diff --git a/SOURCES/0001-patch-8.2.3406-on-some-systems-tests-fail-without-_R.patch b/SOURCES/0001-patch-8.2.3406-on-some-systems-tests-fail-without-_R.patch
new file mode 100644
index 0000000..464ad3c
--- /dev/null
+++ b/SOURCES/0001-patch-8.2.3406-on-some-systems-tests-fail-without-_R.patch
@@ -0,0 +1,49 @@
+From 3ae5fc9a6a881e0be381e4cc70080ac5908d7520 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Mon, 6 Sep 2021 18:57:30 +0200
+Subject: [PATCH] patch 8.2.3406: on some systems tests fail without _REENTRANT
+
+Problem: On some systems tests fail without _REENTRANT. (Elimar
+ Riesebieter)
+Solution: Add -D_REENTRANT in configure. (closes #7402)
+---
+ src/auto/configure | 4 ++++
+ src/configure.ac | 6 ++++++
+ src/version.c | 2 ++
+ 3 files changed, 12 insertions(+)
+
+diff --git a/src/auto/configure b/src/auto/configure
+index fba6a19b5..4f4363224 100755
+--- a/src/auto/configure
++++ b/src/auto/configure
+@@ -14960,6 +14960,10 @@ $as_echo "no" >&6; }
+ fi
+ fi
+
++if `echo "$CFLAGS" | grep -v D_XEENTRANT >/dev/null`; then
++ CFLAGS="$CFLAGS -D_REENTRANT"
++fi
++
+ DEPEND_CFLAGS_FILTER=
+ if test "$GCC" = yes; then
+ { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GCC 3 or later" >&5
+diff --git a/src/configure.ac b/src/configure.ac
+index 5ec955757..4cd6dea1f 100644
+--- a/src/configure.ac
++++ b/src/configure.ac
+@@ -4504,6 +4504,12 @@ if test "$MACOS_X" = "yes"; then
+ fi
+ fi
+
++dnl On some systems REENTRANT needs to be defined. It should not hurt to use
++dnl it everywhere.
++if `echo "$CFLAGS" | grep -v D_REENTRANT >/dev/null`; then
++ CFLAGS="$CFLAGS -D_REENTRANT"
++fi
++
+ dnl gcc 3.1 changed the meaning of -MM. The only solution appears to be to
+ dnl use "-isystem" instead of "-I" for all non-Vim include dirs.
+ dnl But only when making dependencies, cproto and lint don't take "-isystem".
+--
+2.31.1
+
diff --git a/SOURCES/0001-patch-8.2.3409-reading-beyond-end-of-line-with-inval.patch b/SOURCES/0001-patch-8.2.3409-reading-beyond-end-of-line-with-inval.patch
new file mode 100644
index 0000000..407d2e7
--- /dev/null
+++ b/SOURCES/0001-patch-8.2.3409-reading-beyond-end-of-line-with-inval.patch
@@ -0,0 +1,48 @@
+From 65b605665997fad54ef39a93199e305af2fe4d7f Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Tue, 7 Sep 2021 19:26:53 +0200
+Subject: [PATCH] patch 8.2.3409: reading beyond end of line with invalid utf-8
+ character
+
+Problem: Reading beyond end of line with invalid utf-8 character.
+Solution: Check for NUL when advancing.
+---
+ src/regexp_nfa.c | 3 ++-
+ src/testdir/test_regexp_utf8.vim | 8 ++++++++
+ src/version.c | 2 ++
+ 3 files changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c
+index 9757d7c47..c7db98187 100644
+--- a/src/regexp_nfa.c
++++ b/src/regexp_nfa.c
+@@ -5664,7 +5664,8 @@ find_match_text(colnr_T startcol, int regstart, char_u *match_text)
+ match = FALSE;
+ break;
+ }
+- len2 += MB_CHAR2LEN(c2);
++ len2 += enc_utf8 ? utf_ptr2len(rex.line + col + len2)
++ : MB_CHAR2LEN(c2);
+ }
+ if (match
+ // check that no composing char follows
+diff --git a/src/testdir/test_regexp_utf8.vim b/src/testdir/test_regexp_utf8.vim
+index 9f0ffb9aa..044aeffb6 100644
+--- a/src/testdir/test_regexp_utf8.vim
++++ b/src/testdir/test_regexp_utf8.vim
+@@ -558,4 +558,12 @@ func Test_match_char_class_upper()
+ bwipe!
