revert to el9 version 8.2-2637

Signed-off-by: Toshaan Bharvani <toshaan@powerel.org>

SOURCES/0001-patch-8.2.4327-may-end-up-with-no-current-buffer.patch

@@ -0,0 +1,110 @@
+From e3537aec2f8d6470010547af28dcbd83d41461b8 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Tue, 8 Feb 2022 15:05:20 +0000
+Subject: [PATCH] patch 8.2.4327: may end up with no current buffer
+
+Problem:    May end up with no current buffer.
+Solution:   When deleting the current buffer to not pick a quickfix buffer as
+            the new current buffer.
+---
+ src/buffer.c                  | 26 ++++++++++++++++++++++----
+ src/testdir/test_quickfix.vim | 25 +++++++++++++++++++++++++
+ src/version.c                 |  2 ++
+ 3 files changed, 49 insertions(+), 4 deletions(-)
+
+diff --git a/src/buffer.c b/src/buffer.c
+index 81bdb31ca..b3e2bc3f9 100644
+--- a/src/buffer.c
++++ b/src/buffer.c
+@@ -1430,8 +1430,14 @@ do_buffer_ext(
+ 		buf = buflist_findnr(curwin->w_jumplist[jumpidx].fmark.fnum);
+ 		if (buf != NULL)
+ 		{
+-		    if (buf == curbuf || !buf->b_p_bl)
+-			buf = NULL;	// skip current and unlisted bufs
++		    // Skip current and unlisted bufs.  Also skip a quickfix
++		    // buffer, it might be deleted soon.
++		    if (buf == curbuf || !buf->b_p_bl
++#if defined(FEAT_QUICKFIX)
++			    || bt_quickfix(buf)
++#endif
++			    )
++			buf = NULL;
+ 		    else if (buf->b_ml.ml_mfp == NULL)
+ 		    {
+ 			// skip unloaded buf, but may keep it for later
+@@ -1467,7 +1473,11 @@ do_buffer_ext(
+ 		    continue;
+ 		}
+ 		// in non-help buffer, try to skip help buffers, and vv
+-		if (buf->b_help == curbuf->b_help && buf->b_p_bl)
++		if (buf->b_help == curbuf->b_help && buf->b_p_bl
++#if defined(FEAT_QUICKFIX)
++			    && !bt_quickfix(buf)
++#endif
++			   )
+ 		{
+ 		    if (buf->b_ml.ml_mfp != NULL)   // found loaded buffer
+ 			break;
+@@ -1485,7 +1495,11 @@ do_buffer_ext(
+ 	if (buf == NULL)	// No loaded buffer, find listed one
+ 	{
+ 	    FOR_ALL_BUFFERS(buf)
+-		if (buf->b_p_bl && buf != curbuf)
++		if (buf->b_p_bl && buf != curbuf
++#if defined(FEAT_QUICKFIX)
++			    && !bt_quickfix(buf)
++#endif
++		       )
+ 		    break;
+ 	}
+ 	if (buf == NULL)	// Still no buffer, just take one
+@@ -1494,6 +1508,10 @@ do_buffer_ext(
+ 		buf = curbuf->b_next;
+ 	    else
+ 		buf = curbuf->b_prev;
++#if defined(FEAT_QUICKFIX)
++	    if (bt_quickfix(buf))
++		buf = NULL;
++#endif
+ 	}
+     }
+ 
+diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
+index 07fdb9644..adb0ea4fd 100644
+--- a/src/testdir/test_quickfix.vim
++++ b/src/testdir/test_quickfix.vim
+@@ -5851,5 +5851,30 @@ func Test_lopen_bwipe()
+   delfunc R
+ endfunc
+ 
++" Another sequence of commands that caused all buffers to be wiped out
++func Test_lopen_bwipe_all()
++  let lines =<< trim END
++    func R()
++      silent! tab lopen
++      e foo
++      silent! lfile
++    endfunc
++    cal R()
++    exe "norm \<C-W>\<C-V>0"
++    cal R()
++    bwipe
++
++    call writefile(['done'], 'Xresult')
++    qall!
++  END
++  call writefile(lines, 'Xscript')
++  if RunVim([], [], '-u NONE -n -X -Z -e -m -s -S Xscript')
++    call assert_equal(['done'], readfile('Xresult'))
++  endif
++
++  call delete('Xscript')
++  call delete('Xresult')
++endfunc
++
+ 
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+2.35.1
+

