summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-support/vim/files/0001-patch-8.2.3581-reading-character-past-end-of-line.patch62
-rw-r--r--meta/recipes-support/vim/files/0001-src-Makefile-improve-reproducibility.patch13
-rw-r--r--meta/recipes-support/vim/files/0002-patch-8.2.3428-using-freed-memory-when-replacing.patch83
-rw-r--r--meta/recipes-support/vim/files/0002-patch-8.2.3582-reading-uninitialized-memory-when-giv.patch63
-rw-r--r--meta/recipes-support/vim/files/0002-patch-8.2.3611-crash-when-using-CTRL-W-f-without-fin.patch92
-rw-r--r--meta/recipes-support/vim/files/0003-patch-8.2.3487-illegal-memory-access-if-buffer-name-.patch86
-rw-r--r--meta/recipes-support/vim/files/0004-patch-8.2.3489-ml_get-error-after-search-with-range.patch72
-rw-r--r--meta/recipes-support/vim/files/0005-patch-8.2.3564-invalid-memory-access-when-scrolling-.patch97
-rw-r--r--meta/recipes-support/vim/files/CVE-2021-3778.patch61
-rw-r--r--meta/recipes-support/vim/files/b7081e135a16091c93f6f5f7525a5c58fb7ca9f9.patch207
-rw-r--r--meta/recipes-support/vim/files/disable_acl_header_check.patch15
-rw-r--r--meta/recipes-support/vim/files/no-path-adjust.patch8
-rw-r--r--meta/recipes-support/vim/files/racefix.patch6
-rw-r--r--meta/recipes-support/vim/files/vim-add-knob-whether-elf.h-are-checked.patch13
-rw-r--r--meta/recipes-support/vim/vim.inc15
15 files changed, 28 insertions, 865 deletions
diff --git a/meta/recipes-support/vim/files/0001-patch-8.2.3581-reading-character-past-end-of-line.patch b/meta/recipes-support/vim/files/0001-patch-8.2.3581-reading-character-past-end-of-line.patch
deleted file mode 100644
index 28c61cd782..0000000000
--- a/meta/recipes-support/vim/files/0001-patch-8.2.3581-reading-character-past-end-of-line.patch
+++ /dev/null
@@ -1,62 +0,0 @@
1CVE: CVE-2021-3927
2Upstream-Status: Backport
3Signed-off-by: Ross Burton <ross.burton@arm.com>
4
5From 93b427c6e729260d0700c3b2804ec153bc8284fa Mon Sep 17 00:00:00 2001
6From: Bram Moolenaar <Bram@vim.org>
7Date: Thu, 4 Nov 2021 15:10:11 +0000
8Subject: [PATCH] patch 8.2.3581: reading character past end of line
9
10Problem: Reading character past end of line.
11Solution: Correct the cursor column.
12---
13 src/ex_docmd.c | 1 +
14 src/testdir/test_put.vim | 12 ++++++++++++
15 src/version.c | 2 ++
16 3 files changed, 15 insertions(+)
17
18diff --git a/src/ex_docmd.c b/src/ex_docmd.c
19index fde726477..59e245bee 100644
20--- a/src/ex_docmd.c
21+++ b/src/ex_docmd.c
22@@ -6905,6 +6905,7 @@ ex_put(exarg_T *eap)
23 eap->forceit = TRUE;
24 }
25 curwin->w_cursor.lnum = eap->line2;
26+ check_cursor_col();
27 do_put(eap->regname, eap->forceit ? BACKWARD : FORWARD, 1L,
28 PUT_LINE|PUT_CURSLINE);
29 }
30diff --git a/src/testdir/test_put.vim b/src/testdir/test_put.vim
31index 225ebd1f3..922e5b269 100644
32--- a/src/testdir/test_put.vim
33+++ b/src/testdir/test_put.vim
34@@ -113,3 +113,15 @@ func Test_put_p_indent_visual()
35 call assert_equal('select that text', getline(2))
36 bwipe!
37 endfunc
38+
39+func Test_put_above_first_line()
40+ new
41+ let @" = 'text'
42+ silent! normal 0o00
43+ 0put
44+ call assert_equal('text', getline(1))
45+ bwipe!
46+endfunc
47+
48+
49+" vim: shiftwidth=2 sts=2 expandtab
50diff --git a/src/version.c b/src/version.c
51index a9e8be0e7..df4ec9a47 100644
52--- a/src/version.c
53+++ b/src/version.c
54@@ -742,6 +742,8 @@ static char *(features[]) =
55
56 static int included_patches[] =
57 { /* Add new patch number below this line */
58+/**/
59+ 3581,
60 /**/
61 3564,
62 /**/
diff --git a/meta/recipes-support/vim/files/0001-src-Makefile-improve-reproducibility.patch b/meta/recipes-support/vim/files/0001-src-Makefile-improve-reproducibility.patch
index 63a7b78f12..2fc11dbdc2 100644
--- a/meta/recipes-support/vim/files/0001-src-Makefile-improve-reproducibility.patch
+++ b/meta/recipes-support/vim/files/0001-src-Makefile-improve-reproducibility.patch
@@ -16,11 +16,11 @@ Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
16 src/Makefile | 14 ++++---------- 16 src/Makefile | 14 ++++----------
17 1 file changed, 4 insertions(+), 10 deletions(-) 17 1 file changed, 4 insertions(+), 10 deletions(-)
18 18
19diff --git a/src/Makefile b/src/Makefile 19Index: git/src/Makefile
20index f2fafa4dc..7148d4bd9 100644 20===================================================================
21--- a/src/Makefile 21--- git.orig/src/Makefile
22+++ b/src/Makefile 22+++ git/src/Makefile
23@@ -2845,16 +2845,10 @@ auto/pathdef.c: Makefile auto/config.mk 23@@ -3101,16 +3101,10 @@ auto/pathdef.c: Makefile auto/config.mk
24 -@echo '#include "vim.h"' >> $@ 24 -@echo '#include "vim.h"' >> $@
25 -@echo 'char_u *default_vim_dir = (char_u *)"$(VIMRCLOC)";' | $(QUOTESED) >> $@ 25 -@echo 'char_u *default_vim_dir = (char_u *)"$(VIMRCLOC)";' | $(QUOTESED) >> $@
26 -@echo 'char_u *default_vimruntime_dir = (char_u *)"$(VIMRUNTIMEDIR)";' | $(QUOTESED) >> $@ 26 -@echo 'char_u *default_vimruntime_dir = (char_u *)"$(VIMRUNTIMEDIR)";' | $(QUOTESED) >> $@
@@ -41,6 +41,3 @@ index f2fafa4dc..7148d4bd9 100644
41 -@sh $(srcdir)/pathdef.sh 41 -@sh $(srcdir)/pathdef.sh
42 42
43 GUI_GTK_RES_INPUTS = \ 43 GUI_GTK_RES_INPUTS = \
44--
452.17.1
46
diff --git a/meta/recipes-support/vim/files/0002-patch-8.2.3428-using-freed-memory-when-replacing.patch b/meta/recipes-support/vim/files/0002-patch-8.2.3428-using-freed-memory-when-replacing.patch
deleted file mode 100644
index ecfae0301e..0000000000
--- a/meta/recipes-support/vim/files/0002-patch-8.2.3428-using-freed-memory-when-replacing.patch
+++ /dev/null
@@ -1,83 +0,0 @@
1CVE: CVE-2021-3796
2Upstream-Status: Backport
3Signed-off-by: Ross Burton <ross.burton@arm.com>
4
5From 1160e5f74b229336502fc376416f21108d36cfc2 Mon Sep 17 00:00:00 2001
6From: Bram Moolenaar <Bram@vim.org>
7Date: Sat, 11 Sep 2021 21:14:20 +0200
8Subject: [PATCH] patch 8.2.3428: using freed memory when replacing
9
10Problem: Using freed memory when replacing. (Dhiraj Mishra)
11Solution: Get the line pointer after calling ins_copychar().