+ endfunc
+
++func Test_match_invalid_byte()
++ call writefile(0z630a.765d30aa0a.2e0a.790a.4030, 'Xinvalid')
++ new
++ source Xinvalid
++ bwipe!
++ call delete('Xinvalid')
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+--
+2.31.1
+
diff --git a/SOURCES/0001-patch-8.2.3428-using-freed-memory-when-replacing.patch b/SOURCES/0001-patch-8.2.3428-using-freed-memory-when-replacing.patch
new file mode 100644
index 0000000..f4860e8
--- /dev/null
+++ b/SOURCES/0001-patch-8.2.3428-using-freed-memory-when-replacing.patch
@@ -0,0 +1,50 @@
+diff -up vim82/src/normal.c.cve-3796 vim82/src/normal.c
+--- vim82/src/normal.c.cve-3796 2021-03-22 10:02:42.000000000 +0100
++++ vim82/src/normal.c 2021-10-15 10:45:21.397258123 +0200
+@@ -5076,19 +5076,23 @@ nv_replace(cmdarg_T *cap)
+ {
+ /*
+ * Get ptr again, because u_save and/or showmatch() will have
+- * released the line. At the same time we let know that the
+- * line will be changed.
++ * released the line. This may also happen in ins_copychar().
++ * At the same time we let know that the line will be changed.
+ */
+- ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
+ if (cap->nchar == Ctrl_E || cap->nchar == Ctrl_Y)
+ {
+ int c = ins_copychar(curwin->w_cursor.lnum
+ + (cap->nchar == Ctrl_Y ? -1 : 1));
++
++ ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
+ if (c != NUL)
+ ptr[curwin->w_cursor.col] = c;
+ }
+ else
++ {
++ ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
+ ptr[curwin->w_cursor.col] = cap->nchar;
++ }
+ if (p_sm && msg_silent == 0)
+ showmatch(cap->nchar);
+ ++curwin->w_cursor.col;
+diff -up vim82/src/testdir/test_edit.vim.cve-3796 vim82/src/testdir/test_edit.vim
+--- vim82/src/testdir/test_edit.vim.cve-3796 2021-10-15 10:45:21.398258115 +0200
++++ vim82/src/testdir/test_edit.vim 2021-10-15 10:46:22.892764135 +0200
+@@ -1844,4 +1844,16 @@ func Test_read_invalid()
+ set encoding=utf-8
+ endfunc
+
++" Test for getting the character of the line below after "p"
++func Test_edit_put_CTRL_E()
++ set encoding=latin1
++ new
++ let @" = ''
++ sil! norm orggRx
++ sil! norm pr
++ call assert_equal(['r', 'r'], getline(1, 2))
++ bwipe!
++ set encoding=utf-8
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
diff --git a/SOURCES/0001-patch-8.2.3487-illegal-memory-access-if-buffer-name-.patch b/SOURCES/0001-patch-8.2.3487-illegal-memory-access-if-buffer-name-.patch
new file mode 100644
index 0000000..df6ef8d
--- /dev/null
+++ b/SOURCES/0001-patch-8.2.3487-illegal-memory-access-if-buffer-name-.patch
@@ -0,0 +1,72 @@
+From 826bfe4bbd7594188e3d74d2539d9707b1c6a14b Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Fri, 8 Oct 2021 18:39:28 +0100
+Subject: [PATCH] patch 8.2.3487: illegal memory access if buffer name is very
+ long
+
+Problem: Illegal memory access if buffer name is very long.
+Solution: Make sure not to go over the end of the buffer.
+---
+ src/drawscreen.c | 10 +++++-----
+ src/testdir/test_statusline.vim | 10 ++++++++++
+ src/version.c | 2 ++
+ 3 files changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/src/drawscreen.c b/src/drawscreen.c
+index 82e53753b..e38ca9586 100644
+--- a/src/drawscreen.c
++++ b/src/drawscreen.c
+@@ -464,13 +464,13 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED)
+ *(p + len++) = ' ';
+ if (bt_help(wp->w_buffer))
+ {
+- STRCPY(p + len, _("[Help]"));
++ vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[Help]"));
+ len += (int)STRLEN(p + len);
+ }
+ #ifdef FEAT_QUICKFIX
+ if (wp->w_p_pvw)
+ {
+- STRCPY(p + len, _("[Preview]"));
++ vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[Preview]"));
+ len += (int)STRLEN(p + len);
+ }
+ #endif
+@@ -480,12 +480,12 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED)
+ #endif
+ )
+ {
+- STRCPY(p + len, "[+]");
+- len += 3;
++ vim_snprintf((char *)p + len, MAXPATHL - len, "%s", "[+]");
++ len += (int)STRLEN(p + len);
+ }
+ if (wp->w_buffer->b_p_ro)
+ {
+- STRCPY(p + len, _("[RO]"));
++ vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[RO]"));
+ len += (int)STRLEN(p + len);
+ }
+
+diff --git a/src/testdir/test_statusline.vim b/src/testdir/test_statusline.vim
+index f3eea2e71..a952de69b 100644
+--- a/src/testdir/test_statusline.vim
++++ b/src/testdir/test_statusline.vim
+@@ -522,4 +522,14 @@ func Test_statusline_mbyte_fillchar()
+ %bw!
