diff --git a/SOURCES/0001-patch-8.2.3406-on-some-systems-tests-fail-without-_R.patch b/SOURCES/0001-patch-8.2.3406-on-some-systems-tests-fail-without-_R.patch new file mode 100644 index 0000000..464ad3c --- /dev/null +++ b/SOURCES/0001-patch-8.2.3406-on-some-systems-tests-fail-without-_R.patch @@ -0,0 +1,49 @@ +From 3ae5fc9a6a881e0be381e4cc70080ac5908d7520 Mon Sep 17 00:00:00 2001 +From: Bram Moolenaar +Date: Mon, 6 Sep 2021 18:57:30 +0200 +Subject: [PATCH] patch 8.2.3406: on some systems tests fail without _REENTRANT + +Problem: On some systems tests fail without _REENTRANT. (Elimar + Riesebieter) +Solution: Add -D_REENTRANT in configure. (closes #7402) +--- + src/auto/configure | 4 ++++ + src/configure.ac | 6 ++++++ + src/version.c | 2 ++ + 3 files changed, 12 insertions(+) + +diff --git a/src/auto/configure b/src/auto/configure +index fba6a19b5..4f4363224 100755 +--- a/src/auto/configure ++++ b/src/auto/configure +@@ -14960,6 +14960,10 @@ $as_echo "no" >&6; } + fi + fi + ++if `echo "$CFLAGS" | grep -v D_XEENTRANT >/dev/null`; then ++ CFLAGS="$CFLAGS -D_REENTRANT" ++fi ++ + DEPEND_CFLAGS_FILTER= + if test "$GCC" = yes; then + { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GCC 3 or later" >&5 +diff --git a/src/configure.ac b/src/configure.ac +index 5ec955757..4cd6dea1f 100644 +--- a/src/configure.ac ++++ b/src/configure.ac +@@ -4504,6 +4504,12 @@ if test "$MACOS_X" = "yes"; then + fi + fi + ++dnl On some systems REENTRANT needs to be defined. It should not hurt to use ++dnl it everywhere. ++if `echo "$CFLAGS" | grep -v D_REENTRANT >/dev/null`; then ++ CFLAGS="$CFLAGS -D_REENTRANT" ++fi ++ + dnl gcc 3.1 changed the meaning of -MM. The only solution appears to be to + dnl use "-isystem" instead of "-I" for all non-Vim include dirs. + dnl But only when making dependencies, cproto and lint don't take "-isystem". +-- +2.31.1 + diff --git a/SOURCES/0001-patch-8.2.3409-reading-beyond-end-of-line-with-inval.patch b/SOURCES/0001-patch-8.2.3409-reading-beyond-end-of-line-with-inval.patch new file mode 100644 index 0000000..407d2e7 --- /dev/null +++ b/SOURCES/0001-patch-8.2.3409-reading-beyond-end-of-line-with-inval.patch @@ -0,0 +1,48 @@ +From 65b605665997fad54ef39a93199e305af2fe4d7f Mon Sep 17 00:00:00 2001 +From: Bram Moolenaar +Date: Tue, 7 Sep 2021 19:26:53 +0200 +Subject: [PATCH] patch 8.2.3409: reading beyond end of line with invalid utf-8 + character + +Problem: Reading beyond end of line with invalid utf-8 character. +Solution: Check for NUL when advancing. +--- + src/regexp_nfa.c | 3 ++- + src/testdir/test_regexp_utf8.vim | 8 ++++++++ + src/version.c | 2 ++ + 3 files changed, 12 insertions(+), 1 deletion(-) + +diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c +index 9757d7c47..c7db98187 100644 +--- a/src/regexp_nfa.c ++++ b/src/regexp_nfa.c +@@ -5664,7 +5664,8 @@ find_match_text(colnr_T startcol, int regstart, char_u *match_text) + match = FALSE; + break; + } +- len2 += MB_CHAR2LEN(c2); ++ len2 += enc_utf8 ? utf_ptr2len(rex.line + col + len2) ++ : MB_CHAR2LEN(c2); + } + if (match + // check that no composing char follows +diff --git a/src/testdir/test_regexp_utf8.vim b/src/testdir/test_regexp_utf8.vim +index 9f0ffb9aa..044aeffb6 100644 +--- a/src/testdir/test_regexp_utf8.vim ++++ b/src/testdir/test_regexp_utf8.vim +@@ -558,4 +558,12 @@ func Test_match_char_class_upper() + bwipe! + endfunc + ++func Test_match_invalid_byte() ++ call writefile(0z630a.765d30aa0a.2e0a.790a.4030, 'Xinvalid') ++ new ++ source Xinvalid ++ bwipe! ++ call delete('Xinvalid') ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab +-- +2.31.1 + diff --git a/SOURCES/0001-patch-8.2.3428-using-freed-memory-when-replacing.patch b/SOURCES/0001-patch-8.2.3428-using-freed-memory-when-replacing.patch new file mode 100644 index 0000000..f4860e8 --- /dev/null +++ b/SOURCES/0001-patch-8.2.3428-using-freed-memory-when-replacing.patch @@ -0,0 +1,50 @@ +diff -up vim82/src/normal.c.cve-3796 vim82/src/normal.c +--- vim82/src/normal.c.cve-3796 2021-03-22 10:02:42.000000000 +0100 ++++ vim82/src/normal.c 2021-10-15 10:45:21.397258123 +0200 +@@ -5076,19 +5076,23 @@ nv_replace(cmdarg_T *cap) + { + /* + * Get ptr again, because u_save and/or showmatch() will have +- * released the line. At the same time we let know that the +- * line will be changed. ++ * released the line. This may also happen in ins_copychar(). ++ * At the same time we let know that the line will be changed. + */ +- ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE); + if (cap->nchar == Ctrl_E || cap->nchar == Ctrl_Y) + { + int c = ins_copychar(curwin->w_cursor.lnum + + (cap->nchar == Ctrl_Y ? -1 : 1)); ++ ++ ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE); + if (c != NUL) + ptr[curwin->w_cursor.col] = c; + } + else ++ { ++ ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE); + ptr[curwin->w_cursor.col] = cap->nchar; ++ } + if (p_sm && msg_silent == 0) + showmatch(cap->nchar); + ++curwin->w_cursor.col; +diff -up vim82/src/testdir/test_edit.vim.cve-3796 vim82/src/testdir/test_edit.vim +--- vim82/src/testdir/test_edit.vim.cve-3796 2021-10-15 10:45:21.398258115 +0200 ++++ vim82/src/testdir/test_edit.vim 2021-10-15 10:46:22.892764135 +0200 +@@ -1844,4 +1844,16 @@ func Test_read_invalid() + set encoding=utf-8 + endfunc + ++" Test for getting the character of the line below after "p" ++func Test_edit_put_CTRL_E() ++ set encoding=latin1 ++ new ++ let @" = '' ++ sil! norm orggRx ++ sil! norm pr ++ call assert_equal(['r', 'r'], getline(1, 2)) ++ bwipe! ++ set encoding=utf-8 ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab diff --git a/SOURCES/0001-patch-8.2.3487-illegal-memory-access-if-buffer-name-.patch b/SOURCES/0001-patch-8.2.3487-illegal-memory-access-if-buffer-name-.patch new file mode 100644 index 0000000..df6ef8d --- /dev/null +++ b/SOURCES/0001-patch-8.2.3487-illegal-memory-access-if-buffer-name-.patch @@ -0,0 +1,72 @@ +From 826bfe4bbd7594188e3d74d2539d9707b1c6a14b Mon Sep 17 00:00:00 2001 +From: Bram Moolenaar +Date: Fri, 8 Oct 2021 18:39:28 +0100 +Subject: [PATCH] patch 8.2.3487: illegal memory access if buffer name is very + long + +Problem: Illegal memory access if buffer name is very long. +Solution: Make sure not to go over the end of the buffer. +--- + src/drawscreen.c | 10 +++++----- + src/testdir/test_statusline.vim | 10 ++++++++++ + src/version.c | 2 ++ + 3 files changed, 17 insertions(+), 5 deletions(-) + +diff --git a/src/drawscreen.c b/src/drawscreen.c +index 82e53753b..e38ca9586 100644 +--- a/src/drawscreen.c ++++ b/src/drawscreen.c +@@ -464,13 +464,13 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED) + *(p + len++) = ' '; + if (bt_help(wp->w_buffer)) + { +- STRCPY(p + len, _("[Help]")); ++ vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[Help]")); + len += (int)STRLEN(p + len); + } + #ifdef FEAT_QUICKFIX + if (wp->w_p_pvw) + { +- STRCPY(p + len, _("[Preview]")); ++ vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[Preview]")); + len += (int)STRLEN(p + len); + } + #endif +@@ -480,12 +480,12 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED) + #endif + ) + { +- STRCPY(p + len, "[+]"); +- len += 3; ++ vim_snprintf((char *)p + len, MAXPATHL - len, "%s", "[+]"); ++ len += (int)STRLEN(p + len); + } + if (wp->w_buffer->b_p_ro) + { +- STRCPY(p + len, _("[RO]")); ++ vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[RO]")); + len += (int)STRLEN(p + len); + } + +diff --git a/src/testdir/test_statusline.vim b/src/testdir/test_statusline.vim +index f3eea2e71..a952de69b 100644 +--- a/src/testdir/test_statusline.vim ++++ b/src/testdir/test_statusline.vim +@@ -522,4 +522,14 @@ func Test_statusline_mbyte_fillchar() + %bw! + endfunc + ++" Used to write beyond allocated memory. This assumes MAXPATHL is 4096 bytes. ++func Test_statusline_verylong_filename() ++ let fname = repeat('x', 4090) ++ exe "new " .. fname ++ set buftype=help ++ set previewwindow ++ redraw ++ bwipe! ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab +-- +2.31.1 + diff --git a/SOURCES/vim-7.4-nowarnings.patch b/SOURCES/vim-7.4-nowarnings.patch deleted file mode 100644 index fc4315a..0000000 --- a/SOURCES/vim-7.4-nowarnings.patch +++ /dev/null @@ -1,11 +0,0 @@ -diff -up vim82/src/ex_docmd.c.nowarnings vim82/src/ex_docmd.c ---- vim82/src/ex_docmd.c.nowarnings 2020-07-28 11:42:07.437603829 +0200 -+++ vim82/src/ex_docmd.c 2020-07-28 11:44:25.432201129 +0200 -@@ -4020,6 +4020,7 @@ get_flags(exarg_T *eap) - void - ex_ni(exarg_T *eap) - { -+ return; - if (!eap->skip) - eap->errmsg = - _("E319: Sorry, the command is not available in this version"); diff --git a/SOURCES/vim-7.4-syncolor.patch b/SOURCES/vim-7.4-syncolor.patch deleted file mode 100644 index b41f2fe..0000000 --- a/SOURCES/vim-7.4-syncolor.patch +++ /dev/null @@ -1,26 +0,0 @@ -diff --git a/src/highlight.c b/src/highlight.c -index 9322f96..f7147a0 100644 ---- a/src/highlight.c -+++ b/src/highlight.c -@@ -211,8 +211,8 @@ static char *(highlight_init_light[]) = { - CENT("Visual term=reverse", - "Visual term=reverse guibg=LightGrey"), - #ifdef FEAT_DIFF -- CENT("DiffAdd term=bold ctermbg=LightBlue", -- "DiffAdd term=bold ctermbg=LightBlue guibg=LightBlue"), -+ CENT("DiffAdd term=bold ctermbg=LightRed", -+ "DiffAdd term=bold ctermbg=LightRed guibg=LightBlue"), - CENT("DiffChange term=bold ctermbg=LightMagenta", - "DiffChange term=bold ctermbg=LightMagenta guibg=LightMagenta"), - CENT("DiffDelete term=bold ctermfg=Blue ctermbg=LightCyan", -@@ -304,8 +304,8 @@ static char *(highlight_init_dark[]) = { - CENT("Visual term=reverse", - "Visual term=reverse guibg=DarkGrey"), - #ifdef FEAT_DIFF -- CENT("DiffAdd term=bold ctermbg=DarkBlue", -- "DiffAdd term=bold ctermbg=DarkBlue guibg=DarkBlue"), -+ CENT("DiffAdd term=bold ctermbg=DarkRed", -+ "DiffAdd term=bold ctermbg=DarkRed guibg=DarkBlue"), - CENT("DiffChange term=bold ctermbg=DarkMagenta", - "DiffChange term=bold ctermbg=DarkMagenta guibg=DarkMagenta"), - CENT("DiffDelete term=bold