12---
13 src/normal.c | 10 +++++++---
14 src/testdir/test_edit.vim | 14 ++++++++++++++
15 src/version.c | 2 ++
16 3 files changed, 23 insertions(+), 3 deletions(-)
17
18diff --git a/src/normal.c b/src/normal.c
19index c4963e621..d6333b948 100644
20--- a/src/normal.c
21+++ b/src/normal.c
22@@ -5009,19 +5009,23 @@ nv_replace(cmdarg_T *cap)
23 {
24 /*
25 * Get ptr again, because u_save and/or showmatch() will have
26- * released the line. At the same time we let know that the
27- * line will be changed.
28+ * released the line. This may also happen in ins_copychar().
29+ * At the same time we let know that the line will be changed.
30 */
31- ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
32 if (cap->nchar == Ctrl_E || cap->nchar == Ctrl_Y)
33 {
34 int c = ins_copychar(curwin->w_cursor.lnum
35 + (cap->nchar == Ctrl_Y ? -1 : 1));
36+
37+ ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
38 if (c != NUL)
39 ptr[curwin->w_cursor.col] = c;
40 }
41 else
42+ {
43+ ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
44 ptr[curwin->w_cursor.col] = cap->nchar;
45+ }
46 if (p_sm && msg_silent == 0)
47 showmatch(cap->nchar);
48 ++curwin->w_cursor.col;
49diff --git a/src/testdir/test_edit.vim b/src/testdir/test_edit.vim
50index 4e29e7fe1..f94e6c181 100644
51--- a/src/testdir/test_edit.vim
52+++ b/src/testdir/test_edit.vim
53@@ -1519,3 +1519,17 @@ func Test_edit_noesckeys()
54 bwipe!
55 set esckeys
56 endfunc
57+
58+" Test for getting the character of the line below after "p"
59+func Test_edit_put_CTRL_E()
60+ set encoding=latin1
61+ new
62+ let @" = ''
63+ sil! norm orggRx
64+ sil! norm pr
65+ call assert_equal(['r', 'r'], getline(1, 2))
66+ bwipe!
67+ set encoding=utf-8
68+endfunc
69+
70+" vim: shiftwidth=2 sts=2 expandtab
71diff --git a/src/version.c b/src/version.c
72index 85bdfc601..1046993d6 100644
73--- a/src/version.c
74+++ b/src/version.c
75@@ -742,6 +742,8 @@ static char *(features[]) =
76
77 static int included_patches[] =
78 { /* Add new patch number below this line */
79+/**/
80+ 3428,
81 /**/
82 3409,
83 /**/
diff --git a/meta/recipes-support/vim/files/0002-patch-8.2.3582-reading-uninitialized-memory-when-giv.patch b/meta/recipes-support/vim/files/0002-patch-8.2.3582-reading-uninitialized-memory-when-giv.patch
deleted file mode 100644
index d117a98893..0000000000
--- a/meta/recipes-support/vim/files/0002-patch-8.2.3582-reading-uninitialized-memory-when-giv.patch
+++ /dev/null
@@ -1,63 +0,0 @@
1CVE: CVE-2021-3928
2Upstream-Status: Backport
3Signed-off-by: Ross Burton <ross.burton@arm.com>
4
5From ade0f0481969f1453c60e7c8354b00dfe4238739 Mon Sep 17 00:00:00 2001
6From: Bram Moolenaar <Bram@vim.org>
7Date: Thu, 4 Nov 2021 15:46:05 +0000
8Subject: [PATCH] patch 8.2.3582: reading uninitialized memory when giving
9 spell suggestions
10
11Problem: Reading uninitialized memory when giving spell suggestions.
12Solution: Check that preword is not empty.
13---
14 src/spellsuggest.c | 2 +-
15 src/testdir/test_spell.vim | 8 ++++++++
16 src/version.c | 2 ++
17 3 files changed, 11 insertions(+), 1 deletion(-)
18
19diff --git a/src/spellsuggest.c b/src/spellsuggest.c
20index 9d6df7930..8615d5280 100644
21--- a/src/spellsuggest.c
22+++ b/src/spellsuggest.c
23@@ -1600,7 +1600,7 @@ suggest_trie_walk(
24 // char, e.g., "thes," -> "these".
