return FAIL; -- win->w_closing = FALSE; -+ win->w_locked = FALSE; - if (last_window()) - return FAIL; - #ifdef FEAT_EVAL -@@ -3269,7 +3269,7 @@ win_close_othertab(win_T *win, int free_buf, tabpage_T *tp) - - // Get here with win->w_buffer == NULL when win_close() detects the tab - // page changed. -- if (win->w_closing || (win->w_buffer != NULL -+ if (win_locked(win) || (win->w_buffer != NULL - && win->w_buffer->b_locked > 0)) - return; // window is already being closed - -@@ -7792,3 +7792,12 @@ skip: - return NULL; // no error - } - #endif -+ -+/* -+ * Don't let autocommands close the given window -+ */ -+ int -+win_locked(win_T *wp) -+{ -+ return wp->w_locked; -+} --- -2.43.0 - diff --git a/backport-CVE-2024-43802.patch b/backport-CVE-2024-43802.patch deleted file mode 100644 index 9560505252c81e5892eb915a471315b55818f720..0000000000000000000000000000000000000000 --- a/backport-CVE-2024-43802.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 322ba9108612bead5eb7731ccb66763dec69ef1b Mon Sep 17 00:00:00 2001 -From: Christian Brabandt -Date: Sun, 25 Aug 2024 21:33:03 +0200 -Subject: [PATCH] patch 9.1.0697: [security]: heap-buffer-overflow in - ins_typebuf - -Problem: heap-buffer-overflow in ins_typebuf - (SuyueGuo) -Solution: When flushing the typeahead buffer, validate that there - is enough space left - -Github Advisory: -https://github.com/vim/vim/security/advisories/GHSA-4ghr-c62x-cqfh - -Signed-off-by: Christian Brabandt ---- - src/getchar.c | 15 ++++++++++++--- - 1 files changed, 12 insertions(+), 3 deletions(-) - -diff --git a/src/getchar.c b/src/getchar.c -index 29323fa328bd1..96e180f4ae1a9 100644 ---- a/src/getchar.c -+++ b/src/getchar.c -@@ -438,9 +438,18 @@ flush_buffers(flush_buffers_T flush_typeahead) - - if (flush_typeahead == FLUSH_MINIMAL) - { -- // remove mapped characters at the start only -- typebuf.tb_off += typebuf.tb_maplen; -- typebuf.tb_len -= typebuf.tb_maplen; -+ // remove mapped characters at the start only, -+ // but only when enough space left in typebuf -+ if (typebuf.tb_off + typebuf.tb_maplen >= typebuf.tb_buflen) -+ { -+ typebuf.tb_off = MAXMAPLEN; -+ typebuf.tb_len = 0; -+ } -+ else -+ { -+ typebuf.tb_off += typebuf.tb_maplen; -+ typebuf.tb_len -= typebuf.tb_maplen; -+ } - #if defined(FEAT_CLIENTSERVER) || defined(FEAT_EVAL) - if (typebuf.tb_len == 0) - typebuf_was_filled = FALSE; diff --git a/backport-patch-9.0.2114-overflow-detection-not-accurate-when-adding.patch b/backport-patch-9.0.2114-overflow-detection-not-accurate-when-adding.patch deleted file mode 100644 index 2e05e10cb38fa0fb0e2e05a3a0c4535231fe388d..0000000000000000000000000000000000000000 --- a/backport-patch-9.0.2114-overflow-detection-not-accurate-when-adding.patch +++ /dev/null @@ -1,94 +0,0 @@ -From 22cbc8a4e17ce61aa460c451a26e1bff2c3d2af9 Mon Sep 17 00:00:00 2001 -From: Christian Brabandt -Date: Sun, 19 Nov 2023 10:47:21 +0100 -Subject: [PATCH] patch 9.0.2114: overflow detection not accurate when adding - digits - -Problem: overflow detection not accurate when adding digits -Solution: Use a helper function - -Use a helper function to better detect overflows before adding integer -digits to a long or an integer variable respectively. Signal the -overflow to the caller function. - -closes: #13539 - -Signed-off-by: Christian Brabandt -Signed-off-by: Michael Henry -Signed-off-by: Ernie Rael ---- - src/misc1.c | 25 +++++++++++++++++++++++-- - src/normal.c | 3 +-- - src/proto/misc1.pro | 2 ++ - 3 files changed, 26 insertions(+), 4 deletions(-) - -diff --git a/src/misc1.c b/src/misc1.c -index 5f9828ebe9544..dc0deae67af93 100644 ---- a/src/misc1.c -+++ b/src/misc1.c -@@ -975,9 +975,8 @@ get_number( - c = safe_vgetc(); - if (VIM_ISDIGIT(c)) - { -- if (n > INT_MAX / 10) -+ if (vim_append_digit_int(&n, c - '0') == FAIL) - return 0; -- n = n * 10 + c - '0'; - msg_putchar(c); - ++typed; - } -@@ -2817,3 +2816,25 @@ may_trigger_modechanged(void) - restore_v_event(v_event, &save_v_event); - #endif - } -+ -+// For overflow detection, add a digit safely to an int value. -+ int -+vim_append_digit_int(int *value, int digit) -+{ -+ int x = *value; -+ if (x > ((INT_MAX - digit) / 10)) -+ return FAIL; -+ *value = x * 10 + digit; -+ return OK; -+} -+ -+// For overflow detection, add a digit safely to a long value. -+ int -+vim_append_digit_long(long *value, int digit) -+{ -+ long x = *value; -+ if (x > ((LONG_MAX - (long)digit) / 10)) -+ return FAIL; -+ *value = x * 10 + (long)digit; -+ return OK; -+} -diff --git a/src/normal.c b/src/normal.c -index 16b4b45069329..61a19c13a43c9 100644 ---- a/src/normal.c -+++ b/src/normal.c -@@ -2563,12 +2563,11 @@ nv_z_get_count(cmdarg_T *cap, int *nchar_arg) - n /= 10; - else if (VIM_ISDIGIT(nchar)) - { -- if (n > LONG_MAX / 10) -+ if (vim_append_digit_long(&n, nchar - '0') == FAIL) - { - clearopbeep(cap->oap); - break; - } -- n = n * 10 + (nchar - '0'); - } - else if (nchar == CAR) - { -diff --git a/src/proto/misc1.pro