ctermfg=Blue ctermbg=DarkCyan", diff --git a/SOURCES/vim-7.4-syntax.patch b/SOURCES/vim-7.4-syntax.patch index 5131c80..2cd370f 100644 --- a/SOURCES/vim-7.4-syntax.patch +++ b/SOURCES/vim-7.4-syntax.patch @@ -1,11 +1,43 @@ ---- vim74/runtime/filetype.vim.orig 2013-08-12 14:51:58.669350813 +0200 -+++ vim74/runtime/filetype.vim 2013-08-12 14:56:12.432540523 +0200 -@@ -2475,7 +2475,7 @@ +From c669d497d34e4b57f40c19d58e3703401075a6d5 Mon Sep 17 00:00:00 2001 +From: Zdenek Dohnal +Date: Fri, 17 Sep 2021 07:54:56 +0200 +Subject: [PATCH] runtime/filetype.vim: Register more httpd files as apache + filetype + +Several files under /etc/httpd wasn't recognized as 'apache' filetype - +add them to filetype.vim and add tests for checking if recognizition +works. +--- + runtime/filetype.vim | 2 +- + src/testdir/test_filetype.vim | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/runtime/filetype.vim b/runtime/filetype.vim +index d0d40539d..39a772740 100644 +--- a/runtime/filetype.vim ++++ b/runtime/filetype.vim +@@ -2138,7 +2138,7 @@ au BufNewFile,BufRead proftpd.conf* call s:StarSetf('apachestyle') " More Apache config files au BufNewFile,BufRead access.conf*,apache.conf*,apache2.conf*,httpd.conf*,srm.conf* call s:StarSetf('apache') -au BufNewFile,BufRead */etc/apache2/*.conf*,*/etc/apache2/conf.*/*,*/etc/apache2/mods-*/*,*/etc/apache2/sites-*/*,*/etc/httpd/conf.d/*.conf* call s:StarSetf('apache') -+au BufNewFile,BufRead */etc/apache2/*.conf*,*/etc/httpd/conf.*/*,*/etc/httpd/mods-*/*,*/etc/httpd/sites-*/*,*/etc/httpd/conf.d/*.conf*,auth_mysql.conf*,auth_pgsql.conf*,ssl.conf*,perl.conf*,php.conf*,python.conf*,squirrelmail.conf* call s:StarSetf('apache') ++au BufNewFile,BufRead */etc/apache2/*.conf*,*/etc/apache2/conf.*/*,*/etc/apache2/mods-*/*,*/etc/apache2/sites-*/*,*/etc/httpd/conf.*/*,*/etc/httpd/mods-*/*,*/etc/httpd/sites-*/*,*/etc/httpd/conf.d/*.conf* call s:StarSetf('apache') " Asterisk config file au BufNewFile,BufRead *asterisk/*.conf* call s:StarSetf('asterisk') +diff --git a/src/testdir/test_filetype.vim b/src/testdir/test_filetype.vim +index cd6e71d1b..f1404808f 100644 +--- a/src/testdir/test_filetype.vim ++++ b/src/testdir/test_filetype.vim +@@ -59,7 +59,7 @@ let s:filename_checks = { + \ 'aml': ['file.aml'], + \ 'ampl': ['file.run'], + \ 'ant': ['build.xml'], +- \ 'apache': ['.htaccess', '/etc/httpd/file.conf', '/etc/apache2/sites-2/file.com', '/etc/apache2/some.config', '/etc/apache2/conf.file/conf', '/etc/apache2/mods-some/file', '/etc/apache2/sites-some/file', '/etc/httpd/conf.d/file.config', '/etc/apache2/conf.file/file', '/etc/apache2/file.conf', '/etc/apache2/file.conf-file', '/etc/apache2/mods-file/file', '/etc/apache2/sites-file/file', '/etc/apache2/sites-file/file.com', '/etc/httpd/conf.d/file.conf', '/etc/httpd/conf.d/file.conf-file', 'access.conf', 'access.conf-file', 'any/etc/apache2/conf.file/file', 'any/etc/apache2/file.conf', 'any/etc/apache2/file.conf-file', 'any/etc/apache2/mods-file/file', 'any/etc/apache2/sites-file/file', 'any/etc/apache2/sites-file/file.com', 'any/etc/httpd/conf.d/file.conf', 'any/etc/httpd/conf.d/file.conf-file', 'any/etc/httpd/file.conf', 'apache.conf', 'apache.conf-file', 'apache2.conf', 'apache2.conf-file', 'httpd.conf', 'httpd.conf-file', 'srm.conf', 'srm.conf-file'], ++ \ 