25 p = fword + sp->ts_fidx;
26 MB_PTR_BACK(fword, p);
27- if (!spell_iswordp(p, curwin))
28+ if (!spell_iswordp(p, curwin) && *preword != NUL)
29 {
30 p = preword + STRLEN(preword);
31 MB_PTR_BACK(preword, p);
32diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
33index 79fb8927c..e435e9172 100644
34--- a/src/testdir/test_spell.vim
35+++ b/src/testdir/test_spell.vim
36@@ -498,6 +498,14 @@ func Test_spell_screendump()
37 call delete('XtestSpell')
38 endfunc
39
40+func Test_spell_single_word()
41+ new
42+ silent! norm 0R00
43+ spell! ßÂ
44+ silent 0norm 0r$ Dvz=
45+ bwipe!
46+endfunc
47+
48 let g:test_data_aff1 = [
49 \"SET ISO8859-1",
50 \"TRY esianrtolcdugmphbyfvkwjkqxz-\xEB\xE9\xE8\xEA\xEF\xEE\xE4\xE0\xE2\xF6\xFC\xFB'ESIANRTOLCDUGMPHBYFVKWJKQXZ",
51diff --git a/src/version.c b/src/version.c
52index df4ec9a47..e1bc0d09b 100644
53--- a/src/version.c
54+++ b/src/version.c
55@@ -742,6 +742,8 @@ static char *(features[]) =
56
57 static int included_patches[] =
58 { /* Add new patch number below this line */
59+/**/
60+ 3582,
61 /**/
62 3581,
63 /**/
diff --git a/meta/recipes-support/vim/files/0002-patch-8.2.3611-crash-when-using-CTRL-W-f-without-fin.patch b/meta/recipes-support/vim/files/0002-patch-8.2.3611-crash-when-using-CTRL-W-f-without-fin.patch
deleted file mode 100644
index 58d3442677..0000000000
--- a/meta/recipes-support/vim/files/0002-patch-8.2.3611-crash-when-using-CTRL-W-f-without-fin.patch
+++ /dev/null
@@ -1,92 +0,0 @@
1CVE: CVE-2021-3973
2Upstream-Status: Backport
3Signed-off-by: Ross Burton <ross.burton@arm.com>
4
5From b6154e9f530544ddc3130d981caae0dabc053757 Mon Sep 17 00:00:00 2001
6From: Bram Moolenaar <Bram@vim.org>
7Date: Wed, 17 Nov 2021 18:00:31 +0000
8Subject: [PATCH] patch 8.2.3611: crash when using CTRL-W f without finding a
9 file name Problem: Crash when using CTRL-W f without finding
10 a file name. Solution: Bail out when the file name length is zero.
11
12---
13 src/findfile.c | 8 ++++++++
14 src/normal.c | 6 ++++--
15 src/testdir/test_visual.vim | 8 ++++++++
16 src/version.c | 2 ++
17 4 files changed, 22 insertions(+), 2 deletions(-)
18
19diff --git a/src/findfile.c b/src/findfile.c
20index dba547da1..5764fd7b8 100644
21--- a/src/findfile.c
22+++ b/src/findfile.c
23@@ -1727,6 +1727,9 @@ find_file_in_path_option(
24 proc->pr_WindowPtr = (APTR)-1L;
25 # endif
26
27+ if (len == 0)
28+ return NULL;
29+
30 if (first == TRUE)
31 {
32 // copy file name into NameBuff, expanding environment variables
33@@ -2094,7 +2097,12 @@ find_file_name_in_path(
34 int c;
35 # if defined(FEAT_FIND_ID) && defined(FEAT_EVAL)
36 char_u *tofree = NULL;
37+# endif
38
39+ if (len == 0)
40+ return NULL;
41+
42+# if defined(FEAT_FIND_ID) && defined(FEAT_EVAL)
43 if ((options & FNAME_INCL) && *curbuf->b_p_inex != NUL)
44 {
45 tofree = eval_includeexpr(ptr, len);
46diff --git a/src/normal.c b/src/normal.c
47index 7cb959257..f0084f2ac 100644
48--- a/src/normal.c
49+++ b/src/normal.c
50@@ -3778,8 +3778,10 @@ get_visual_text(
51 *pp = ml_get_pos(&VIsual);
52 *lenp = curwin->w_cursor.col - VIsual.col + 1;
53 }
54- if (has_mbyte)
55- // Correct the length to include the whole last character.
56+ if (**pp == NUL)
57+ *lenp = 0;
58+ if (has_mbyte && *lenp > 0)
59+ // Correct the length to include all bytes of the last character.
60 *lenp += (*mb_ptr2len)(*pp + (*lenp - 1)) - 1;
61 }
62 reset_VIsual_and_resel();
63diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
64index ae281238e..0705fdb57 100644
65--- a/src/testdir/test_visual.vim
66+++ b/src/testdir/test_visual.vim
67@@ -894,4 +894,12 @@ func Test_block_insert_replace_tabs()
68 bwipe!
69 endfunc
70
71+func Test_visual_block_ctrl_w_f()
72+ " Emtpy block selected in new buffer should not result in an error.
73+ au! BufNew foo sil norm f
74+ edit foo
75+
76+ au! BufNew
77+endfunc
78+
79 " vim: shiftwidth=2 sts=2 expandtab
80diff --git a/src/version.c b/src/version.c
81index 52be3c39d..59a314b3a 100644
82--- a/src/version.c
83+++ b/src/version.c
84@@ -742,6 +742,8 @@ static char *(features[]) =
85
86 static int included_patches[] =
87 { /* Add new patch number below this line */
88+/**/
89+ 3611,
90 /**/
91 3582,
92 /**/
diff --git a/meta/recipes-support/vim/files/0003-patch-8.2.3487-illegal-memory-access-if-buffer-name-.patch b/meta/recipes-support/vim/files/0003-patch-8.2.3487-illegal-memory-access-if-buffer-name-.patch
deleted file mode 100644
index 576664f436..0000000000
--- a/meta/recipes-support/vim/files/0003-patch-8.2.3487-illegal-memory-access-if-buffer-name-.patch
+++ /dev/null
@@ -1,86 +0,0 @@
1CVE: CVE-2021-3872
2Upstream-Status: Backport
3Signed-off-by: Ross Burton <ross.burton@arm.com>
4
5From 61629ea24a2fff1f89c37479d3fb52f17c3480fc Mon Sep 17 00:00:00 2001
6From: Bram Moolenaar <Bram@vim.org>
7Date: Fri, 8 Oct 2021 18:39:28 +0100
8Subject: [PATCH] patch 8.2.3487: illegal memory access if buffer name is very
9 long
10
11Problem: Illegal memory access if buffer name is very long.