b/src/proto/misc1.pro -index b87b7ea747576..2b8e9d8f264cb 100644 ---- a/src/proto/misc1.pro -+++ b/src/proto/misc1.pro -@@ -53,4 +53,6 @@ int path_with_url(char_u *fname); - dict_T *get_v_event(save_v_event_T *sve); - void restore_v_event(dict_T *v_event, save_v_event_T *sve); - void may_trigger_modechanged(void); -+int vim_append_digit_int(int *value, int digit); -+int vim_append_digit_long(long *value, int digit); - /* vim: set ft=c : */ diff --git a/backport-patch-9.0.2123-Problem-with-initializing-the-length-of-range-lists.patch b/backport-patch-9.0.2123-Problem-with-initializing-the-length-of-range-lists.patch deleted file mode 100644 index e062058bef5c41d89ba5d6a3d9821047f5758d89..0000000000000000000000000000000000000000 --- a/backport-patch-9.0.2123-Problem-with-initializing-the-length-of-range-lists.patch +++ /dev/null @@ -1,90 +0,0 @@ -From df63da98d8dc284b1c76cfe1b17fa0acbd6094d8 Mon Sep 17 00:00:00 2001 -From: Christian Brabandt -Date: Thu, 23 Nov 2023 20:14:28 +0100 -Subject: [PATCH] patch 9.0.2123: Problem with initializing the length of - range() lists - -Problem: Problem with initializing the length of range() lists -Solution: Set length explicitly when it shouldn't contain any items - -range() may cause a wrong calculation of list length, which may later -then cause a segfault in list_find(). This is usually not a problem, -because range_list_materialize() calculates the length, when it -materializes the list. - -In addition, in list_find() when the length of the range was wrongly -initialized, it may seem to be valid, so the check for list index -out-of-bounds will not be true, because it is called before the list is -actually materialized. And so we may eventually try to access a null -pointer, causing a segfault. - -So this patch does 3 things: - -- In f_range(), when we know that the list should be empty, explicitly - set the list->lv_len value to zero. This should happen, when - start is larger than end (in case the stride is positive) or - end is larger than start when the stride is negative. - This should fix the underlying issue properly. However, - -- as a safety measure, let's check that the requested index is not - out of range one more time, after the list has been materialized - and return NULL in case it suddenly is. - -- add a few more tests to verify the behaviour. - -fixes: #13557 -closes: #13563 - -Co-authored-by: Tim Pope -Signed-off-by: Christian Brabandt ---- - src/evalfunc.c | 5 ++++- - src/list.c | 4 ++++ - src/testdir/test_functions.vim | 3 +++ - 3 files changed, 11 insertions(+), 1 deletion(-) - -diff --git a/src/evalfunc.c b/src/evalfunc.c -index 7f7914eca7d91..fa27d0d274a64 100644 ---- a/src/evalfunc.c -+++ b/src/evalfunc.c -@@ -8646,7 +8646,10 @@ f_range(typval_T *argvars, typval_T *rettv) - list->lv_u.nonmat.lv_start = start; - list->lv_u.nonmat.lv_end = end; - list->lv_u.nonmat.lv_stride = stride; -- list->lv_len = (end - start) / stride + 1; -+ if (stride > 0 ? end < start : end > start) -+ list->lv_len = 0; -+ else -+ list->lv_len = (end - start) / stride + 1; - } - - /* -diff --git a/src/list.c b/src/list.c -index d1494c67d56e9..ce1ccaa1c045c 100644 ---- a/src/list.c -+++ b/src/list.c -@@ -415,6 +415,10 @@ list_find(list_T *l, long n) - - CHECK_LIST_MATERIALIZE(l); - -+ // range_list_materialize may reset l->lv_len -+ if (n >= l->lv_len) -+ return NULL; -+ - // When there is a cached index may start search from there. - if (l->lv_u.mat.lv_idx_item != NULL) - { -diff --git a/src/testdir/test_functions.vim b/src/testdir/test_functions.vim -index 49b688c25f347..0801d2b695b76 100644 ---- a/src/testdir/test_functions.vim -+++ b/src/testdir/test_functions.vim -@@ -3052,6 +3052,9 @@ func Test_range() - " get() - call assert_equal(4, get(range(1, 10), 3)) - call assert_equal(-1, get(range(1, 10), 42, -1)) -+ call assert_equal(0, get(range(1, 0, 2), 0)) -+ call assert_equal(0, get(range(0, -1, 2), 0)) -+ call assert_equal(0, get(range(-2, -1, -2), 0)) - - " index() - call assert_equal(1, index(range(1, 5), 2)) diff --git a/backport-patch-9.1.0265-console-dialog-cannot-save-unnamed-bu.patch b/backport-patch-9.1.0265-console-dialog-cannot-save-unnamed-bu.patch deleted file mode 100644 index 44191134ee0b80c6c3a0a5e2cbd285cd2345eea2..0000000000000000000000000000000000000000 --- a/backport-patch-9.1.0265-console-dialog-cannot-save-unnamed-bu.patch +++ /dev/null @@ -1,171 +0,0 @@ -From df46115fc839c8912ed60646e86a412e5180ba1d Mon Sep 17 00:00:00 2001 -From: glepnir -Date: Thu, 4 Apr 2024 22:23:29 +0200 -Subject: [PATCH] patch 9.1.0265: console dialog cannot save unnamed buffers - -Problem: console dialog cannot save unnamed buffers -Solution: set bufname before save (glepnir). Define dialog_con_gui - to test for GUI+Console dialog support, use it to skip - the test when the GUI feature has been defined. - -Note: The dialog_changed() function will also try to call the -browse_save_fname() function, when