'apache': ['.htaccess', '/etc/httpd/file.conf', '/etc/apache2/sites-2/file.com', '/etc/apache2/some.config', '/etc/apache2/conf.file/conf', '/etc/apache2/mods-some/file', '/etc/apache2/sites-some/file', '/etc/httpd/conf.d/file.config', '/etc/apache2/conf.file/file', '/etc/apache2/file.conf', '/etc/apache2/file.conf-file', '/etc/apache2/mods-file/file', '/etc/apache2/sites-file/file', '/etc/apache2/sites-file/file.com', '/etc/httpd/conf.d/file.conf', '/etc/httpd/conf.d/file.conf-file', 'access.conf', 'access.conf-file', 'any/etc/apache2/conf.file/file', 'any/etc/apache2/file.conf', 'any/etc/apache2/file.conf-file', 'any/etc/apache2/mods-file/file', 'any/etc/apache2/sites-file/file', 'any/etc/apache2/sites-file/file.com', 'any/etc/httpd/conf.d/file.conf', 'any/etc/httpd/conf.d/file.conf-file', 'any/etc/httpd/file.conf', 'apache.conf', 'apache.conf-file', 'apache2.conf', 'apache2.conf-file', 'httpd.conf', 'httpd.conf-file', 'srm.conf', 'srm.conf-file', '/etc/httpd/mods-some/file', '/etc/httpd/sites-some/file', '/etc/httpd/conf.file/conf'], + \ 'apachestyle': ['/etc/proftpd/file.config,/etc/proftpd/conf.file/file', '/etc/proftpd/conf.file/file', '/etc/proftpd/file.conf', '/etc/proftpd/file.conf-file', 'any/etc/proftpd/conf.file/file', 'any/etc/proftpd/file.conf', 'any/etc/proftpd/file.conf-file', 'proftpd.conf', 'proftpd.conf-file'], + \ 'applescript': ['file.scpt'], + \ 'aptconf': ['apt.conf', '/.aptitude/config', 'any/.aptitude/config'], +-- +2.31.1 + diff --git a/SOURCES/vim-8.0-copy-paste.patch b/SOURCES/vim-8.0-copy-paste.patch index 203cbb7..73870cd 100644 --- a/SOURCES/vim-8.0-copy-paste.patch +++ b/SOURCES/vim-8.0-copy-paste.patch @@ -1,6 +1,7 @@ -diff -up vim82/runtime/defaults.vim.copypaste vim82/runtime/defaults.vim ---- vim82/runtime/defaults.vim.copypaste 2020-10-06 17:03:19.276066889 +0200 -+++ vim82/runtime/defaults.vim 2020-10-06 17:04:30.437448603 +0200 +diff --git a/runtime/defaults.vim b/runtime/defaults.vim +index f3c639b..20637e2 100644 +--- a/runtime/defaults.vim ++++ b/runtime/defaults.vim @@ -73,18 +73,6 @@ map Q gq " Revert with ":iunmap ". inoremap u @@ -20,3 +21,59 @@ diff -up vim82/runtime/defaults.vim.copypaste vim82/runtime/defaults.vim " Only do this part when Vim was compiled with the +eval feature. if 1 +diff --git a/src/testdir/test_balloon.vim b/src/testdir/test_balloon.vim +index 319e546..8fcf63c 100644 +--- a/src/testdir/test_balloon.vim ++++ b/src/testdir/test_balloon.vim +@@ -9,6 +9,7 @@ source screendump.vim + CheckScreendump + + let s:common_script =<< trim [CODE] ++ set mouse=a + call setline(1, ["one one one", "two tXo two", "three three three"]) + set balloonevalterm balloonexpr=MyBalloonExpr() balloondelay=100 + func MyBalloonExpr() +diff --git a/src/testdir/test_popupwin.vim b/src/testdir/test_popupwin.vim +index f13252b..ec755a4 100644 +--- a/src/testdir/test_popupwin.vim ++++ b/src/testdir/test_popupwin.vim +@@ -553,6 +553,7 @@ func Test_popup_drag() + " create a popup that covers the command line + let lines =<< trim END + call setline(1, range(1, 20)) ++ set mouse=a + split + vsplit + $wincmd w +@@ -599,6 +600,7 @@ func Test_popup_drag_termwin() + let lines =<< trim END + set foldmethod=marker + call setline(1, range(100)) ++ set mouse=a + for nr in range(7) + call setline(nr * 12 + 1, "fold {{{") + call setline(nr * 12 + 