12Solution: Make sure not to go over the end of the buffer.
13---
14 src/drawscreen.c | 10 +++++-----
15 src/testdir/test_statusline.vim | 11 +++++++++++
16 src/version.c | 2 ++
17 3 files changed, 18 insertions(+), 5 deletions(-)
18
19diff --git a/src/drawscreen.c b/src/drawscreen.c
20index 3a88ee979..9acb70552 100644
21--- a/src/drawscreen.c
22+++ b/src/drawscreen.c
23@@ -446,13 +446,13 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED)
24 *(p + len++) = ' ';
25 if (bt_help(wp->w_buffer))
26 {
27- STRCPY(p + len, _("[Help]"));
28+ vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[Help]"));
29 len += (int)STRLEN(p + len);
30 }
31 #ifdef FEAT_QUICKFIX
32 if (wp->w_p_pvw)
33 {
34- STRCPY(p + len, _("[Preview]"));
35+ vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[Preview]"));
36 len += (int)STRLEN(p + len);
37 }
38 #endif
39@@ -462,12 +462,12 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED)
40 #endif
41 )
42 {
43- STRCPY(p + len, "[+]");
44- len += 3;
45+ vim_snprintf((char *)p + len, MAXPATHL - len, "%s", "[+]");
46+ len += (int)STRLEN(p + len);
47 }
48 if (wp->w_buffer->b_p_ro)
49 {
50- STRCPY(p + len, _("[RO]"));
51+ vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[RO]"));
52 len += (int)STRLEN(p + len);
53 }
54
55diff --git a/src/testdir/test_statusline.vim b/src/testdir/test_statusline.vim
56index 1f705b847..91bce1407 100644
57--- a/src/testdir/test_statusline.vim
58+++ b/src/testdir/test_statusline.vim
59@@ -393,3 +393,14 @@ func Test_statusline_visual()
60 bwipe! x1
61 bwipe! x2
62 endfunc
63+" Used to write beyond allocated memory. This assumes MAXPATHL is 4096 bytes.
64+func Test_statusline_verylong_filename()
65+ let fname = repeat('x', 4090)
66+ exe "new " .. fname
67+ set buftype=help
68+ set previewwindow
69+ redraw
70+ bwipe!
71+endfunc
72+
73+" vim: shiftwidth=2 sts=2 expandtab
74diff --git a/src/version.c b/src/version.c
75index 1046993d6..2b5de5ccf 100644
76--- a/src/version.c
77+++ b/src/version.c
78@@ -742,6 +742,8 @@ static char *(features[]) =
79
80 static int included_patches[] =
81 { /* Add new patch number below this line */
82+/**/
83+ 3487,
84 /**/
85 3428,
86 /**/
diff --git a/meta/recipes-support/vim/files/0004-patch-8.2.3489-ml_get-error-after-search-with-range.patch b/meta/recipes-support/vim/files/0004-patch-8.2.3489-ml_get-error-after-search-with-range.patch
deleted file mode 100644
index 045081579c..0000000000
--- a/meta/recipes-support/vim/files/0004-patch-8.2.3489-ml_get-error-after-search-with-range.patch
+++ /dev/null
@@ -1,72 +0,0 @@
1CVE: CVE-2021-3875
2Upstream-Status: Backport
3Signed-off-by: Ross Burton <ross.burton@arm.com>
4
5From b8968e26d7508e7d64bfc86808142818b0a9288c Mon Sep 17 00:00:00 2001
6From: Bram Moolenaar <Bram@vim.org>
7Date: Sat, 9 Oct 2021 13:58:55 +0100
8Subject: [PATCH] patch 8.2.3489: ml_get error after search with range
9
10Problem: ml_get error after search with range.
11Solution: Limit the line number to the buffer line count.
12---
13 src/ex_docmd.c | 6 ++++--
14 src/testdir/test_search.vim | 17 +++++++++++++++++
15 src/version.c | 2 ++
16 3 files changed, 23 insertions(+), 2 deletions(-)
17
18diff --git a/src/ex_docmd.c b/src/ex_docmd.c
19index fb07450f8..fde726477 100644
20--- a/src/ex_docmd.c
21+++ b/src/ex_docmd.c
22@@ -3586,8 +3586,10 @@ get_address(
23
24 // When '/' or '?' follows another address, start from
25 // there.
26- if (lnum != MAXLNUM)
27- curwin->w_cursor.lnum = lnum;
28+ if (lnum > 0 && lnum != MAXLNUM)
29+ curwin->w_cursor.lnum =
30+ lnum > curbuf->b_ml.ml_line_count
31+ ? curbuf->b_ml.ml_line_count : lnum;
32
33 // Start a forward search at the end of the line (unless
34 // before the first line).
35diff --git a/src/testdir/test_search.vim b/src/testdir/test_search.vim
36index 187671305..e142c3547 100644
37--- a/src/testdir/test_search.vim
38+++ b/src/testdir/test_search.vim
39@@ -1366,3 +1366,20 @@ func Test_searchdecl()
40
41 bwipe!
42 endfunc
43+
44+func Test_search_with_invalid_range()
45+ new
46+ let lines =<< trim END
47+ /\%.v
48+ 5/
49+ c
50+ END
51+ call writefile(lines, 'Xrangesearch')
52+ source Xrangesearch
53+
54+ bwipe!
55+ call delete('Xrangesearch')
56+endfunc
57+
58+
59+" vim: shiftwidth=2 sts=2 expandtab
60diff --git a/src/version.c b/src/version.c
61index 2b5de5ccf..092864bbb 100644
62--- a/src/version.c
63+++ b/src/version.c
64@@ -742,6 +742,8 @@ static char *(features[]) =
65
66 static int included_patches[] =
67 { /* Add new patch number below this line */
68+/**/
69+ 3489,
70 /**/
71 3487,
72 /**/
diff --git a/meta/recipes-support/vim/files/0005-patch-8.2.3564-invalid-memory-access-when-scrolling-.patch b/meta/recipes-support/vim/files/0005-patch-8.2.3564-invalid-memory-access-when-scrolling-.patch
deleted file mode 100644
index 7184b37cad..0000000000
--- a/meta/recipes-support/vim/files/0005-patch-8.2.3564-invalid-memory-access-when-scrolling-.patch
+++ /dev/null
@@ -1,97 +0,0 @@
1CVE: CVE-2021-3903
2Upstream-Status: Backport
3Signed-off-by: Ross Burton <ross.burton@arm.com>
4
5From b15919c1fe0f7fc3d98ff5207ed2feb43c59009d Mon Sep 17 00:00:00 2001
6From: Bram Moolenaar <Bram@vim.org>
7Date: Mon, 25 Oct 2021 17:07:04 +0100
8Subject: [PATCH] patch 8.2.3564: invalid memory access when scrolling without
9 valid screen
10
11Problem: Invalid memory access when scrolling without a valid screen.