FEAT_BROWSE is defined (which is only -defined in a GUI build of Vim). This will eventually lead to a call of -do_browse(), which causes an error message if a GUI is not currently -running (see the TODO: in do_browse()) and will then lead to a failure -in Test_goto_buf_with_onfirm(). - -Therefore, we must disable the Test_goto_buf_with_onfirm(), when the -dialog_con_gui feature is enabled (which basically means dialog feature -for GUI and Console builds, in contrast to the dialog_con and dialog_gui -feature). - -(Previously this wasn't a problem, because the test aborted in the YES -case for the :confirm :b XgotoConf case and did therefore not run into -the browse function call) - -closes: #14398 - -Signed-off-by: glepnir -Signed-off-by: Christian Brabandt ---- - runtime/doc/builtin.txt | 5 +++-- - src/evalfunc.c | 7 +++++++ - src/ex_cmds2.c | 26 ++++++++++++++++++++++---- - src/testdir/test_buffer.vim | 21 +++++++++++++++------ - 4 files changed, 47 insertions(+), 12 deletions(-) - -diff --git a/runtime/doc/builtin.txt b/runtime/doc/builtin.txt -index 6a4c8d981..fb7c794f6 100644 ---- a/runtime/doc/builtin.txt -+++ b/runtime/doc/builtin.txt -@@ -1,4 +1,4 @@ --*builtin.txt* For Vim version 9.0. Last change: 2023 Sep 27 -+*builtin.txt* For Vim version 9.1. Last change: 2024 Apr 04 - - - VIM REFERENCE MANUAL by Bram Moolenaar -@@ -1761,7 +1761,7 @@ confirm({msg} [, {choices} [, {default} [, {type}]]]) - made. It returns the number of the choice. For the first - choice this is 1. - Note: confirm() is only supported when compiled with dialog -- support, see |+dialog_con| and |+dialog_gui|. -+ support, see |+dialog_con| |+dialog_con_gui| and |+dialog_gui|. - - {msg} is displayed in a |dialog| with {choices} as the - alternatives. When {choices} is missing or empty, "&OK" is -@@ -10912,6 +10912,7 @@ cscope Compiled with |cscope| support. - cursorbind Compiled with |'cursorbind'| (always true) - debug Compiled with "DEBUG" defined. - dialog_con Compiled with console dialog support. -+dialog_con_gui Compiled with console and GUI dialog support. - dialog_gui Compiled with GUI dialog support. - diff Compiled with |vimdiff| and 'diff' support. - digraphs Compiled with support for digraphs. -diff --git a/src/evalfunc.c b/src/evalfunc.c -index 0e071d87b..20649828e 100644 ---- a/src/evalfunc.c -+++ b/src/evalfunc.c -@@ -5792,6 +5792,13 @@ f_has(typval_T *argvars, typval_T *rettv) - 1 - #else - 0 -+#endif -+ }, -+ {"dialog_con_gui", -+#if defined(FEAT_CON_DIALOG) && defined(FEAT_GUI_DIALOG) -+ 1 -+#else -+ 0 - #endif - }, - {"dialog_gui", -diff --git a/src/ex_cmds2.c b/src/ex_cmds2.c -index 4a6f51923..a75bfc11c 100644 ---- a/src/ex_cmds2.c -+++ b/src/ex_cmds2.c -@@ -163,7 +163,8 @@ dialog_changed( - char_u buff[DIALOG_MSG_SIZE]; - int ret; - buf_T *buf2; -- exarg_T ea; -+ exarg_T ea; -+ int empty_buf = buf->b_fname == NULL ? TRUE : FALSE; - - dialog_msg(buff, _("Save changes to \"%s\"?"), buf->b_fname); - if (checkall) -@@ -181,10 +182,27 @@ dialog_changed( - // May get file name, when there is none - browse_save_fname(buf); - #endif -- if (buf->b_fname != NULL && check_overwrite(&ea, buf, -- buf->b_fname, buf->b_ffname, FALSE) == OK) -+ if (empty_buf) -+ buf_set_name(buf->b_fnum, (char_u *)"Untitled"); -+ -+ if (check_overwrite(&ea, buf, buf->b_fname, buf->b_ffname, FALSE) == OK) -+ { - // didn't hit Cancel -- (void)buf_write_all(buf, FALSE); -+ if (buf_write_all(buf, FALSE) == OK) -+ return; -+ } -+ -+ // restore to empty when write failed -+ if (empty_buf) -+ { -+ vim_free(buf->b_fname); -+ buf->b_fname = NULL; -+ vim_free(buf->b_ffname); -+ buf->b_ffname = NULL; -+ vim_free(buf->b_sfname); -+ buf->b_sfname = NULL; -+ unchanged(buf, TRUE, FALSE); -+ } - } - else if (ret == VIM_NO) - { -diff --git a/src/testdir/test_buffer.vim b/src/testdir/test_buffer.vim -index a5643b3bb..de088bd8e 100644 ---- a/src/testdir/test_buffer.vim -+++ b/src/testdir/test_buffer.vim -@@ -252,21 +252,30 @@ func Test_goto_buf_with_confirm() - CheckUnix - CheckNotGui - CheckFeature dialog_con -+ " When dialog_con_gui is defined, Vim is compiled with GUI support -+ " and FEAT_BROWSE will be defined, which causes :confirm :b to -+ " call do_browse(), which will try to use a GUI file browser, -+ " which aborts if a GUI is not available. -+ CheckNotFeature dialog_con_gui - new XgotoConf - enew - call setline(1, 'test') - call assert_fails('b XgotoConf', 'E37:') - call feedkeys('c', 'L') - call assert_fails('confirm b XgotoConf', 'E37:') -- call assert_equal(1, &modified) -- call assert_equal('', @%) -+ call assert_true(&modified) -+ call assert_true(empty(bufname('%'))) - call feedkeys('y', 'L') -- call assert_fails('confirm b XgotoConf', ['', 'E37:']) -- call assert_equal(1, &modified) -- call assert_equal('', @%) -+ confirm b XgotoConf -+ call assert_equal('XgotoConf', bufname('%')) -+ call assert_equal(['test'], readfile('Untitled')) -+ e Untitled -+ call setline(2, 