11, "end }}}") +@@ -652,6 +654,7 @@ func Test_popup_close_with_mouse() + + let lines =<< trim END + call setline(1, range(1, 20)) ++ set mouse=a + " With border, can click on X + let winid = popup_create('foobar', #{ + \ close: 'button', +@@ -1479,6 +1482,7 @@ func Test_popup_beval() + let lines =<< trim END + call setline(1, range(1, 20)) + call setline(5, 'here is some text to hover over') ++ set mouse=a + set balloonevalterm + set balloonexpr=BalloonExpr() + set balloondelay=100 +@@ -2170,6 +2174,7 @@ func Test_popup_scrollbar() + + let lines =<< trim END + call setline(1, range(1, 20)) ++ set mouse=a + hi ScrollThumb ctermbg=blue + hi ScrollBar ctermbg=red + let winid = popup_create(['one', 'two', 'three', 'four', 'five', diff --git a/SOURCES/vim-cve-var-retab.patch b/SOURCES/vim-cve-var-retab.patch new file mode 100644 index 0000000..e262955 --- /dev/null +++ b/SOURCES/vim-cve-var-retab.patch @@ -0,0 +1,200 @@ +diff --git a/src/indent.c b/src/indent.c +index e1c6f52..a002b4b 100644 +--- a/src/indent.c ++++ b/src/indent.c +@@ -18,18 +18,19 @@ + /* + * Set the integer values corresponding to the string setting of 'vartabstop'. + * "array" will be set, caller must free it if needed. ++ * Return FAIL for an error. + */ + int + tabstop_set(char_u *var, int **array) + { +- int valcount = 1; +- int t; +- char_u *cp; ++ int valcount = 1; ++ int t; ++ char_u *cp; + + if (var[0] == NUL || (var[0] == '0' && var[1] == NUL)) + { + *array = NULL; +- return TRUE; ++ return OK; + } + + for (cp = var; *cp != NUL; ++cp) +@@ -43,8 +44,8 @@ tabstop_set(char_u *var, int **array) + if (cp != end) + emsg(_(e_positive)); + else +- emsg(_(e_invarg)); +- return FALSE; ++ semsg(_(e_invarg2), cp); ++ return FAIL; + } + } + +@@ -55,26 +56,36 @@ tabstop_set(char_u *var, int **array) + ++valcount; + continue; + } +- emsg(_(e_invarg)); +- return FALSE; ++ semsg(_(e_invarg2), var); ++ return FAIL; + } + + *array = ALLOC_MULT(int, valcount + 1); + if (*array == NULL) +- return FALSE; ++ return FAIL; + (*array)[0] = valcount; + + t = 1; + for (cp = var; *cp != NUL;) + { +- (*array)[t++] = atoi((char *)cp); +- while (*cp != NUL && *cp != ',') ++ int n = atoi((char *)cp); ++ ++ // Catch negative values, overflow and ridiculous big values. ++ if (n < 0 || n > 9999) ++ { ++ semsg(_(e_invarg2), cp); ++ vim_free(*array); ++ *array = NULL; ++ return FAIL; ++ } ++ (*array)[t++] = n; ++ while (*cp != NUL && *cp != ',') + ++cp; + if (*cp != NUL) + ++cp; + } + +- return TRUE; ++ return OK; + } + + /* +@@ -1561,7 +1572,7 @@ ex_retab(exarg_T *eap) + + #ifdef FEAT_VARTABS + new_ts_str = eap->arg; +- if (!tabstop_set(eap->arg, &new_vts_array)) ++ if (tabstop_set(eap->arg, &new_vts_array) == FAIL) + return; + while (vim_isdigit(*(eap->arg)) || *(eap->arg) == ',') + ++(eap->arg); +@@ -1577,12 +1588,18 @@ ex_retab(exarg_T *eap) + else + new_ts_str = vim_strnsave(new_ts_str, eap->arg - new_ts_str); + #else +- new_ts = getdigits(&(eap->arg)); +- if (new_ts < 0) ++ ptr = eap->arg; ++ new_ts = getdigits(&ptr); ++ if (new_ts < 0 && *eap->arg == '-') + { + emsg(_(e_positive)); + return; + } ++ if (new_ts < 0 || new_ts > 9999) ++ { ++ semsg(_(e_invarg2), eap->arg); ++ return; ++ } + if (new_ts == 0) + new_ts = curbuf->b_p_ts; + #endif +diff --git a/src/option.c b/src/option.c +index b9d7edb..9a3b71e 