+ endfunc
+
++" Used to write beyond allocated memory. This assumes MAXPATHL is 4096 bytes.
++func Test_statusline_verylong_filename()
++ let fname = repeat('x', 4090)
++ exe "new " .. fname
++ set buftype=help
++ set previewwindow
++ redraw
++ bwipe!
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+--
+2.31.1
+
diff --git a/SOURCES/vim-7.4-nowarnings.patch b/SOURCES/vim-7.4-nowarnings.patch
deleted file mode 100644
index fc4315a..0000000
--- a/SOURCES/vim-7.4-nowarnings.patch
+++ /dev/null
@@ -1,11 +0,0 @@
-diff -up vim82/src/ex_docmd.c.nowarnings vim82/src/ex_docmd.c
---- vim82/src/ex_docmd.c.nowarnings 2020-07-28 11:42:07.437603829 +0200
-+++ vim82/src/ex_docmd.c 2020-07-28 11:44:25.432201129 +0200
-@@ -4020,6 +4020,7 @@ get_flags(exarg_T *eap)
- void
- ex_ni(exarg_T *eap)
- {
-+ return;
- if (!eap->skip)
- eap->errmsg =
- _("E319: Sorry, the command is not available in this version");
diff --git a/SOURCES/vim-7.4-syncolor.patch b/SOURCES/vim-7.4-syncolor.patch
deleted file mode 100644
index b41f2fe..0000000
--- a/SOURCES/vim-7.4-syncolor.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff --git a/src/highlight.c b/src/highlight.c
-index 9322f96..f7147a0 100644
---- a/src/highlight.c
-+++ b/src/highlight.c
-@@ -211,8 +211,8 @@ static char *(highlight_init_light[]) = {
- CENT("Visual term=reverse",
- "Visual term=reverse guibg=LightGrey"),
- #ifdef FEAT_DIFF
-- CENT("DiffAdd term=bold ctermbg=LightBlue",
-- "DiffAdd term=bold ctermbg=LightBlue guibg=LightBlue"),
-+ CENT("DiffAdd term=bold ctermbg=LightRed",
-+ "DiffAdd term=bold ctermbg=LightRed guibg=LightBlue"),
- CENT("DiffChange term=bold ctermbg=LightMagenta",
- "DiffChange term=bold ctermbg=LightMagenta guibg=LightMagenta"),
- CENT("DiffDelete term=bold ctermfg=Blue ctermbg=LightCyan",
-@@ -304,8 +304,8 @@ static char *(highlight_init_dark[]) = {
- CENT("Visual term=reverse",
- "Visual term=reverse guibg=DarkGrey"),
- #ifdef FEAT_DIFF
-- CENT("DiffAdd term=bold ctermbg=DarkBlue",
-- "DiffAdd term=bold ctermbg=DarkBlue guibg=DarkBlue"),
-+ CENT("DiffAdd term=bold ctermbg=DarkRed",
-+ "DiffAdd term=bold ctermbg=DarkRed guibg=DarkBlue"),
- CENT("DiffChange term=bold ctermbg=DarkMagenta",
- "DiffChange term=bold ctermbg=DarkMagenta guibg=DarkMagenta"),
- CENT("DiffDelete term=bold ctermfg=Blue ctermbg=DarkCyan",
diff --git a/SOURCES/vim-7.4-syntax.patch b/SOURCES/vim-7.4-syntax.patch
index 5131c80..2cd370f 100644
--- a/SOURCES/vim-7.4-syntax.patch
+++ b/SOURCES/vim-7.4-syntax.patch
@@ -1,11 +1,43 @@
---- vim74/runtime/filetype.vim.orig 2013-08-12 14:51:58.669350813 +0200
-+++ vim74/runtime/filetype.vim 2013-08-12 14:56:12.432540523 +0200
-@@ -2475,7 +2475,7 @@
+From c669d497d34e4b57f40c19d58e3703401075a6d5 Mon Sep 17 00:00:00 2001
+From: Zdenek Dohnal <zdohnal@redhat.com>
+Date: Fri, 17 Sep 2021 07:54:56 +0200
+Subject: [PATCH] runtime/filetype.vim: Register more httpd files as apache
+ filetype
+
+Several files under /etc/httpd wasn't recognized as 'apache' filetype -
+add them to filetype.vim and add tests for checking if recognizition
+works.