'test2') - call feedkeys('n', 'L') - confirm b XgotoConf -- call assert_equal('XgotoConf', @%) -+ call assert_equal('XgotoConf', bufname('%')) -+ call assert_equal(['test'], readfile('Untitled')) -+ call delete('Untitled') - close! - endfunc - --- -2.33.0 - diff --git a/backport-patch-9.1.0267-File-name-entered-in-GUI-dialog-is-ig.patch b/backport-patch-9.1.0267-File-name-entered-in-GUI-dialog-is-ig.patch deleted file mode 100644 index 6c047cb32c0832b502c375c29dfe9b7bab0a38df..0000000000000000000000000000000000000000 --- a/backport-patch-9.1.0267-File-name-entered-in-GUI-dialog-is-ig.patch +++ /dev/null @@ -1,67 +0,0 @@ -From c20bdf1107d48a1c14713709d12d429e761132af Mon Sep 17 00:00:00 2001 -From: zeertzjq -Date: Fri, 5 Apr 2024 20:02:55 +0200 -Subject: [PATCH] patch 9.1.0267: File name entered in GUI dialog is ignored - -Problem: File name entered in GUI dialog is ignored (after v9.1.0265) -Solution: Only set file name to "Untitled" if GUI dialog didn't set it. - (zeertzjq) - -closes: #14417 - -Signed-off-by: zeertzjq -Signed-off-by: Christian Brabandt ---- - src/ex_cmds2.c | 17 ++++++++--------- - 1 file changed, 8 insertions(+), 9 deletions(-) - -diff --git a/src/ex_cmds2.c b/src/ex_cmds2.c -index a75bfc11c..ce30b8d39 100644 ---- a/src/ex_cmds2.c -+++ b/src/ex_cmds2.c -@@ -164,7 +164,6 @@ dialog_changed( - int ret; - buf_T *buf2; - exarg_T ea; -- int empty_buf = buf->b_fname == NULL ? TRUE : FALSE; - - dialog_msg(buff, _("Save changes to \"%s\"?"), buf->b_fname); - if (checkall) -@@ -178,11 +177,14 @@ dialog_changed( - - if (ret == VIM_YES) - { -+ int empty_bufname; -+ - #ifdef FEAT_BROWSE - // May get file name, when there is none - browse_save_fname(buf); - #endif -- if (empty_buf) -+ empty_bufname = buf->b_fname == NULL ? TRUE : FALSE; -+ if (empty_bufname) - buf_set_name(buf->b_fnum, (char_u *)"Untitled"); - - if (check_overwrite(&ea, buf, buf->b_fname, buf->b_ffname, FALSE) == OK) -@@ -193,14 +195,11 @@ dialog_changed( - } - - // restore to empty when write failed -- if (empty_buf) -+ if (empty_bufname) - { -- vim_free(buf->b_fname); -- buf->b_fname = NULL; -- vim_free(buf->b_ffname); -- buf->b_ffname = NULL; -- vim_free(buf->b_sfname); -- buf->b_sfname = NULL; -+ VIM_CLEAR(buf->b_fname); -+ VIM_CLEAR(buf->b_ffname); -+ VIM_CLEAR(buf->b_sfname); - unchanged(buf, TRUE, FALSE); - } - } --- -2.33.0 - diff --git a/backport-patch-9.1.0554-bw-leaves-jumplist-and-tagstack-data-.patch b/backport-patch-9.1.0554-bw-leaves-jumplist-and-tagstack-data-.patch deleted file mode 100644 index f23299193b99d207cbd058259a44aaba586f9c77..0000000000000000000000000000000000000000 --- a/backport-patch-9.1.0554-bw-leaves-jumplist-and-tagstack-data-.patch +++ /dev/null @@ -1,237 +0,0 @@ -From 4ff3a9b1e3ba45f9dbd0ea8c721f27d9315c4d93 Mon Sep 17 00:00:00 2001 -From: LemonBoy -Date: Tue, 9 Jul 2024 20:03:24 +0200 -Subject: [PATCH] patch 9.1.0554: :bw leaves jumplist and tagstack data around - -Problem: :bw leaves jumplist and tagstack data around - (Paul "Joey" Clark) -Solution: Wipe jumplist and tagstack references to the wiped buffer - (LemonBoy) - -As documented the :bwipeout command brutally deletes all the references -to the buffer, so let's make it delete all the entries in the jump list -and tag stack referring to the wiped-out buffer. - -fixes: #8201 -closes: #15185 - -Signed-off-by: LemonBoy -Signed-off-by: Christian Brabandt ---- - runtime/doc/version9.txt | 1 + - runtime/doc/windows.txt | 5 +++-- - src/buffer.c | 5 +++++ - src/mark.c | 34 ++++++++++++++++++++++++++++++++++ - src/proto/mark.pro | 1 + - src/proto/tag.pro | 1 + - src/tag.c | 3 +-- - src/testdir/test_jumplist.vim | 22 ++++++---------------- - src/testdir/test_tagjump.vim | 17 +++++++++++++++++ - 9 files changed, 69 insertions(+), 20 deletions(-) - -diff --git a/runtime/doc/version9.txt b/runtime/doc/version9.txt -index 9cf20300f..df56215ea 100644 ---- a/runtime/doc/version9.txt -+++ b/runtime/doc/version9.txt -@@ -31701,6 +31701,7 @@ Other improvements *new-other-9.1* - - Changed *changed-9.1* - ------- -+- |:bwipe| also wipes jumplist and tagstack data - - Added *added-9.1* - ----- -diff --git a/runtime/doc/windows.txt b/runtime/doc/windows.txt -index e264e5117..d3e5f6785 100644 ---- a/runtime/doc/windows.txt -+++ b/runtime/doc/windows.txt -@@ -1,4 +1,4 @@ --*windows.txt* For Vim version 9.0. Last change: 2022 Nov 27 -+*windows.txt* For Vim version 9.1. Last change: 2024 Jul 09 - - - VIM REFERENCE MANUAL by Bram Moolenaar -@@ -1225,7 +1225,8 @@ list of buffers. |unlisted-buffer| - :bw[ipeout][!] N1 N2 ... - Like |:bdelete|, but really delete the buffer. Everything - related to the buffer is lost. All marks in this buffer -- become invalid, option settings are lost, etc. Don't use this -+ become invalid, option settings are lost, the jumplist and -+ tagstack data will be purged, etc. Don't use this - unless you know what you are doing. Examples: > - :.