100644 +--- a/src/option.c ++++ b/src/option.c +@@ -2349,9 +2349,9 @@ didset_options2(void) + #endif + #ifdef FEAT_VARTABS + vim_free(curbuf->b_p_vsts_array); +- tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array); ++ (void)tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array); + vim_free(curbuf->b_p_vts_array); +- tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array); ++ (void)tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array); + #endif + } + +@@ -5828,7 +5828,7 @@ buf_copy_options(buf_T *buf, int flags) + buf->b_p_vsts = vim_strsave(p_vsts); + COPY_OPT_SCTX(buf, BV_VSTS); + if (p_vsts && p_vsts != empty_option) +- tabstop_set(p_vsts, &buf->b_p_vsts_array); ++ (void)tabstop_set(p_vsts, &buf->b_p_vsts_array); + else + buf->b_p_vsts_array = 0; + buf->b_p_vsts_nopaste = p_vsts_nopaste +@@ -5988,7 +5988,7 @@ buf_copy_options(buf_T *buf, int flags) + buf->b_p_isk = save_p_isk; + #ifdef FEAT_VARTABS + if (p_vts && p_vts != empty_option && !buf->b_p_vts_array) +- tabstop_set(p_vts, &buf->b_p_vts_array); ++ (void)tabstop_set(p_vts, &buf->b_p_vts_array); + else + buf->b_p_vts_array = NULL; + #endif +@@ -6003,7 +6003,7 @@ buf_copy_options(buf_T *buf, int flags) + buf->b_p_vts = vim_strsave(p_vts); + COPY_OPT_SCTX(buf, BV_VTS); + if (p_vts && p_vts != empty_option && !buf->b_p_vts_array) +- tabstop_set(p_vts, &buf->b_p_vts_array); ++ (void)tabstop_set(p_vts, &buf->b_p_vts_array); + else + buf->b_p_vts_array = NULL; + #endif +@@ -6700,7 +6700,7 @@ paste_option_changed(void) + if (buf->b_p_vsts_array) + vim_free(buf->b_p_vsts_array); + if (buf->b_p_vsts && buf->b_p_vsts != empty_option) +- tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array); ++ (void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array); + else + buf->b_p_vsts_array = 0; + #endif +diff --git a/src/optionstr.c b/src/optionstr.c +index 521242d..db015e8 100644 +--- a/src/optionstr.c ++++ b/src/optionstr.c +@@ -2215,7 +2215,7 @@ ambw_end: + if (errmsg == NULL) + { + int *oldarray = curbuf->b_p_vsts_array; +- if (tabstop_set(*varp, &(curbuf->b_p_vsts_array))) ++ if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)) == OK) + { + if (oldarray) + vim_free(oldarray); +@@ -2254,7 +2254,7 @@ ambw_end: + { + int *oldarray = curbuf->b_p_vts_array; + +- if (tabstop_set(*varp, &(curbuf->b_p_vts_array))) ++ if (tabstop_set(*varp, &(curbuf->b_p_vts_array)) == OK) + { + vim_free(oldarray); + #ifdef FEAT_FOLDING +diff --git a/src/testdir/test_retab.vim b/src/testdir/test_retab.vim +index b792da5..c7190aa 100644 +--- a/src/testdir/test_retab.vim ++++ b/src/testdir/test_retab.vim +@@ -75,6 +75,9 @@ endfunc + func Test_retab_error() + call assert_fails('retab -1', 'E487:') + call assert_fails('retab! -1', 'E487:') ++ call assert_fails('ret -1000', 'E487:') ++ call assert_fails('ret 10000', 'E475:') ++ call assert_fails('ret 80000000000000000000', 'E475:') + endfunc + + " vim: shiftwidth=2 sts=2 expandtab diff --git a/SOURCES/virc b/SOURCES/virc index 808e7d6..df4d4f4 100644 --- a/SOURCES/virc +++ b/SOURCES/virc @@ -28,8 +28,6 @@ if has("autocmd") endif -filetype plugin on - if &term=="xterm" set t_Co=8 set t_Sb=[4%dm diff --git a/SPECS/vim.spec b/SPECS/vim.spec index 6d2430a..522a865 100644 --- a/SPECS/vim.spec +++ b/SPECS/vim.spec @@ -27,7 +27,7 @@ Summary: The VIM editor URL: http://www.vim.org/ Name: vim Version: %{baseversion}.