12Solution: Do not set VALID_BOTLINE in w_valid.
13---
14 src/move.c | 1 -
15 src/testdir/test_normal.vim | 23 ++++++++++++++++++++---
16 src/version.c | 2 ++
17 3 files changed, 22 insertions(+), 4 deletions(-)
18
19diff --git a/src/move.c b/src/move.c
20index 8e53d8bcb..10165ef4d 100644
21--- a/src/move.c
22+++ b/src/move.c
23@@ -198,7 +198,6 @@ update_topline(void)
24 {
25 curwin->w_topline = curwin->w_cursor.lnum;
26 curwin->w_botline = curwin->w_topline;
27- curwin->w_valid |= VALID_BOTLINE|VALID_BOTLINE_AP;
28 curwin->w_scbind_pos = 1;
29 return;
30 }
31diff --git a/src/testdir/test_normal.vim b/src/testdir/test_normal.vim
32index d45cf4159..ca87928f5 100644
33--- a/src/testdir/test_normal.vim
34+++ b/src/testdir/test_normal.vim
35@@ -33,14 +33,14 @@ func CountSpaces(type, ...)
36 else
37 silent exe "normal! `[v`]y"
38 endif
39- let g:a=strlen(substitute(@@, '[^ ]', '', 'g'))
40+ let g:a = strlen(substitute(@@, '[^ ]', '', 'g'))
41 let &selection = sel_save
42 let @@ = reg_save
43 endfunc
44
45 func OpfuncDummy(type, ...)
46 " for testing operatorfunc
47- let g:opt=&linebreak
48+ let g:opt = &linebreak
49
50 if a:0 " Invoked from Visual mode, use gv command.
51 silent exe "normal! gvy"
52@@ -51,7 +51,7 @@ func OpfuncDummy(type, ...)
53 endif
54 " Create a new dummy window
55 new
56- let g:bufnr=bufnr('%')
57+ let g:bufnr = bufnr('%')
58 endfunc
59
60 fun! Test_normal00_optrans()
61@@ -718,6 +718,23 @@ func Test_normal17_z_scroll_hor2()
62 bw!
63 endfunc
64
65+
66+func Test_scroll_in_ex_mode()
67+ " This was using invalid memory because w_botline was invalid.
68+ let lines =<< trim END
69+ diffsplit
70+ norm os00(
71+ call writefile(['done'], 'Xdone')
72+ qa!
73+ END
74+ call writefile(lines, 'Xscript')
75+ call assert_equal(1, RunVim([], [], '--clean -X -Z -e -s -S Xscript'))
76+ call assert_equal(['done'], readfile('Xdone'))
77+
78+ call delete('Xscript')
79+ call delete('Xdone')
80+endfunc
81+
82 func Test_normal18_z_fold()
83 " basic tests for foldopen/folddelete
84 if !has("folding")
85diff --git a/src/version.c b/src/version.c
86index 092864bbb..a9e8be0e7 100644
87--- a/src/version.c
88+++ b/src/version.c
89@@ -742,6 +742,8 @@ static char *(features[]) =
90
91 static int included_patches[] =
92 { /* Add new patch number below this line */
93+/**/
94+ 3564,
95 /**/
96 3489,
97 /**/
diff --git a/meta/recipes-support/vim/files/CVE-2021-3778.patch b/meta/recipes-support/vim/files/CVE-2021-3778.patch
deleted file mode 100644
index 544af04458..0000000000
--- a/meta/recipes-support/vim/files/CVE-2021-3778.patch
+++ /dev/null
@@ -1,61 +0,0 @@
1From 6d351cec5b97cb72b226d03bd727e453a235ed8d Mon Sep 17 00:00:00 2001
2From: Minjae Kim <flowergom@gmail.com>
3Date: Sun, 26 Sep 2021 23:48:00 +0000
4Subject: [PATCH] patch 8.2.3409: reading beyond end of line with invalid utf-8
5 character
6
7Problem: Reading beyond end of line with invalid utf-8 character.
8Solution: Check for NUL when advancing.
9
10Upstream-Status: Accepted [https://github.com/vim/vim/commit/65b605665997fad54ef39a93199e305af2fe4d7f]
11CVE: CVE-2021-3778
12Signed-off-by: Minjae Kim <flowergom@gmail.com>
13
14---
15 src/regexp_nfa.c | 3 ++-
16 src/testdir/test_regexp_utf8.vim | 7 +++++++
17 src/version.c | 2 ++
18 3 files changed, 11 insertions(+), 1 deletion(-)
19
20diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c
21index fb512f961..ace83a1a3 100644
22--- a/src/regexp_nfa.c
23+++ b/src/regexp_nfa.c
24@@ -5455,7 +5455,8 @@ find_match_text(colnr_T startcol, int regstart, char_u *match_text)
25 match = FALSE;
26 break;
27 }
28- len2 += MB_CHAR2LEN(c2);
29+ len2 += enc_utf8 ? utf_ptr2len(rex.line + col + len2)
30+ : MB_CHAR2LEN(c2);
31 }
32 if (match
33 // check that no composing char follows
34diff --git a/src/testdir/test_regexp_utf8.vim b/src/testdir/test_regexp_utf8.vim
35index 19ff882be..e0665818b 100644
36--- a/src/testdir/test_regexp_utf8.vim
37+++ b/src/testdir/test_regexp_utf8.vim
38@@ -215,3 +215,10 @@ func Test_optmatch_toolong()
39 set re=0
40 endfunc
41
42+func Test_match_invalid_byte()
43+ call writefile(0z630a.765d30aa0a.2e0a.790a.4030, 'Xinvalid')
44+ new
45+ source Xinvalid
46+ bwipe!
