Blame SOURCES/0001-patch-8.2.5023-substitute-overwrites-allocated-buffe.patch

c1b08a
diff -up vim80/src/normal.c.cve1897 vim80/src/normal.c
c1b08a
--- vim80/src/normal.c.cve1897	2022-06-13 14:50:22.800290132 +0200
c1b08a
+++ vim80/src/normal.c	2022-06-13 14:55:06.082861349 +0200
c1b08a
@@ -532,6 +532,22 @@ find_command(int cmdchar)
c1b08a
 }
c1b08a
 
c1b08a
 /*
c1b08a
+ * If currently editing a cmdline or text is locked: beep and give an error
c1b08a
+ * message, return TRUE.
c1b08a
+ */
c1b08a
+    static int
c1b08a
+check_text_locked(oparg_T *oap)
c1b08a
+{
c1b08a
+    if (text_locked())
c1b08a
+    {
c1b08a
+	clearopbeep(oap);
c1b08a
+	text_locked_msg();
c1b08a
+	return TRUE;
c1b08a
+    }
c1b08a
+    return FALSE;
c1b08a
+}
c1b08a
+
c1b08a
+/*
c1b08a
  * Execute a command in Normal mode.
c1b08a
  */
c1b08a
     void
c1b08a
@@ -792,14 +808,9 @@ getcount:
c1b08a
 	goto normal_end;
c1b08a
     }
c1b08a
 
c1b08a
-    if (text_locked() && (nv_cmds[idx].cmd_flags & NV_NCW))
c1b08a
-    {
c1b08a
-	/* This command is not allowed while editing a cmdline: beep. */
c1b08a
-	clearopbeep(oap);
c1b08a
-	text_locked_msg();
c1b08a
-	goto normal_end;
c1b08a
-    }
c1b08a
-    if ((nv_cmds[idx].cmd_flags & NV_NCW) && curbuf_locked())
c1b08a
+    if ((nv_cmds[idx].cmd_flags & NV_NCW)
c1b08a
+				&& (check_text_locked(oap) || curbuf_locked()))
c1b08a
+	// this command is not allowed now
c1b08a
 	goto normal_end;
c1b08a
 
c1b08a
     /*
c1b08a
@@ -6234,12 +6245,8 @@ nv_gotofile(cmdarg_T *cap)
c1b08a
     char_u	*ptr;
c1b08a
     linenr_T	lnum = -1;
c1b08a
 
c1b08a
-    if (text_locked())
c1b08a
-    {
c1b08a
-	clearopbeep(cap->oap);
c1b08a
-	text_locked_msg();
c1b08a
+    if (check_text_locked(cap->oap))
c1b08a
 	return;
c1b08a
-    }
c1b08a
     if (curbuf_locked())
c1b08a
     {
c1b08a
 	clearop(cap->oap);
c1b08a
@@ -8420,14 +8427,7 @@ nv_g_cmd(cmdarg_T *cap)
c1b08a
 
c1b08a
     /* "gQ": improved Ex mode */
c1b08a
     case 'Q':
c1b08a
-	if (text_locked())
c1b08a
-	{
c1b08a
-	    clearopbeep(cap->oap);
c1b08a
-	    text_locked_msg();
c1b08a
-	    break;
c1b08a
-	}
c1b08a
-
c1b08a
-	if (!checkclearopq(oap))
c1b08a
+	if (!check_text_locked(cap->oap) && !checkclearopq(oap))
c1b08a
 	    do_exmode(TRUE);
c1b08a
 	break;
c1b08a
 
c1b08a
diff -up vim80/src/testdir/test_substitute.vim.cve1897 vim80/src/testdir/test_substitute.vim
c1b08a
--- vim80/src/testdir/test_substitute.vim.cve1897	2022-06-13 14:50:22.849290402 +0200
c1b08a
+++ vim80/src/testdir/test_substitute.vim	2022-06-13 14:55:50.370111134 +0200
c1b08a
@@ -513,3 +513,26 @@ func Test_sub_change_window()
c1b08a
   bwipe!
c1b08a
   delfunc Repl
c1b08a
 endfunc
c1b08a
+
c1b08a
+" This was undoign a change in between computing the length and using it.
c1b08a
+func Do_Test_sub_undo_change()
c1b08a
+  new
c1b08a
+  norm o0000000000000000000000000000000000000000000000000000
c1b08a
+  silent! s/\%')/\=Repl()
c1b08a
+  bwipe!
c1b08a
+endfunc
c1b08a
+
c1b08a
+func Test_sub_undo_change()
c1b08a
+  func Repl()
c1b08a
+    silent! norm g-
c1b08a
+  endfunc
c1b08a
+  call Do_Test_sub_undo_change()
c1b08a
+
c1b08a
+  func! Repl()
c1b08a
+    silent earlier
c1b08a
+  endfunc
c1b08a
+  call Do_Test_sub_undo_change()
c1b08a
+
c1b08a
+  delfunc Repl
c1b08a
+endfunc
c1b08a
+
c1b08a
diff -up vim80/src/undo.c.cve1897 vim80/src/undo.c
c1b08a
--- vim80/src/undo.c.cve1897	2022-06-13 14:50:22.849290402 +0200
c1b08a
+++ vim80/src/undo.c	2022-06-13 14:56:57.916492090 +0200
c1b08a
@@ -2283,6 +2283,12 @@ undo_time(
c1b08a
     if (curbuf->b_u_synced == FALSE)
c1b08a
 	u_sync(TRUE);
c1b08a
 
c1b08a
+    if (text_locked())
c1b08a
+    {
c1b08a
+	text_locked_msg();
c1b08a
+	return;
c1b08a
+    }
c1b08a
+
c1b08a
     u_newcount = 0;
c1b08a
     u_oldcount = 0;
c1b08a
     if (curbuf->b_ml.ml_flags & ML_EMPTY)