%{patchlevel} -Release: 5%{?dist} +Release: 8%{?dist} License: Vim and MIT Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2 Source1: virc @@ -57,10 +57,8 @@ BuildRequires: hunspell-devel %endif Patch3000: vim-7.4-syntax.patch -Patch3002: vim-7.4-nowarnings.patch Patch3004: vim-7.0-rclocation.patch Patch3007: vim-7.4-fstabsyntax.patch -Patch3008: vim-7.4-syncolor.patch Patch3010: vim-7.3-manpage-typo-668894-675480.patch Patch3011: vim-manpagefixes-948566.patch Patch3013: vim-7.4-globalsyntax.patch @@ -72,6 +70,16 @@ Patch3017: vim-python3-tests.patch Patch3018: vim-crypto-warning.patch Patch3019: 0001-patch-8.2.3115-Coverity-complains-about-free_wininfo.patch Patch3020: 0001-patch-8.2.3290-Vim9-compiling-dict-may-use-pointer-a.patch +# 2002320 - CVE-2021-3770 vim: using retab with large value may lead to heap buffer overflow [rhel-9.0] +Patch3021: vim-cve-var-retab.patch +# 2004893 - CVE-2021-3778 vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c [rhel-9.0] +Patch3022: 0001-patch-8.2.3409-reading-beyond-end-of-line-with-inval.patch +# 2004976 - CVE-2021-3796 vim: use-after-free in nv_replace() in normal.c [rhel-9.0] +Patch3023: 0001-patch-8.2.3428-using-freed-memory-when-replacing.patch +# 2015517 - [s390x] Vim needs to be compiled with -D_REENTRANT +Patch3024: 0001-patch-8.2.3406-on-some-systems-tests-fail-without-_R.patch +# 2016202 - CVE-2021-3872 vim: heap-based buffer overflow in win_redr_status() drawscreen.c [rhel-9.0] +Patch3025: 0001-patch-8.2.3487-illegal-memory-access-if-buffer-name-.patch # gcc is no longer in buildroot by default BuildRequires: gcc @@ -268,10 +276,8 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk %endif %patch3000 -p1 -%patch3002 -p1 -b .nowarnings %patch3004 -p1 %patch3007 -p1 -b .fstabsyntax -%patch3008 -p1 -b .syncolor %patch3010 -p1 %patch3011 -p1 %patch3013 -p1 @@ -281,6 +287,11 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk %patch3018 -p1 -b .fips-warning %patch3019 -p1 -b .covscan-free-wininfo %patch3020 -p1 -b .covscan-key-freed +%patch3021 -p1 -b .cve-var-retab +%patch3022 -p1 -b .cve-utf-ptrchar +%patch3023 -p1 -b .cve-nv-replace +%patch3024 -p1 -b .reentrant +%patch3025 -p1 -b .cve-win-redr %build cd src @@ -838,6 +849,21 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags %endif %changelog +* Tue Oct 26 2021 Zdenek Dohnal - 2:8.2.2637-8 +- 2016202 - CVE-2021-3872 vim: heap-based buffer overflow in win_redr_status() drawscreen.c [rhel-9.0] + +* Tue Oct 19 2021 Zdenek Dohnal - 2:8.2.2637-7 +- 2015517 - [s390x] Vim needs to be compiled with -D_REENTRANT + +* Thu Oct 14 2021 Zdenek Dohnal - 2:8.2.2637-6 +- 2011412 - test suite fails on apache/httpd filetype tests +- 2011424 - Remove vim-7.4-syncolor.patch +- 2011429 - Remove downstream patch vim-7.4-nowarning.patch +- 2011749 - Update test suite to work without default mouse behavior +- 2002320 - CVE-2021-3770 vim: using retab with large value may lead to heap buffer overflow [rhel-9.0] +- 2004893 - CVE-2021-3778 vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c [rhel-9.0] +- 2004976 - CVE-2021-3796 vim: use-after-free in nv_replace() in normal.c [rhel-9.0] + * Tue Aug 10 2021 Mohan Boddu - 2:8.2.2637-5 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688