47+ call delete('Xinvalid')
48+endfunc
49diff --git a/src/version.c b/src/version.c
50index 8912f6215..85bdfc601 100644
51--- a/src/version.c
52+++ b/src/version.c
53@@ -742,6 +742,8 @@ static char *(features[]) =
54
55 static int included_patches[] =
56 { /* Add new patch number below this line */
57+/**/
58+ 3409,
59 /**/
60 3402,
61 /**/
diff --git a/meta/recipes-support/vim/files/b7081e135a16091c93f6f5f7525a5c58fb7ca9f9.patch b/meta/recipes-support/vim/files/b7081e135a16091c93f6f5f7525a5c58fb7ca9f9.patch
deleted file mode 100644
index 1cee759502..0000000000
--- a/meta/recipes-support/vim/files/b7081e135a16091c93f6f5f7525a5c58fb7ca9f9.patch
+++ /dev/null
@@ -1,207 +0,0 @@
1From b7081e135a16091c93f6f5f7525a5c58fb7ca9f9 Mon Sep 17 00:00:00 2001
2From: Bram Moolenaar <Bram@vim.org>
3Date: Sat, 4 Sep 2021 18:47:28 +0200
4Subject: [PATCH] patch 8.2.3402: invalid memory access when using :retab with
5 large value
6
7Problem: Invalid memory access when using :retab with large value.
8Solution: Check the number is positive.
9
10CVE: CVE-2021-3770
11Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
12Upstream-Status: Backport [https://github.com/vim/vim/commit/b7081e135a16091c93f6f5f7525a5c58fb7ca9f9]
13---
14 src/indent.c | 34 +++++++++++++++++++++-------------
15 src/option.c | 12 ++++++------
16 src/optionstr.c | 4 ++--
17 src/testdir/test_retab.vim | 3 +++
18 src/version.c | 2 ++
19 5 files changed, 34 insertions(+), 21 deletions(-)
20
21Index: git/src/indent.c
22===================================================================
23--- git.orig/src/indent.c
24+++ git/src/indent.c
25@@ -18,18 +18,19 @@
26 /*
27 * Set the integer values corresponding to the string setting of 'vartabstop'.
28 * "array" will be set, caller must free it if needed.
29+ * Return FAIL for an error.
30 */
31 int
32 tabstop_set(char_u *var, int **array)
33 {
34- int valcount = 1;
35- int t;
36- char_u *cp;
37+ int valcount = 1;
38+ int t;
39+ char_u *cp;
40
41 if (var[0] == NUL || (var[0] == '0' && var[1] == NUL))
42 {
43 *array = NULL;
44- return TRUE;
45+ return OK;
46 }
47
48 for (cp = var; *cp != NUL; ++cp)
49@@ -43,8 +44,8 @@ tabstop_set(char_u *var, int **array)
50 if (cp != end)
51 emsg(_(e_positive));
52 else
53- emsg(_(e_invarg));
54- return FALSE;
55+ semsg(_(e_invarg2), cp);
56+ return FAIL;
57 }
58 }
59
60@@ -55,26 +56,33 @@ tabstop_set(char_u *var, int **array)
61 ++valcount;
62 continue;
63 }
64- emsg(_(e_invarg));
65- return FALSE;
66+ semsg(_(e_invarg2), var);
67+ return FAIL;
68 }
69
70 *array = ALLOC_MULT(int, valcount + 1);
71 if (*array == NULL)
72- return FALSE;
73+ return FAIL;
74 (*array)[0] = valcount;
75
76 t = 1;
77 for (cp = var; *cp != NUL;)
78 {
79- (*array)[t++] = atoi((char *)cp);
80- while (*cp != NUL && *cp != ',')
81+ int n = atoi((char *)cp);
82+
83+ if (n < 0 || n > 9999)
84+ {
85+ semsg(_(e_invarg2), cp);
86+ return FAIL;
87+ }
88+ (*array)[t++] = n;
89+ while (*cp != NUL && *cp != ',')
90 ++cp;
91 if (*cp != NUL)
92 ++cp;
93 }
94
95- return TRUE;
96+ return OK;
97 }
98
99 /*
100@@ -1556,7 +1564,7 @@ ex_retab(exarg_T *eap)
101
102 #ifdef FEAT_VARTABS
103 new_ts_str = eap->arg;
104- if (!tabstop_set(eap->arg, &new_vts_array))
105+ if (tabstop_set(eap->arg, &new_vts_array) == FAIL)
106 return;
107 while (vim_isdigit(*(eap->arg)) || *(eap->arg) == ',')
108 ++(eap->arg);
109Index: git/src/option.c
110===================================================================
111--- git.orig/src/option.c
112+++ git/src/option.c
113@@ -2292,9 +2292,9 @@ didset_options2(void)
114 #endif
115 #ifdef FEAT_VARTABS
116 vim_free(curbuf->b_p_vsts_array);
117- tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
118+ (void)tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
119 vim_free(curbuf->b_p_vts_array);
120- tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array);
121+ (void)tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array);
122 #endif
123 }
124
125@@ -5756,7 +5756,7 @@ buf_copy_options(buf_T *buf, int flags)
126 buf->b_p_vsts = vim_strsave(p_vsts);
127 COPY_OPT_SCTX(buf, BV_VSTS);
128 if (p_vsts && p_vsts != empty_option)
129- tabstop_set(p_vsts, &buf->b_p_vsts_array);
130+ (void)tabstop_set(p_vsts, &buf->b_p_vsts_array);
131 else
132 buf->b_p_vsts_array = 0;
133 buf->b_p_vsts_nopaste = p_vsts_nopaste
134@@ -5914,7 +5914,7 @@ buf_copy_options(buf_T *buf, int flags)
135 buf->b_p_isk = save_p_isk;
136 #ifdef FEAT_VARTABS
137 if (p_vts && p_vts != empty_option && !buf->b_p_vts_array)
138- tabstop_set(p_vts, &buf->b_p_vts_array);
139+ (void)tabstop_set(p_vts, &buf->b_p_vts_array);
140 else
141 buf->b_p_vts_array = NULL;
142 #endif
143@@ -5929,7 +5929,7 @@ buf_copy_options(buf_T *buf, int flags)
144 buf->b_p_vts = vim_strsave(p_vts);
145 COPY_OPT_SCTX(buf, BV_VTS);
146 if (p_vts && p_vts != empty_option && !buf->b_p_vts_array)