+,$bwipeout " wipe out all buffers after the current - " one -diff --git a/src/buffer.c b/src/buffer.c -index cbec9b980..28967342d 100644 ---- a/src/buffer.c -+++ b/src/buffer.c -@@ -750,10 +750,15 @@ aucmd_abort: - */ - if (wipe_buf) - { -+ win_T *wp; -+ - // Do not wipe out the buffer if it is used in a window. - if (buf->b_nwindows > 0) - return FALSE; - -+ FOR_ALL_WINDOWS(wp) -+ mark_forget_file(wp, buf->b_fnum); -+ - if (action == DOBUF_WIPE_REUSE) - { - // we can re-use this buffer number, store it -diff --git a/src/mark.c b/src/mark.c -index 22e3c6257..85f7b68e2 100644 ---- a/src/mark.c -+++ b/src/mark.c -@@ -129,6 +129,40 @@ setmark_pos(int c, pos_T *pos, int fnum) - return FAIL; - } - -+/* -+ * Delete every entry referring to file 'fnum' from both the jumplist and the -+ * tag stack. -+ */ -+ void -+mark_forget_file(win_T *wp, int fnum) -+{ -+ int i; -+ -+ for (i = 0; i < wp->w_jumplistlen; ++i) -+ if (wp->w_jumplist[i].fmark.fnum == fnum) -+ { -+ vim_free(wp->w_jumplist[i].fname); -+ mch_memmove(&wp->w_jumplist[i], &wp->w_jumplist[i + 1], -+ (wp->w_jumplistlen - i - 1) * sizeof(xfmark_T)); -+ if (wp->w_jumplistidx > i) -+ --wp->w_jumplistidx; -+ --wp->w_jumplistlen; -+ --i; -+ } -+ -+ for (i = 0; i < wp->w_tagstacklen; i++) -+ if (wp->w_tagstack[i].fmark.fnum == fnum) -+ { -+ tagstack_clear_entry(&wp->w_tagstack[i]); -+ mch_memmove(&wp->w_tagstack[i], &wp->w_tagstack[i + 1], -+ (wp->w_tagstacklen - i - 1) * sizeof(taggy_T)); -+ if (wp->w_tagstackidx > i) -+ --wp->w_tagstackidx; -+ --wp->w_tagstacklen; -+ --i; -+ } -+} -+ - /* - * Set the previous context mark to the current position and add it to the - * jump list. -diff --git a/src/proto/mark.pro b/src/proto/mark.pro -index cc45f0d3c..d398c3677 100644 ---- a/src/proto/mark.pro -+++ b/src/proto/mark.pro -@@ -28,4 +28,5 @@ void set_last_cursor(win_T *win); - void free_all_marks(void); - xfmark_T *get_namedfm(void); - void f_getmarklist(typval_T *argvars, typval_T *rettv); -+void mark_forget_file(win_T *wp, int fnum); - /* vim: set ft=c : */ -diff --git a/src/proto/tag.pro b/src/proto/tag.pro -index 6de463e92..eec7c24ed 100644 ---- a/src/proto/tag.pro -+++ b/src/proto/tag.pro -@@ -14,4 +14,5 @@ int expand_tags(int tagnames, char_u *pat, int *num_file, char_u ***file); - int get_tags(list_T *list, char_u *pat, char_u *buf_fname); - void get_tagstack(win_T *wp, dict_T *retdict); - int set_tagstack(win_T *wp, dict_T *d, int action); -+void tagstack_clear_entry(taggy_T *item); - /* vim: set ft=c : */ -diff --git a/src/tag.c b/src/tag.c -index d406fdec1..57f9fe016 100644 ---- a/src/tag.c -+++ b/src/tag.c -@@ -144,7 +144,6 @@ static void print_tag_list(int new_tag, int use_tagstack, int num_matches, char_ - #if defined(FEAT_QUICKFIX) && defined(FEAT_EVAL) - static int add_llist_tags(char_u *tag, int num_matches, char_u **matches); - #endif --static void tagstack_clear_entry(taggy_T *item); - - static char_u *tagmatchname = NULL; // name of last used tag - -@@ -4225,7 +4224,7 @@ find_extra(char_u **pp) - /* - * Free a single entry in a tag stack - */ -- static void -+ void - tagstack_clear_entry(taggy_T *item) - { - VIM_CLEAR(item->tagname); -diff --git a/src/testdir/test_jumplist.vim b/src/testdir/test_jumplist.vim -index 8fbf39f55..0f43a8c6e 100644 ---- a/src/testdir/test_jumplist.vim -+++ b/src/testdir/test_jumplist.vim -@@ -62,26 +62,16 @@ endfunc - func Test_jumplist_invalid() - new - clearjumps -- " put some randome text -- put ='a' -- let prev = bufnr('%') -+ " Put some random text and fill the jump list. -+ call setline(1, ['foo', 'bar', 'baz']) -+ normal G -+ normal gg - setl nomodified bufhidden=wipe - e XXJumpListBuffer -- let bnr = bufnr('%') -- " 1) empty jumplist -- let expected = [[ -- \ {'lnum': 2, 'bufnr': prev, 'col': 0, 'coladd': 0}], 1] -- call assert_equal(expected, getjumplist()) -+ " The jump list is empty as the buffer was wiped out. -+ call assert_equal([[], 0], getjumplist()) - let jumps = execute(':jumps') - call assert_equal('>', jumps[-1:]) -- " now jump back -- exe ":norm! \" -- let expected = [[ -- \ {'lnum': 2, 'bufnr': prev, 'col': 0, 'coladd': 0}, -- \ {'lnum': 1, 'bufnr': bnr, 'col': 0, 'coladd': 0}], 0] -- call assert_equal(expected, getjumplist()) -- let jumps = execute(':jumps') -- call assert_match('> 0 2 0 -invalid-', jumps) - endfunc - - " Test for '' mark in an empty buffer -diff --git a/src/testdir/test_tagjump.vim b/src/testdir/test_tagjump.vim -index 432906efb..71237855c 100644 ---- a/src/testdir/test_tagjump.vim -+++ b/src/testdir/test_tagjump.vim -@@ -943,6 +943,23 @@ func Test_tag_stack() - call settagstack(1, {'items' : []}) - call assert_fails('pop', 'E73:') - -+ " References to wiped buffer are deleted. -+ for i in range(10, 20) -+ edit Xtest -+ exe "tag var" .. i -+ endfor -+ edit Xtest -+ -+ let t = gettagstack() -+ call assert_equal(11, t.length) -+ call assert_equal(12, t.curidx) -+ -+ bwipe! -+ -+ let t = gettagstack() -+ call assert_equal(0, t.length) -+ call assert_equal(1, t.curidx) -+ - set tags& - %bwipe - endfunc --- -2.33.0 - diff --git a/backport-vim-7.0-rclocation.patch b/backport-vim-7.0-rclocation.patch deleted file mode 100644 index 00b3fc011ebc38434c67eea69c42e028691fd551..0000000000000000000000000000000000000000 --- a/backport-vim-7.0-rclocation.