Blame SOURCES/0001-patch-8.2.5023-substitute-overwrites-allocated-buffe.patch

f520a9
diff -up vim82/src/normal.c.cve1897 vim82/src/normal.c
f520a9
--- vim82/src/normal.c.cve1897	2022-06-13 09:31:42.880768567 +0200
f520a9
+++ vim82/src/normal.c	2022-06-13 09:35:38.560084927 +0200
f520a9
@@ -479,6 +479,22 @@ find_command(int cmdchar)
f520a9
 }
f520a9
 
f520a9
 /*
f520a9
+ * If currently editing a cmdline or text is locked: beep and give an error
f520a9
+ * message, return TRUE.
f520a9
+ */
f520a9
+    static int
f520a9
+check_text_locked(oparg_T *oap)
f520a9
+{
f520a9
+    if (text_locked())
f520a9
+    {
f520a9
+	clearopbeep(oap);
f520a9
+	text_locked_msg();
f520a9
+	return TRUE;
f520a9
+    }
f520a9
+    return FALSE;
f520a9
+}
f520a9
+
f520a9
+/*
f520a9
  * Execute a command in Normal mode.
f520a9
  */
f520a9
     void
f520a9
@@ -742,14 +758,9 @@ getcount:
f520a9
 	goto normal_end;
f520a9
     }
f520a9
 
f520a9
-    if (text_locked() && (nv_cmds[idx].cmd_flags & NV_NCW))
f520a9
-    {
f520a9
-	// This command is not allowed while editing a cmdline: beep.
f520a9
-	clearopbeep(oap);
f520a9
-	text_locked_msg();
f520a9
-	goto normal_end;
f520a9
-    }
f520a9
-    if ((nv_cmds[idx].cmd_flags & NV_NCW) && curbuf_locked())
f520a9
+    if ((nv_cmds[idx].cmd_flags & NV_NCW)
f520a9
+				&& (check_text_locked(oap) || curbuf_locked()))
f520a9
+	// this command is not allowed now
f520a9
 	goto normal_end;
f520a9
 
f520a9
     /*
f520a9
@@ -4212,12 +4223,8 @@ nv_gotofile(cmdarg_T *cap)
f520a9
     char_u	*ptr;
f520a9
     linenr_T	lnum = -1;
f520a9
 
f520a9
-    if (text_locked())
f520a9
-    {
f520a9
-	clearopbeep(cap->oap);
f520a9
-	text_locked_msg();
f520a9
+    if (check_text_locked(cap->oap))
f520a9
 	return;
f520a9
-    }
f520a9
     if (curbuf_locked())
f520a9
     {
f520a9
 	clearop(cap->oap);
f520a9
@@ -6343,14 +6350,7 @@ nv_g_cmd(cmdarg_T *cap)
f520a9
 
f520a9
     // "gQ": improved Ex mode
f520a9
     case 'Q':
f520a9
-	if (text_locked())
f520a9
-	{
f520a9
-	    clearopbeep(cap->oap);
f520a9
-	    text_locked_msg();
f520a9
-	    break;
f520a9
-	}
f520a9
-
f520a9
-	if (!checkclearopq(oap))
f520a9
+	if (!check_text_locked(cap->oap) && !checkclearopq(oap))
f520a9
 	    do_exmode(TRUE);
f520a9
 	break;
f520a9
 
f520a9
diff -up vim82/src/testdir/test_substitute.vim.cve1897 vim82/src/testdir/test_substitute.vim
f520a9
--- vim82/src/testdir/test_substitute.vim.cve1897	2022-06-13 09:31:42.938768884 +0200
f520a9
+++ vim82/src/testdir/test_substitute.vim	2022-06-13 09:36:39.013406036 +0200
f520a9
@@ -955,5 +955,27 @@ func Test_sub_change_window()
f520a9
   delfunc Repl
f520a9
 endfunc
f520a9
 
f520a9
+" This was undoign a change in between computing the length and using it.
f520a9
+func Do_Test_sub_undo_change()
f520a9
+  new
f520a9
+  norm o0000000000000000000000000000000000000000000000000000
f520a9
+  silent! s/\%')/\=Repl()
f520a9
+  bwipe!
f520a9
+endfunc
f520a9
+
f520a9
+func Test_sub_undo_change()
f520a9
+  func Repl()
f520a9
+    silent! norm g-
f520a9
+  endfunc
f520a9
+  call Do_Test_sub_undo_change()
f520a9
+
f520a9
+  func! Repl()
f520a9
+    silent earlier
f520a9
+  endfunc
f520a9
+  call Do_Test_sub_undo_change()
f520a9
+
f520a9
+  delfunc Repl
f520a9
+endfunc
f520a9
+
f520a9
 
f520a9
 " vim: shiftwidth=2 sts=2 expandtab
f520a9
diff -up vim82/src/undo.c.cve1897 vim82/src/undo.c
f520a9
--- vim82/src/undo.c.cve1897	2022-06-13 09:31:42.904768698 +0200
f520a9
+++ vim82/src/undo.c	2022-06-13 09:31:42.938768884 +0200
f520a9
@@ -2323,6 +2323,12 @@ undo_time(
f520a9
     int		    above = FALSE;
f520a9
     int		    did_undo = TRUE;
f520a9
 
f520a9
+    if (text_locked())
f520a9
+    {
f520a9
+	text_locked_msg();
f520a9
+	return;
f520a9
+    }
f520a9
+
f520a9
     // First make sure the current undoable change is synced.
f520a9
     if (curbuf->b_u_synced == FALSE)
f520a9
 	u_sync(TRUE);