diff --git a/7.2.436 b/7.2.436
new file mode 100644
index 0000000..6469d6d
--- /dev/null
+++ b/7.2.436
@@ -0,0 +1,107 @@
+To: vim-dev@vim.org
+Subject: Patch 7.2.436
+Fcc: outbox
+From: Bram Moolenaar <Bram@moolenaar.net>
+Mime-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+------------
+
+Patch 7.2.436
+Problem: Reproducible crash in syntax HL. (George Reilly, Dominique Pelle)
+Solution: Make sst_stacksize an int instead of short. (Dominique Pelle)
+Files: src/structs.h
+
+
+*** ../vim-7.2.435/src/structs.h 2010-05-14 22:24:31.000000000 +0200
+--- src/structs.h 2010-05-16 13:48:26.000000000 +0200
+***************
+*** 327,333 ****
+ typedef struct m_info minfo_T;
+
+ /*
+! * stucture used to link chunks in one of the free chunk lists.
+ */
+ struct m_info
+ {
+--- 327,333 ----
+ typedef struct m_info minfo_T;
+
+ /*
+! * structure used to link chunks in one of the free chunk lists.
+ */
+ struct m_info
+ {
+***************
+*** 795,803 ****
+ garray_T sst_ga; /* growarray for long state stack */
+ } sst_union;
+ int sst_next_flags; /* flags for sst_next_list */
+ short *sst_next_list; /* "nextgroup" list in this state
+ * (this is a copy, don't free it! */
+- short sst_stacksize; /* number of states on the stack */
+ disptick_T sst_tick; /* tick when last displayed */
+ linenr_T sst_change_lnum;/* when non-zero, change in this line
+ * may have made the state invalid */
+--- 795,803 ----
+ garray_T sst_ga; /* growarray for long state stack */
+ } sst_union;
+ int sst_next_flags; /* flags for sst_next_list */
++ int sst_stacksize; /* number of states on the stack */
+ short *sst_next_list; /* "nextgroup" list in this state
+ * (this is a copy, don't free it! */
+ disptick_T sst_tick; /* tick when last displayed */
+ linenr_T sst_change_lnum;/* when non-zero, change in this line
+ * may have made the state invalid */
+***************
+*** 2138,2144 ****
+ #define SHAPE_IDX_CI 5 /* Command line Insert mode */
+ #define SHAPE_IDX_CR 6 /* Command line Replace mode */
+ #define SHAPE_IDX_O 7 /* Operator-pending mode */
+! #define SHAPE_IDX_VE 8 /* Visual mode with 'seleciton' exclusive */
+ #define SHAPE_IDX_CLINE 9 /* On command line */
+ #define SHAPE_IDX_STATUS 10 /* A status line */
+ #define SHAPE_IDX_SDRAG 11 /* dragging a status line */
+--- 2138,2144 ----
+ #define SHAPE_IDX_CI 5 /* Command line Insert mode */
+ #define SHAPE_IDX_CR 6 /* Command line Replace mode */
+ #define SHAPE_IDX_O 7 /* Operator-pending mode */
+! #define SHAPE_IDX_VE 8 /* Visual mode with 'selection' exclusive */
+ #define SHAPE_IDX_CLINE 9 /* On command line */
+ #define SHAPE_IDX_STATUS 10 /* A status line */
+ #define SHAPE_IDX_SDRAG 11 /* dragging a status line */
+***************
+*** 2267,2273 ****
+ /* short index; */ /* the item index within the father menu */
+ short menu_id; /* the menu id to which this item belong */
+ short submenu_id; /* the menu id of the children (could be
+! get throught some tricks) */
+ MenuHandle menu_handle;
+ MenuHandle submenu_handle;
+ #endif
+--- 2267,2273 ----
+ /* short index; */ /* the item index within the father menu */
+ short menu_id; /* the menu id to which this item belong */
+ short submenu_id; /* the menu id of the children (could be
+! get through some tricks) */
+ MenuHandle menu_handle;
+ MenuHandle submenu_handle;
+ #endif
+*** ../vim-7.2.435/src/version.c 2010-05-16 13:26:19.000000000 +0200
+--- src/version.c 2010-05-16 13:54:30.000000000 +0200
+***************
+*** 683,684 ****
+--- 683,686 ----
+ { /* Add new patch number below this line */
++ /**/
++ 436,
+ /**/
+
+--
+hundred-and-one symptoms of being an internet addict:
+47. You are so familiar with the WWW that you find the search engines useless.
+
+ /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net \\\
+/// sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
+\\\ download, build and distribute -- http://www.A-A-P.org ///
+ \\\ help me help AIDS victims -- http://ICCF-Holland.org ///
diff --git a/README.patches b/README.patches
index a78a88c..414e962 100644
--- a/README.patches
+++ b/README.patches
@@ -465,3 +465,6 @@ Individual patches for Vim 7.2:
2599 7.2.431 ":amenu" moves the cursor when in Insert mode
12967 7.2.432 translated menus make :emenu difficult to use
5410 7.2.433 can't use cscope with QuickFixCmdPre and QuickFixCmdPost
+ 2106 7.2.434 (after 7.2.432) compilation fails without multi-lang feature
+ 4590 7.2.435 (after 7.2.430) crash when using bad_char_idx uninitialized
+ 4058 7.2.436 reproducible crash in syntax HL
diff --git a/vim.spec b/vim.spec
index 027a70c..f659c44 100644
--- a/vim.spec
+++ b/vim.spec
@@ -18,7 +18,7 @@
#used for pre-releases:
%define beta %{nil}
%define vimdir vim72%{?beta}
-%define patchlevel 433
+%define patchlevel 436
Summary: The VIM editor
URL: http://www.vim.org/
@@ -499,6 +499,9 @@ Patch430: ftp://ftp.vim.org/pub/vim/patches/7.2/7.2.430
Patch431: ftp://ftp.vim.org/pub/vim/patches/7.2/7.2.431
Patch432: ftp://ftp.vim.org/pub/vim/patches/7.2/7.2.432
Patch433: ftp://ftp.vim.org/pub/vim/patches/7.2/7.2.433
+Patch434: ftp://ftp.vim.org/pub/vim/patches/7.2/7.2.434
+Patch435: ftp://ftp.vim.org/pub/vim/patches/7.2/7.2.435
+Patch436: ftp://ftp.vim.org/pub/vim/patches/7.2/7.2.436
Patch3000: vim-7.0-syntax.patch
Patch3002: vim-7.1-nowarnings.patch
@@ -1070,6 +1073,9 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
%patch431 -p0
%patch432 -p0
%patch433 -p0
+%patch434 -p0
+%patch435 -p0
+%patch436 -p0
# install spell files
@@ -1534,6 +1540,9 @@ rm -rf $RPM_BUILD_ROOT
%{_datadir}/icons/hicolor/*/apps/*
%changelog
+* Sun May 16 2010 Karsten Hopp <karsten@redhat.com> 7.2.436-1
+- patchlevel 436
+
* Sat May 15 2010 Karsten Hopp <karsten@redhat.com> 7.2.433-1
- patchlevel 433