147- tabstop_set(p_vts, &buf->b_p_vts_array);
148+ (void)tabstop_set(p_vts, &buf->b_p_vts_array);
149 else
150 buf->b_p_vts_array = NULL;
151 #endif
152@@ -6634,7 +6634,7 @@ paste_option_changed(void)
153 if (buf->b_p_vsts_array)
154 vim_free(buf->b_p_vsts_array);
155 if (buf->b_p_vsts && buf->b_p_vsts != empty_option)
156- tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
157+ (void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
158 else
159 buf->b_p_vsts_array = 0;
160 #endif
161Index: git/src/optionstr.c
162===================================================================
163--- git.orig/src/optionstr.c
164+++ git/src/optionstr.c
165@@ -2166,7 +2166,7 @@ did_set_string_option(
166 if (errmsg == NULL)
167 {
168 int *oldarray = curbuf->b_p_vsts_array;
169- if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)))
170+ if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)) == OK)
171 {
172 if (oldarray)
173 vim_free(oldarray);
174@@ -2205,7 +2205,7 @@ did_set_string_option(
175 {
176 int *oldarray = curbuf->b_p_vts_array;
177
178- if (tabstop_set(*varp, &(curbuf->b_p_vts_array)))
179+ if (tabstop_set(*varp, &(curbuf->b_p_vts_array)) == OK)
180 {
181 vim_free(oldarray);
182 #ifdef FEAT_FOLDING
183Index: git/src/testdir/test_retab.vim
184===================================================================
185--- git.orig/src/testdir/test_retab.vim
186+++ git/src/testdir/test_retab.vim
187@@ -74,4 +74,7 @@ endfunc
188 func Test_retab_error()
189 call assert_fails('retab -1', 'E487:')
190 call assert_fails('retab! -1', 'E487:')
191+ call assert_fails('ret -1000', 'E487:')
192+ call assert_fails('ret 10000', 'E475:')
193+ call assert_fails('ret 80000000000000000000', 'E475:')
194 endfunc
195Index: git/src/version.c
196===================================================================
197--- git.orig/src/version.c
198+++ git/src/version.c
199@@ -743,6 +743,8 @@ static char *(features[]) =
200 static int included_patches[] =
201 { /* Add new patch number below this line */
202 /**/
203+ 3402,
204+/**/
205 0
206 };
207
diff --git a/meta/recipes-support/vim/files/disable_acl_header_check.patch b/meta/recipes-support/vim/files/disable_acl_header_check.patch
index 26335d3297..ee1ea0f390 100644
--- a/meta/recipes-support/vim/files/disable_acl_header_check.patch
+++ b/meta/recipes-support/vim/files/disable_acl_header_check.patch
@@ -13,11 +13,11 @@ Signed-off-by: Changqing Li <changqing.li@windriver.com>
13 src/configure.ac | 3 ++- 13 src/configure.ac | 3 ++-
14 1 file changed, 2 insertions(+), 1 deletion(-) 14 1 file changed, 2 insertions(+), 1 deletion(-)
15 15
16diff --git a/src/configure.ac b/src/configure.ac 16Index: git/src/configure.ac
17index 2d409b3ca06a..dbcaf6140263 100644 17===================================================================
18--- a/src/configure.ac 18--- git.orig/src/configure.ac
19+++ b/src/configure.ac 19+++ git/src/configure.ac
20@@ -3257,7 +3257,7 @@ AC_CHECK_HEADERS(stdint.h stdlib.h string.h \ 20@@ -3292,7 +3292,7 @@ AC_CHECK_HEADERS(stdint.h stdlib.h strin
21 sys/systeminfo.h locale.h sys/stream.h termios.h \ 21 sys/systeminfo.h locale.h sys/stream.h termios.h \
22 libc.h sys/statfs.h poll.h sys/poll.h pwd.h \ 22 libc.h sys/statfs.h poll.h sys/poll.h pwd.h \
23 utime.h sys/param.h sys/ptms.h libintl.h libgen.h \ 23 utime.h sys/param.h sys/ptms.h libintl.h libgen.h \
@@ -26,7 +26,7 @@ index 2d409b3ca06a..dbcaf6140263 100644
26 sys/access.h sys/sysinfo.h wchar.h wctype.h) 26 sys/access.h sys/sysinfo.h wchar.h wctype.h)
27 27
28 dnl sys/ptem.h depends on sys/stream.h on Solaris 28 dnl sys/ptem.h depends on sys/stream.h on Solaris
29@@ -3886,6 +3886,7 @@ AC_ARG_ENABLE(acl, 29@@ -3974,6 +3974,7 @@ AC_ARG_ENABLE(acl,
30 , [enable_acl="yes"]) 30 , [enable_acl="yes"])
31 if test "$enable_acl" = "yes"; then 31 if test "$enable_acl" = "yes"; then
32 AC_MSG_RESULT(no) 32 AC_MSG_RESULT(no)
@@ -34,6 +34,3 @@ index 2d409b3ca06a..dbcaf6140263 100644
34 AC_CHECK_LIB(posix1e, acl_get_file, [LIBS="$LIBS -lposix1e"], 34 AC_CHECK_LIB(posix1e, acl_get_file, [LIBS="$LIBS -lposix1e"],
35 AC_CHECK_LIB(acl, acl_get_file, [LIBS="$LIBS -lacl" 35 AC_CHECK_LIB(acl, acl_get_file, [LIBS="$LIBS -lacl"
36 AC_CHECK_LIB(attr, fgetxattr, LIBS="$LIBS -lattr",,)],,),) 36 AC_CHECK_LIB(attr, fgetxattr, LIBS="$LIBS -lattr",,)],,),)
37--
382.7.4
39
diff --git a/meta/recipes-support/vim/files/no-path-adjust.patch b/meta/recipes-support/vim/files/no-path-adjust.patch
index 05c2d803f6..9d6da80913 100644
--- a/meta/recipes-support/vim/files/no-path-adjust.patch
+++ b/meta/recipes-support/vim/files/no-path-adjust.patch
@@ -7,9 +7,11 @@ Upstream-Status: Pending
7 7
8Signed-off-by: Joe Slater <joe.slater@windriver.com> 8Signed-off-by: Joe Slater <joe.slater@windriver.com>
9 9
10--- a/src/Makefile 10Index: git/src/Makefile