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 54a4d7d5afe1157778223c9c97563b115b9341bc Mon Sep 17 00:00:00 2001 -From: Zdenek Dohnal -Date: 2003-08-04 15:38:05.000000000 +0200 -Subject: [PATCH] vim-7.0-rclocation.patch - -new /usr/share/vim/{vimrc,virc} symlinks are created forloading /etc/{vimrc,virc}. -New symlinks point to original files in /etc. ---- - src/os_unix.h | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/src/os_unix.h b/src/os_unix.h -index 00ae239..a0c9485 100644 ---- a/src/os_unix.h -+++ b/src/os_unix.h -@@ -217,10 +217,10 @@ typedef struct dsc$descriptor DESC; - * Unix system-dependent file names - */ - #ifndef SYS_VIMRC_FILE --# define SYS_VIMRC_FILE "$VIM/vimrc" -+# define SYS_VIMRC_FILE "/etc/vimrc" - #endif - #ifndef SYS_GVIMRC_FILE --# define SYS_GVIMRC_FILE "$VIM/gvimrc" -+# define SYS_GVIMRC_FILE "/etc/gvimrc" - #endif - #ifndef DFLT_HELPFILE - # define DFLT_HELPFILE "$VIMRUNTIME/doc/help.txt" --- -2.27.0 - diff --git a/vim-7.4-fstabsyntax.patch b/vim-7.4-fstabsyntax.patch deleted file mode 100644 index a779af1130f2cf5ee946cbdc5ae12c576ff61531..0000000000000000000000000000000000000000 --- a/vim-7.4-fstabsyntax.patch +++ /dev/null @@ -1,21 +0,0 @@ -diff -up vim82/runtime/syntax/fstab.vim.fstabsyntax vim82/runtime/syntax/fstab.vim ---- vim82/runtime/syntax/fstab.vim.fstabsyntax 2020-08-10 12:08:01.000000000 +0200 -+++ vim82/runtime/syntax/fstab.vim 2020-08-10 12:17:22.540855735 +0200 -@@ -56,7 +56,7 @@ syn keyword fsMountPointKeyword contained none swap - " Type - syn cluster fsTypeCluster contains=fsTypeKeyword,fsTypeUnknown - syn match fsTypeUnknown /\s\+\zs\w\+/ contained --syn keyword fsTypeKeyword contained adfs ados affs anon_inodefs atfs audiofs auto autofs bdev befs bfs btrfs binfmt_misc cd9660 ceph cfs cgroup cifs coda coherent configfs cpuset cramfs debugfs devfs devpts devtmpfs dlmfs e2compr ecryptfs efivarfs efs erofs exfat ext2 ext2fs ext3 ext4 f2fs fdesc ffs filecore fuse fuseblk fusectl gfs2 hfs hfsplus hpfs hugetlbfs iso9660 jffs jffs2 jfs kernfs lfs linprocfs mfs minix mqueue msdos ncpfs nfs nfs4 nfsd nilfs2 none ntfs ntfs3 null nwfs ocfs2 omfs overlay ovlfs pipefs portal proc procfs pstore ptyfs pvfs2 qnx4 qnx6 reiserfs ramfs romfs rpc_pipefs securityfs shm smbfs spufs squashfs sockfs sshfs std subfs swap sysfs sysv tcfs tmpfs ubifs udf ufs umap umsdos union usbfs userfs v9fs vfat virtiofs vs3fs vxfs wrapfs wvfs xenfs xenix xfs zisofs zonefs -+syn keyword fsTypeKeyword contained adfs ados affs anon_inodefs atfs audiofs auto autofs bdev befs bfs btrfs binfmt_misc cd9660 cfs cgroup cifs coda configfs cpuset cramfs devfs devpts devtmpfs e2compr efs ext2 ext2fs ext3 ext4 fdesc ffs filecore fuse fuseblk fusectl hfs hpfs hugetlbfs iso9660 jffs jffs2 jfs kernfs lfs linprocfs mfs minix mqueue msdos ncpfs nfs nfsd nilfs2 none ntfs null nwfs overlay ovlfs pipefs portal proc procfs pstore ptyfs qnx4 reiserfs ramfs romfs rpc_pipefs securityfs shm smbfs squashfs sockfs sshfs std subfs swap sysfs sysv tcfs tmpfs udf ufs umap umsdos union usbfs userfs vfat vs3fs vxfs wrapfs wvfs xenfs xfs zisofs - - " Options - " ------- -@@ -72,7 +72,7 @@ syn keyword fsOptionsYN y n - syn keyword fsOptions01 0 1 - syn cluster fsOptionsCheckCluster contains=fsOptionsExt2Check,fsOptionsFatCheck - syn keyword fsOptionsSize 512 1024 2048 --syn keyword fsOptionsGeneral async atime auto bind current defaults dev devgid devmode devmtime devuid dirsync exec force fstab kudzu loop managed mand move noatime noauto noclusterr noclusterw nodev nodevmtime nodiratime noexec nomand norelatime nosuid nosymfollow nouser owner pamconsole rbind rdonly relatime remount ro rq rw suid suiddir supermount sw sync union update user users wxallowed xx nofail failok lazytime -+syn keyword fsOptionsGeneral async atime auto bind current defaults dev devgid devmode devmtime devuid dirsync exec force fstab kudzu loop managed mand move noatime noauto noclusterr noclusterw nodev nodevmtime nodiratime noexec nomand norelatime nosuid nosymfollow nouser owner pamconsole rbind rdonly relatime remount ro rq rw suid suiddir supermount sw sync union update user users wxallowed xx nofail - syn match fsOptionsGeneral /_netdev/ - - syn match fsOptionsKeywords contained /\= 0.2.93 libtool make chrpath %if %{_with_selinux__} BuildRequires: libselinux-devel @@ -93,10 +66,9 @@ The minimal package provides a minimal version of vim editor. It will be install %package enhanced Summary: This is a package containing enhanced vim editor. -Requires: vim-common = %{epoch}:%{version}-%{release} which gpm-libs +Requires: vim-common = %{epoch}:%{version}-%{release} which