+---
+ runtime/filetype.vim | 2 +-
+ src/testdir/test_filetype.vim | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/runtime/filetype.vim b/runtime/filetype.vim
+index d0d40539d..39a772740 100644
+--- a/runtime/filetype.vim
++++ b/runtime/filetype.vim
+@@ -2138,7 +2138,7 @@ au BufNewFile,BufRead proftpd.conf* call s:StarSetf('apachestyle')
" More Apache config files
au BufNewFile,BufRead access.conf*,apache.conf*,apache2.conf*,httpd.conf*,srm.conf* call s:StarSetf('apache')
-au BufNewFile,BufRead */etc/apache2/*.conf*,*/etc/apache2/conf.*/*,*/etc/apache2/mods-*/*,*/etc/apache2/sites-*/*,*/etc/httpd/conf.d/*.conf* call s:StarSetf('apache')
-+au BufNewFile,BufRead */etc/apache2/*.conf*,*/etc/httpd/conf.*/*,*/etc/httpd/mods-*/*,*/etc/httpd/sites-*/*,*/etc/httpd/conf.d/*.conf*,auth_mysql.conf*,auth_pgsql.conf*,ssl.conf*,perl.conf*,php.conf*,python.conf*,squirrelmail.conf* call s:StarSetf('apache')
++au BufNewFile,BufRead */etc/apache2/*.conf*,*/etc/apache2/conf.*/*,*/etc/apache2/mods-*/*,*/etc/apache2/sites-*/*,*/etc/httpd/conf.*/*,*/etc/httpd/mods-*/*,*/etc/httpd/sites-*/*,*/etc/httpd/conf.d/*.conf* call s:StarSetf('apache')
" Asterisk config file
au BufNewFile,BufRead *asterisk/*.conf* call s:StarSetf('asterisk')
+diff --git a/src/testdir/test_filetype.vim b/src/testdir/test_filetype.vim
+index cd6e71d1b..f1404808f 100644
+--- a/src/testdir/test_filetype.vim
++++ b/src/testdir/test_filetype.vim
+@@ -59,7 +59,7 @@ let s:filename_checks = {
+ \ 'aml': ['file.aml'],
+ \ 'ampl': ['file.run'],
+ \ 'ant': ['build.xml'],
+- \ 'apache': ['.htaccess', '/etc/httpd/file.conf', '/etc/apache2/sites-2/file.com', '/etc/apache2/some.config', '/etc/apache2/conf.file/conf', '/etc/apache2/mods-some/file', '/etc/apache2/sites-some/file', '/etc/httpd/conf.d/file.config', '/etc/apache2/conf.file/file', '/etc/apache2/file.conf', '/etc/apache2/file.conf-file', '/etc/apache2/mods-file/file', '/etc/apache2/sites-file/file', '/etc/apache2/sites-file/file.com', '/etc/httpd/conf.d/file.conf', '/etc/httpd/conf.d/file.conf-file', 'access.conf', 'access.conf-file', 'any/etc/apache2/conf.file/file', 'any/etc/apache2/file.conf', 'any/etc/apache2/file.conf-file', 'any/etc/apache2/mods-file/file', 'any/etc/apache2/sites-file/file', 'any/etc/apache2/sites-file/file.com', 'any/etc/httpd/conf.d/file.conf', 'any/etc/httpd/conf.d/file.conf-file', 'any/etc/httpd/file.conf', 'apache.conf', 'apache.conf-file', 'apache2.conf', 'apache2.conf-file', 'httpd.conf', 'httpd.conf-file', 'srm.conf', 'srm.conf-file'],
++ \ 'apache': ['.htaccess', '/etc/httpd/file.conf', '/etc/apache2/sites-2/file.com', '/etc/apache2/some.config', '/etc/apache2/conf.file/conf', '/etc/apache2/mods-some/file', '/etc/apache2/sites-some/file', '/etc/httpd/conf.d/file.config', '/etc/apache2/conf.file/file', '/etc/apache2/file.conf', '/etc/apache2/file.conf-file', '/etc/apache2/mods-file/file', '/etc/apache2/sites-file/file', '/etc/apache2/sites-file/file.com', '/etc/httpd/conf.d/file.conf', '/etc/httpd/conf.d/file.conf-file', 'access.conf', 'access.conf-file', 'any/etc/apache2/conf.file/file', 'any/etc/apache2/file.conf', 'any/etc/apache2/file.conf-file', 'any/etc/apache2/mods-file/file', 'any/etc/apache2/sites-file/file', 'any/etc/apache2/sites-file/file.com', 'any/etc/httpd/conf.d/file.conf', 'any/etc/httpd/conf.d/file.conf-file', 'any/etc/httpd/file.conf', 'apache.conf', 'apache.conf-file', 'apache2.conf', 'apache2.conf-file', 'httpd.conf', 'httpd.conf-file', 'srm.conf', 'srm.conf-file', '/etc/httpd/mods-some/file', '/etc/httpd/sites-some/file', '/etc/httpd/conf.file/conf'],