11+++ b/src/Makefile 11===================================================================
12@@ -2507,11 +2507,14 @@ installtools: $(TOOLS) $(DESTDIR)$(exec_ 12--- git.orig/src/Makefile
13+++ git/src/Makefile
14@@ -2565,11 +2565,14 @@ installtools: $(TOOLS) $(DESTDIR)$(exec_
13 rm -rf $$cvs; \ 15 rm -rf $$cvs; \
14 fi 16 fi
15 -chmod $(FILEMOD) $(DEST_TOOLS)/* 17 -chmod $(FILEMOD) $(DEST_TOOLS)/*
diff --git a/meta/recipes-support/vim/files/racefix.patch b/meta/recipes-support/vim/files/racefix.patch
index 48dca44cad..1cb8fb442f 100644
--- a/meta/recipes-support/vim/files/racefix.patch
+++ b/meta/recipes-support/vim/files/racefix.patch
@@ -9,9 +9,9 @@ Index: git/src/po/Makefile
9=================================================================== 9===================================================================
10--- git.orig/src/po/Makefile 10--- git.orig/src/po/Makefile
11+++ git/src/po/Makefile 11+++ git/src/po/Makefile
12@@ -165,17 +165,16 @@ $(PACKAGE).pot: ../*.c ../if_perl.xs ../ 12@@ -207,17 +207,16 @@ $(PACKAGE).pot: $(PO_INPUTLIST) $(PO_VIM
13 po/gvim.desktop.in po/vim.desktop.in 13 # Delete the temporary files
14 mv -f ../$(PACKAGE).po $(PACKAGE).pot 14 rm *.js
15 15
16-vim.desktop: vim.desktop.in $(POFILES) 16-vim.desktop: vim.desktop.in $(POFILES)
17+LINGUAS: 17+LINGUAS:
diff --git a/meta/recipes-support/vim/files/vim-add-knob-whether-elf.h-are-checked.patch b/meta/recipes-support/vim/files/vim-add-knob-whether-elf.h-are-checked.patch
index 37914d4cd9..5284ba45b6 100644
--- a/meta/recipes-support/vim/files/vim-add-knob-whether-elf.h-are-checked.patch
+++ b/meta/recipes-support/vim/files/vim-add-knob-whether-elf.h-are-checked.patch
@@ -14,11 +14,11 @@ Signed-off-by: Changqing Li <changqing.li@windriver.com>
14 src/configure.ac | 7 +++++++ 14 src/configure.ac | 7 +++++++
15 1 file changed, 7 insertions(+) 15 1 file changed, 7 insertions(+)
16 16
17diff --git a/src/configure.ac b/src/configure.ac 17Index: git/src/configure.ac
18index 0ee86ad..64736f0 100644 18===================================================================
19--- a/src/configure.ac 19--- git.orig/src/configure.ac
20+++ b/src/configure.ac 20+++ git/src/configure.ac
21@@ -3192,11 +3192,18 @@ AC_TRY_COMPILE([#include <stdio.h>], [int x __attribute__((unused));], 21@@ -3264,11 +3264,18 @@ AC_TRY_COMPILE([#include <stdio.h>], [in
22 AC_MSG_RESULT(no)) 22 AC_MSG_RESULT(no))
23 23
24 dnl Checks for header files. 24 dnl Checks for header files.
@@ -37,6 +37,3 @@ index 0ee86ad..64736f0 100644
37 37
38 AC_HEADER_DIRENT 38 AC_HEADER_DIRENT
39 39
40--
412.7.4
42
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index a0692755b6..dc11a0aabb 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -8,8 +8,9 @@ BUGTRACKER = "https://github.com/vim/vim/issues"
8DEPENDS = "ncurses gettext-native" 8DEPENDS = "ncurses gettext-native"
9# vimdiff doesn't like busybox diff 9# vimdiff doesn't like busybox diff
10RSUGGESTS:${PN} = "diffutils" 10RSUGGESTS:${PN} = "diffutils"
11
11LICENSE = "vim" 12LICENSE = "vim"
12LIC_FILES_CHKSUM = "file://runtime/doc/uganda.txt;endline=287;md5=a19edd7ec70d573a005d9e509375a99a" 13LIC_FILES_CHKSUM = "file://runtime/doc/uganda.txt;endline=287;md5=909f1394892b7e0f9c2a95306c0c552b"
13 14
14SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \ 15SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \
15 file://disable_acl_header_check.patch \ 16 file://disable_acl_header_check.patch \
@@ -17,18 +18,10 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \
17 file://0001-src-Makefile-improve-reproducibility.patch \ 18 file://0001-src-Makefile-improve-reproducibility.patch \
18 file://no-path-adjust.patch \ 19 file://no-path-adjust.patch \
19 file://racefix.patch \ 20 file://racefix.patch \
20 file://b7081e135a16091c93f6f5f7525a5c58fb7ca9f9.patch \
21 file://CVE-2021-3778.patch \
22 file://0002-patch-8.2.3428-using-freed-memory-when-replacing.patch \
23 file://0003-patch-8.2.3487-illegal-memory-access-if-buffer-name-.patch \
24 file://0004-patch-8.2.3489-ml_get-error-after-search-with-range.patch \
25 file://0005-patch-8.2.3564-invalid-memory-access-when-scrolling-.patch \
26 file://0001-patch-8.2.3581-reading-character-past-end-of-line.patch \
27 file://0002-patch-8.2.3582-reading-uninitialized-memory-when-giv.patch \
28 file://0002-patch-8.2.3611-crash-when-using-CTRL-W-f-without-fin.patch \
29 " 21 "
30 22
31SRCREV = "98056533b96b6b5d8849641de93185dd7bcadc44" 23PV .= ".3752"
24SRCREV = "8603be338ac810446f23c092f21bc6082f787519"
32 25
33# Do not consider .z in x.y.z, as that is updated with every commit 26# Do not consider .z in x.y.z, as that is updated with every commit
34UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>\d+\.\d+)\.0" 27UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>\d+\.\d+)\.0"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-12-16 03:34:03 +0000