Provides: vim = %{version}-%{release} %{_bindir}/mergetool %{_bindir}/vim -Suggests: python3 python3-libs -Suggests: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) +Suggests: python3 python3-libS Suggests: perl-libs perl-devel %if %{_with_ruby__} Suggests: ruby-libs ruby @@ -118,11 +90,9 @@ This package contains the vim filesystem. %package X11 Summary: Vim for the X Window System i.e.gvim BuildRequires: gtk3-devel libX11-devel libSM-devel libXt-devel libXpm-devel libICE-devel libappstream-glib -Requires: vim-common = %{epoch}:%{version}-%{release} libattr >= 2.4 gtk3 hicolor-icon-theme -Requires: libICE libSM libX11 libXt cairo gdk-pixbuf2 pango +Requires: vim-common = %{epoch}:%{version}-%{release} libattr >= 2.4 hicolor-icon-theme Provides: gvim = %{version}-%{release} %{_bindir}/mergetool %{_bindir}/gvim Suggests: python3 python3-libs -Suggests: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) Suggests: perl-libs perl-devel %if %{_with_ruby__} Suggests: ruby-libs ruby @@ -135,7 +105,7 @@ Suggests: lua-libs This X11 package serves you the ability to use vim with graphics and mouse. %prep -%autosetup -b 0 -n %{name}-%{baseversion}.%{patchlevel} -p1 +%autosetup -n %{name}-%{baseversion}.%{patchlevel} -p1 #ipv6 test fail in CI, it should be related to the ipv6 configuration on jenkins, which is successful on openEuler obs rm -rf src/testdir/test_channel.* @@ -143,19 +113,17 @@ rm -rf src/testdir/test_channel.* %build %define _make_cmd__() %{make_build} VIMRCLOC=/etc VIMRUNTIMEDIR=/usr/share/vim/%{vimdir}; cp vim %{?1}; %{!?2:make clean} -export CFLAGS="%{optflags} -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_FORTIFY_SOURCE=2 -I%{_python3path__} -D__linux__ -D_REENTRANT" -export CXXFLAGS="%{optflags} -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_FORTIFY_SOURCE=2 -I%{_python3path__} -D__linux__ -D_REENTRANT" +export CFLAGS="%{optflags} -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_FORTIFY_SOURCE=2 -D__linux__ -D_REENTRANT" +export CXXFLAGS="%{optflags} -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_FORTIFY_SOURCE=2 -D__linux__ -D_REENTRANT" sed -i 's/nawk/awk/g' runtime/tools/mve.awk cd src; autoconf -cp -f os_unix.h os_unix.h.bak - -sed -i 's/vimrc/virc/' os_unix.h -%configure --with-features=small --with-x=no --enable-multibyte --disable-netbeans \ +%configure CFLAGS="${CFLAGS} -DSYS_VIMRC_FILE='\"/etc/virc\"'" \ + --with-features=small --with-x=no --enable-multibyte --disable-netbeans --disable-libsodium \ --disable-pythoninterp --disable-perlinterp --disable-tclinterp --with-tlib=ncurses \ --enable-gui=no --disable-gpm --exec-prefix=/ \ - --enable-fail-if-missing --with-python3-config-dir=/usr/lib64/python%{python_ver}/config-%{python_ver}-%{_arch}-linux-gnu \ + --enable-fail-if-missing --with-python3-config-dir=/usr/lib64/python%{python3_version}/config-%{python3_version}-%{_arch}-linux-gnu \ %if %{_with_selinux__} --enable-selinux \ %else @@ -164,12 +132,11 @@ sed -i 's/vimrc/virc/' os_unix.h %{_make_cmd__ vim-minimal} -mv os_unix.h.bak os_unix.h - -%configure --with-features=huge --enable-python3interp=dynamic \ +%configure CFLAGS="${CFLAGS} -DSYS_VIMRC_FILE='\"/etc/vimrc\"'" \ + --with-features=huge --enable-python3interp=dynamic --enable-libsodium \ --enable-perlinterp=dynamic --disable-tclinterp --with-x=yes --enable-xim --enable-multibyte \ --with-tlib=ncurses --enable-gtk3-check --enable-gui=gtk3 \ - --enable-cscope --enable-fail-if-missing --with-python3-config-dir=/usr/lib64/python%{python_ver}/config-%{python_ver}-%{_arch}-linux-gnu \ + --enable-cscope --enable-fail-if-missing --with-python3-config-dir=/usr/lib64/python%{python3_version}/config-%{python3_version}-%{_arch}-linux-gnu \ %if %{_with_netbeans__} --enable-netbeans \ %else @@ -193,9 +160,10 @@ mv os_unix.h.bak os_unix.h %{_make_cmd__ vim-X11} -%configure --with-features=huge --enable-python3interp=dynamic \ +%configure CFLAGS="${CFLAGS} -DSYS_VIMRC_FILE='\"/etc/vimrc\"'" \ + --with-features=huge --enable-python3interp=dynamic --enable-libsodium \ --enable-perlinterp=dynamic --disable-tclinterp --with-x=no --enable-gui=no --enable-multibyte \ - --enable-cscope --with-tlib=ncurses --with-python3-config-dir=/usr/lib64/python%{python_ver}/config-%{python_ver}-%{_arch}-linux-gnu \ + --enable-cscope --with-tlib=ncurses --with-python3-config-dir=/usr/lib64/python%{python3_version}/config-%{python3_version}-%{_arch}-linux-gnu \ --enable-fail-if-missing \ %if %{_with_netbeans__} --enable-netbeans \ @@ -250,10 +218,12 @@ cat > %{buildroot}%{_metainfodir}/gvim.appdata.xml < SentUpstream: 2014-05-22 --> - - gvim.desktop + + org.vim.Vim + GVim CC0-1.0 Vim + The VIM version of the vi editor for the X Window System

Vim is an advanced text editor that seeks to provide the power of the @@ -268,14 +238,23 @@ SentUpstream: 2014-05-22 Vim is perfect for all kinds of text editing, from composing email to editing configuration files.