+ \ 'apachestyle': ['/etc/proftpd/file.config,/etc/proftpd/conf.file/file', '/etc/proftpd/conf.file/file', '/etc/proftpd/file.conf', '/etc/proftpd/file.conf-file', 'any/etc/proftpd/conf.file/file', 'any/etc/proftpd/file.conf', 'any/etc/proftpd/file.conf-file', 'proftpd.conf', 'proftpd.conf-file'],
+ \ 'applescript': ['file.scpt'],
+ \ 'aptconf': ['apt.conf', '/.aptitude/config', 'any/.aptitude/config'],
+--
+2.31.1
+
diff --git a/SOURCES/vim-8.0-copy-paste.patch b/SOURCES/vim-8.0-copy-paste.patch
index 203cbb7..73870cd 100644
--- a/SOURCES/vim-8.0-copy-paste.patch
+++ b/SOURCES/vim-8.0-copy-paste.patch
@@ -1,6 +1,7 @@
-diff -up vim82/runtime/defaults.vim.copypaste vim82/runtime/defaults.vim
---- vim82/runtime/defaults.vim.copypaste 2020-10-06 17:03:19.276066889 +0200
-+++ vim82/runtime/defaults.vim 2020-10-06 17:04:30.437448603 +0200
+diff --git a/runtime/defaults.vim b/runtime/defaults.vim
+index f3c639b..20637e2 100644
+--- a/runtime/defaults.vim
++++ b/runtime/defaults.vim
@@ -73,18 +73,6 @@ map Q gq
" Revert with ":iunmap <C-U>".
inoremap <C-U> <C-G>u<C-U>
@@ -20,3 +21,59 @@ diff -up vim82/runtime/defaults.vim.copypaste vim82/runtime/defaults.vim
" Only do this part when Vim was compiled with the +eval feature.
if 1
+diff --git a/src/testdir/test_balloon.vim b/src/testdir/test_balloon.vim
+index 319e546..8fcf63c 100644
+--- a/src/testdir/test_balloon.vim
++++ b/src/testdir/test_balloon.vim
+@@ -9,6 +9,7 @@ source screendump.vim
+ CheckScreendump
+
+ let s:common_script =<< trim [CODE]
++ set mouse=a
+ call setline(1, ["one one one", "two tXo two", "three three three"])
+ set balloonevalterm balloonexpr=MyBalloonExpr() balloondelay=100
+ func MyBalloonExpr()
+diff --git a/src/testdir/test_popupwin.vim b/src/testdir/test_popupwin.vim
+index f13252b..ec755a4 100644
+--- a/src/testdir/test_popupwin.vim
++++ b/src/testdir/test_popupwin.vim
+@@ -553,6 +553,7 @@ func Test_popup_drag()
+ " create a popup that covers the command line
+ let lines =<< trim END
+ call setline(1, range(1, 20))
++ set mouse=a
+ split
+ vsplit
+ $wincmd w
+@@ -599,6 +600,7 @@ func Test_popup_drag_termwin()
+ let lines =<< trim END
+ set foldmethod=marker
+ call setline(1, range(100))
++ set mouse=a
+ for nr in range(7)
+ call setline(nr * 12 + 1, "fold {{{")
+ call setline(nr * 12 + 11, "end }}}")
+@@ -652,6 +654,7 @@ func Test_popup_close_with_mouse()
+
+ let lines =<< trim END
+ call setline(1, range(1, 20))
++ set mouse=a
+ " With border, can click on X
+ let winid = popup_create('foobar', #{
+ \ close: 'button',
+@@ -1479,6 +1482,7 @@ func Test_popup_beval()
+ let lines =<< trim END
+ call setline(1, range(1, 20))
+ call setline(5, 'here is some text to hover over')
++ set mouse=a
+ set balloonevalterm
+ set balloonexpr=BalloonExpr()
+ set balloondelay=100
+@@ -2170,6 +2174,7 @@ func Test_popup_scrollbar()
+
+ let lines =<< trim END
+ call setline(1, range(1, 20))
++ set mouse=a
+ hi ScrollThumb ctermbg=blue
+ hi ScrollBar ctermbg=red
+ let winid = popup_create(['one', 'two', 'three', 'four', 'five',
diff --git a/SOURCES/vim-cve-var-retab.patch b/SOURCES/vim-cve-var-retab.patch
new file mode 100644
index 0000000..e262955
--- /dev/null
+++ b/SOURCES/vim-cve-var-retab.patch
@@ -0,0 +1,200 @@
+diff --git a/src/indent.c b/src/indent.c
+index e1c6f52..a002b4b 100644
+--- a/src/indent.c
++++ b/src/indent.c
+@@ -18,18 +18,19 @@
+ /*
+ * Set the integer values corresponding to the string setting of 'vartabstop'.
+ * "array" will be set, caller must free it if needed.
++ * Return FAIL for an error.
+ */
+ int
+ tabstop_set(char_u *var, int **array)
+ {
+- int valcount = 1;
+- int t;
+- char_u *cp;
++ int valcount = 1;
++ int t;
++ char_u *cp;
+
+ if (var[0] == NUL || (var[0] == '0' && var[1] == NUL))
+ {
+ *array = NULL;
+- return TRUE;
++ return OK;
+ }
+
+ for (cp = var; *cp != NUL; ++cp)
+@@ -43,8 +44,8 @@ tabstop_set(char_u *var, int **array)
+ if (cp != end)
+ emsg(_(e_positive));
+ else
+- emsg(_(e_invarg));
+- return FALSE;
++ semsg(_(e_invarg2), cp);
++ return FAIL;
+ }
+ }
+
+@@ -55,26 +56,36 @@ tabstop_set(char_u *var, int **array)
+ ++valcount;
+ continue;
+ }
+- emsg(_(e_invarg));
+- return FALSE;
++ semsg(_(e_invarg2), var);
++ return FAIL;
+ }
+
+ *array = ALLOC_MULT(int, valcount + 1);
+ if (*array == NULL)
+- return FALSE;
++ return FAIL;
+ (*array)[0] = valcount;
+
+ t = 1;
+ for (cp = var; *cp != NUL;)
+ {
+- (*array)[t++] = atoi((char *)cp);
+- while (*cp != NUL && *cp != ',')
++ int n = atoi((char *)cp);
++
++ // Catch negative values, overflow and ridiculous big values.
++ if (n < 0 || n > 9999)
++ {
++ semsg(_(e_invarg2), cp);
++ vim_free(*array);
++ *array = NULL;
++ return FAIL;
++ }
++ (*array)[t++] = n;
++ while (*cp != NUL && *cp != ',')
+ ++cp;
+ if (*cp != NUL)
+ ++cp;
+ }
+
+- return TRUE;
++ return OK;
+ }
+
+ /*
+@@ -1561,7 +1572,7 @@ ex_retab(exarg_T *eap)
+
+ #ifdef FEAT_VARTABS
+ new_ts_str = eap->arg;
+- if (!tabstop_set(eap->arg, &new_vts_array))
++ if (tabstop_set(eap->arg, &new_vts_array) == FAIL)
+ return;
+ while (vim_isdigit(*(eap->arg)) || *(eap->arg) == ',')
+ ++(eap->arg);
+@@ -1577,12 +1588,18 @@ ex_retab(exarg_T *eap)
+ else
+ new_ts_str = vim_strnsave(new_ts_str, eap->arg - new_ts_str);
+ #else
+- new_ts = getdigits(&(eap->arg));
+- if (new_ts < 0)
++ ptr = eap->arg;
++ new_ts = getdigits(&ptr);
++ if (new_ts < 0 && *eap->arg == '-')
+ {
+ emsg(_(e_positive));
+ return;
+ }
++ if (new_ts < 0 || new_ts > 9999)
++ {
++ semsg(_(e_invarg2), eap->arg);
++ return;
++ }
+ if (new_ts == 0)
+ new_ts = curbuf->b_p_ts;
+ #endif
+diff --git a/src/option.c b/src/option.c
+index b9d7edb..9a3b71e 100644
+--- a/src/option.c
++++ b/src/option.c
+@@ -2349,9 +2349,9 @@ didset_options2(void)
+ #endif
+ #ifdef FEAT_VARTABS
+ vim_free(curbuf->b_p_vsts_array);
+- tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
++ (void)tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
+ vim_free(curbuf->b_p_vts_array);
+- tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array);
++ (void)tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array);
+ #endif
+ }
+
+@@ -5828,7 +5828,7 @@ buf_copy_options(buf_T *buf, int flags)
+ buf->b_p_vsts = vim_strsave(p_vsts);
+ COPY_OPT_SCTX(buf, BV_VSTS);
+ if (p_vsts && p_vsts != empty_option)
+- tabstop_set(p_vsts, &buf->b_p_vsts_array);
++ (void)tabstop_set(p_vsts, &buf->b_p_vsts_array);
+ else
+ buf->b_p_vsts_array = 0;
+ buf->b_p_vsts_nopaste = p_vsts_nopaste
+@@ -5988,7 +5988,7 @@ buf_copy_options(buf_T *buf, int flags)
+ buf->b_p_isk = save_p_isk;
+ #ifdef FEAT_VARTABS
+ if (p_vts && p_vts != empty_option && !buf->b_p_vts_array)
+- tabstop_set(p_vts, &buf->b_p_vts_array);
++ (void)tabstop_set(p_vts, &buf->b_p_vts_array);
+ else
+ buf->b_p_vts_array = NULL;
+ #endif
+@@ -6003,7 +6003,7 @@ buf_copy_options(buf_T *buf, int flags)
+ buf->b_p_vts = vim_strsave(p_vts);
+ COPY_OPT_SCTX(buf, BV_VTS);
+ if (p_vts && p_vts != empty_option && !buf->b_p_vts_array)
+- tabstop_set(p_vts, &buf->b_p_vts_array);
++ (void)tabstop_set(p_vts, &buf->b_p_vts_array);
+ else
+ buf->b_p_vts_array = NULL;
+ #endif
+@@ -6700,7 +6700,7 @@ paste_option_changed(void)
+ if (buf->b_p_vsts_array)
+ vim_free(buf->b_p_vsts_array);
+ if (buf->b_p_vsts && buf->b_p_vsts != empty_option)
+- tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
++ (void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
+ else
+ buf->b_p_vsts_array = 0;
+ #endif
+diff --git a/src/optionstr.c b/src/optionstr.c
+index 521242d..db015e8 100644
+--- a/src/optionstr.c
++++ b/src/optionstr.c
+@@ -2215,7 +2215,7 @@ ambw_end:
+ if (errmsg == NULL)
+ {
+ int *oldarray = curbuf->b_p_vsts_array;
+- if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)))
++ if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)) == OK)
+ {
+ if (oldarray)
+ vim_free(oldarray);
+@@ -2254,7 +2254,7 @@ ambw_end:
+ {
+ int *oldarray = curbuf->b_p_vts_array;
+
+- if (tabstop_set(*varp, &(curbuf->b_p_vts_array)))
++ if (tabstop_set(*varp, &(curbuf->b_p_vts_array)) == OK)
+ {
+ vim_free(oldarray);
+ #ifdef FEAT_FOLDING
+diff --git a/src/testdir/test_retab.vim b/src/testdir/test_retab.vim
+index b792da5..c7190aa 100644
+--- a/src/testdir/test_retab.vim
++++ b/src/testdir/test_retab.vim
+@@ -75,6 +75,9 @@ endfunc
+ func Test_retab_error()
+ call assert_fails('retab -1', 'E487:')
+ call assert_fails('retab! -1', 'E487:')
++ call assert_fails('ret -1000', 'E487:')
++ call assert_fails('ret 10000', 'E475:')
++ call assert_fails('ret 80000000000000000000', 'E475:')
+ endfunc
+
+ " vim: shiftwidth=2 sts=2 expandtab
diff --git a/SOURCES/virc b/SOURCES/virc
index 808e7d6..df4d4f4 100644
--- a/SOURCES/virc
+++ b/SOURCES/virc
@@ -28,8 +28,6 @@ if has("autocmd")
endif
-filetype plugin on
-
if &term=="xterm"
set t_Co=8
set t_Sb=[4%dm
diff --git a/SPECS/vim.spec b/SPECS/vim.spec
index 6d2430a..522a865 100644
--- a/SPECS/vim.spec
+++ b/SPECS/vim.spec
@@ -27,7 +27,7 @@ Summary: The VIM editor
URL: http://www.vim.org/
Name: vim
Version: %{baseversion}.%{patchlevel}
-Release: 5%{?dist}
+Release: 8%{?dist}
License: Vim and MIT
Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2
Source1: virc