+

+ We ship the current Vim stable release - %{baseversion} - with the upstream + patchlevel %{patchlevel} applied, which is combined into version %{version} + used during packaging. +

+ + + https://raw.githubusercontent.com/zdohnal/vim/zdohnal-screenshot/gvim16_9.png http://www.vim.org/ - + + EOF %define _linkvi__ %{buildroot}%{_bindir}/{rvi,rview,view,ex} @@ -291,8 +270,8 @@ pushd %{buildroot}%{_mandir}/man1 sed -i 's,%{buildroot},,' {vim.1,vimtutor.1} rm -f rvim.1 install -p vim.1 vi.1 -ln -sf vi.1.gz rvi.1.gz -ln -sf vim.1.gz vimdiff.1.gz +ln -sf vi.1 rvi.1 +ln -sf vim.1 vimdiff.1 popd desktop-file-install --dir %{buildroot}%{_datadir}/applications %{_builddir}/%{name}-%{baseversion}.%{patchlevel}/runtime/gvim.desktop @@ -313,19 +292,24 @@ popd install -Dpm644 %{SOURCE1} %{buildroot}%{_sysconfdir}/virc install -pm644 %{SOURCE2} %{buildroot}%{_sysconfdir}/vimrc -pushd %{buildroot}%{_mandir} -for files in `find ??/ -type f` -do - if [[ "`file ${files}`" == *UTF-8\ Unicode\ text* ]] - then - continue - fi - iconv -f latin1 -t UTF8 ${files} -o ${files}.bak; mv ${files}.bak ${files} +rm -f %{buildroot}/%{_datadir}/vim/%{vimdir}/macros/maze/maze*.c +rm -rf %{buildroot}/%{_datadir}/vim/%{vimdir}/tools +rm -rf %{buildroot}/%{_datadir}/vim/%{vimdir}/doc/vim2html.pl +rm -f %{buildroot}/%{_datadir}/vim/%{vimdir}/tutor/tutor.gr.utf-8~ + +# Remove not UTF-8 manpages +for i in pl.ISO8859-2 it.ISO8859-1 ru.KOI8-R fr.ISO8859-1 da.ISO8859-1 de.ISO8859-1 tr.ISO8859-9; do + rm -rf %{buildroot}/%{_mandir}/$i done -popd +# use common man1/ru directory mv %{buildroot}%{_mandir}/ru.UTF-8 %{buildroot}%{_mandir}/ru +# Remove duplicate man pages +for i in fr.UTF-8 it.UTF-8 pl.UTF-8 da.UTF-8 de.UTF-8 tr.UTF-8; do + rm -rf %{buildroot}/%{_mandir}/$i +done + install -d %{buildroot}%{_mandir}/man5 for files in %{buildroot}%{_mandir}/{man1/{rvim.1,gvim.1,gex.1,gview.1,vimx.1},man5/vimrc.5} do @@ -339,9 +323,6 @@ touch %{buildroot}%{_datadir}/%{name}/vimfiles/doc/tags chrpath -d %{buildroot}%{_bindir}/vim chrpath -d %{buildroot}%{_bindir}/xxd -mkdir -p %{buildroot}/etc/ld.so.conf.d -echo "%{_libdir}/perl5/CORE" > %{buildroot}/etc/ld.so.conf.d/%{name}-%{_arch}.conf - pushd runtime ln -sf ../../%{name}/%{vimdir}/doc docs popd @@ -358,12 +339,6 @@ export TERM=xterm LC_ALL=en_US.UTF-8 make -j1 test || echo "Warning: Please check tests." %files common -%exclude %{_datadir}/vim/%{vimdir}/macros/maze/maze*.c -%exclude %{_datadir}/vim/%{vimdir}/tools -%exclude %{_datadir}/vim/%{vimdir}/doc/vim2html.pl -%exclude %{_mandir}/{pl.ISO8859-2,it.ISO8859-1,ru.KOI8-R,fr.ISO8859-1,da.ISO8859-1} -%exclude %{_mandir}/{de.ISO8859-1,fr.UTF-8,it.UTF-8,pl.UTF-8,da.UTF-8,de.UTF-8} -%{!?_licensedir:%global license %%doc} %license LICENSE %doc README* %doc runtime/docs @@ -386,6 +361,7 @@ LC_ALL=en_US.UTF-8 make -j1 test || echo "Warning: Please check tests." %lang(fi) %{_datadir}/%{name}/%{vimdir}/lang/fi %lang(fr) %{_datadir}/%{name}/%{vimdir}/lang/fr %lang(ga) %{_datadir}/%{name}/%{vimdir}/lang/ga +%lang(hu) %{_datadir}/%{name}/%{vimdir}/lang/hu %lang(it) %{_datadir}/%{name}/%{vimdir}/lang/it %lang(ja) %{_datadir}/%{name}/%{vimdir}/lang/ja %lang(ja.euc-jp) %{_datadir}/%{name}/%{vimdir}/lang/ja.euc-jp @@ -423,12 +399,9 @@ LC_ALL=en_US.UTF-8 make -j1 test || echo "Warning: Please check tests." %lang(pl) %{_mandir}/pl/man1/* %lang(ru) %{_mandir}/ru/man1/* %lang(tr) %{_mandir}/tr/man1/* -%lang(tr.ISO8859-9) %{_mandir}/tr.ISO8859-9/man1/* -%lang(tr.UTF-8) %{_mandir}/tr.UTF-8/man1/* %{_mandir}/man1/{gex.*,gview.*,gvim*,rvim.*,vim.*,vimdiff.*} %{_mandir}/man1/{vimtutor.*,vimx.*,xxd.*} %{_mandir}/man5/vimrc.* -%config(noreplace) /etc/ld.so.conf.d/* %files minimal %config(noreplace) %{_sysconfdir}/virc @@ -439,7 +412,6 @@ LC_ALL=en_US.UTF-8 make -j1 test || echo "Warning: Please check tests." %files enhanced %{_bindir}/{vim,rvim,vimdiff,vimtutor} -%config(noreplace) /etc/ld.so.conf.d/* %files filesystem %dir %{_datadir}/%{name}/vimfiles/after/* @@ -448,7 +420,7 @@ LC_ALL=en_US.UTF-8 make -j1 test || echo "Warning: Please check tests." %ghost %{_datadir}/%{name}/vimfiles/doc/tags %files X11 -%exclude /%{_datadir}/applications/vim.desktop +%exclude %{_datadir}/applications/vim.desktop %{_datadir}/metainfo/*.appdata.xml %{_datadir}/applications/* %{_datadir}/icons/{hicolor,locolor}/*/apps/* @@ -457,6 +429,9 @@ LC_ALL=en_US.UTF-8 make -j1 test || echo "Warning: Please check tests." %{_mandir}/man1/evim.* %changelog +* Mon Sep 02 2024 Funda Wang - 2:9.1.0709-1 +- update to 9.1 patchlevel 0709 + * Thu Aug 29 2024 wangjiang - 2:9.0.2092-11 - Type:CVE - ID:CVE-2024-43802