@@ -57,10 +57,8 @@ BuildRequires: hunspell-devel
%endif
Patch3000: vim-7.4-syntax.patch
-Patch3002: vim-7.4-nowarnings.patch
Patch3004: vim-7.0-rclocation.patch
Patch3007: vim-7.4-fstabsyntax.patch
-Patch3008: vim-7.4-syncolor.patch
Patch3010: vim-7.3-manpage-typo-668894-675480.patch
Patch3011: vim-manpagefixes-948566.patch
Patch3013: vim-7.4-globalsyntax.patch
@@ -72,6 +70,16 @@ Patch3017: vim-python3-tests.patch
Patch3018: vim-crypto-warning.patch
Patch3019: 0001-patch-8.2.3115-Coverity-complains-about-free_wininfo.patch
Patch3020: 0001-patch-8.2.3290-Vim9-compiling-dict-may-use-pointer-a.patch
+# 2002320 - CVE-2021-3770 vim: using retab with large value may lead to heap buffer overflow [rhel-9.0]
+Patch3021: vim-cve-var-retab.patch
+# 2004893 - CVE-2021-3778 vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c [rhel-9.0]
+Patch3022: 0001-patch-8.2.3409-reading-beyond-end-of-line-with-inval.patch
+# 2004976 - CVE-2021-3796 vim: use-after-free in nv_replace() in normal.c [rhel-9.0]
+Patch3023: 0001-patch-8.2.3428-using-freed-memory-when-replacing.patch
+# 2015517 - [s390x] Vim needs to be compiled with -D_REENTRANT
+Patch3024: 0001-patch-8.2.3406-on-some-systems-tests-fail-without-_R.patch
+# 2016202 - CVE-2021-3872 vim: heap-based buffer overflow in win_redr_status() drawscreen.c [rhel-9.0]
+Patch3025: 0001-patch-8.2.3487-illegal-memory-access-if-buffer-name-.patch
# gcc is no longer in buildroot by default
BuildRequires: gcc
@@ -268,10 +276,8 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
%endif
%patch3000 -p1
-%patch3002 -p1 -b .nowarnings
%patch3004 -p1
%patch3007 -p1 -b .fstabsyntax
-%patch3008 -p1 -b .syncolor
%patch3010 -p1
%patch3011 -p1
%patch3013 -p1
@@ -281,6 +287,11 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
%patch3018 -p1 -b .fips-warning
%patch3019 -p1 -b .covscan-free-wininfo
%patch3020 -p1 -b .covscan-key-freed
+%patch3021 -p1 -b .cve-var-retab
+%patch3022 -p1 -b .cve-utf-ptrchar
+%patch3023 -p1 -b .cve-nv-replace
+%patch3024 -p1 -b .reentrant
+%patch3025 -p1 -b .cve-win-redr
%build
cd src
@@ -838,6 +849,21 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
%endif
%changelog
+* Tue Oct 26 2021 Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-8
+- 2016202 - CVE-2021-3872 vim: heap-based buffer overflow in win_redr_status() drawscreen.c [rhel-9.0]
+
+* Tue Oct 19 2021 Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-7
+- 2015517 - [s390x] Vim needs to be compiled with -D_REENTRANT
+
+* Thu Oct 14 2021 Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-6
+- 2011412 - test suite fails on apache/httpd filetype tests
+- 2011424 - Remove vim-7.4-syncolor.patch
+- 2011429 - Remove downstream patch vim-7.4-nowarning.patch
+- 2011749 - Update test suite to work without default mouse behavior
+- 2002320 - CVE-2021-3770 vim: using retab with large value may lead to heap buffer overflow [rhel-9.0]
+- 2004893 - CVE-2021-3778 vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c [rhel-9.0]
+- 2004976 - CVE-2021-3796 vim: use-after-free in nv_replace() in normal.c [rhel-9.0]
+
* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 2:8.2.2637-5
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688