SOURCES/0001-patch-8.2.4563-z-in-Visual-mode-may-go-beyond-the-en.patch

@@ -0,0 +1,39 @@
+diff -up vim82/src/spellsuggest.c.cve0943 vim82/src/spellsuggest.c
+--- vim82/src/spellsuggest.c.cve0943	2022-03-28 20:48:07.079197805 +0200
++++ vim82/src/spellsuggest.c	2022-03-28 20:48:07.101197522 +0200
+@@ -501,6 +501,10 @@ spell_suggest(int count)
+ 	    curwin->w_cursor.col = VIsual.col;
+ 	++badlen;
+ 	end_visual_mode();
++	// make sure we don't include the NUL at the end of the line
++	line = ml_get_curline();
++	if (badlen > STRLEN(line) - curwin->w_cursor.col)
++	    badlen = STRLEN(line) - curwin->w_cursor.col;
+     }
+     // Find the start of the badly spelled word.
+     else if (spell_move_to(curwin, FORWARD, TRUE, TRUE, NULL) == 0
+diff -up vim82/src/testdir/test_spell.vim.cve0943 vim82/src/testdir/test_spell.vim
+--- vim82/src/testdir/test_spell.vim.cve0943	2022-03-28 20:48:07.102197509 +0200
++++ vim82/src/testdir/test_spell.vim	2022-03-28 20:49:05.038452974 +0200
+@@ -441,6 +441,21 @@ func Test_spellsuggest_expr_errors()
+   delfunc MySuggest3
+ endfunc
+ 
++func Test_spellsuggest_visual_end_of_line()
++  let enc_save = &encoding
++  set encoding=iso8859
++
++  " This was reading beyond the end of the line.
++  norm R00000000000
++  sil norm 0
++  sil! norm i00000)
++  sil! norm i00000)
++  call feedkeys("\<CR>")
++  norm z=
++
++  let &encoding = enc_save
++endfunc
++
+ func Test_spellinfo()
+   new
+   let runtime = substitute($VIMRUNTIME, '\\', '/', 'g')

SOURCES/0001-patch-8.2.4646-using-buffer-line-after-it-has-been-f.patch

@@ -0,0 +1,44 @@
+diff -up vim82/src/regexp_bt.c.cve1154 vim82/src/regexp_bt.c
+--- vim82/src/regexp_bt.c.cve1154	2022-04-25 15:22:28.367621755 +0200
++++ vim82/src/regexp_bt.c	2022-04-25 15:25:13.726340728 +0200
+@@ -3188,8 +3188,17 @@ regmatch(
+ 		int	mark = OPERAND(scan)[0];
+ 		int	cmp = OPERAND(scan)[1];
+ 		pos_T	*pos;
++		size_t	col = REG_MULTI ? rex.input - rex.line : 0;
+ 
+ 		pos = getmark_buf(rex.reg_buf, mark, FALSE);
++
++		// Line may have been freed, get it again.
++		if (REG_MULTI)
++		{
++		    rex.line = reg_getline(rex.lnum);
++		    rex.input = rex.line + col;
++		}
++
+ 		if (pos == NULL		     // mark doesn't exist
+ 			|| pos->lnum <= 0    // mark isn't set in reg_buf
+ 			|| (pos->lnum == rex.lnum + rex.reg_firstlnum
+diff -up vim82/src/testdir/test_regexp_latin.vim.cve1154 vim82/src/testdir/test_regexp_latin.vim
+--- vim82/src/testdir/test_regexp_latin.vim.cve1154	2022-04-25 15:22:28.368621752 +0200
++++ vim82/src/testdir/test_regexp_latin.vim	2022-04-25 15:26:57.515227712 +0200
+@@ -954,4 +954,19 @@ func Test_using_visual_position()
+   bwipe!
+ endfunc
+ 
++func Test_using_mark_position()
++  " this was using freed memory
++  " new engine
++  new
++  norm O0
++  call assert_fails("s/\\%')", 'E486:')
++  bwipe!
++
++  " old engine
++  new
++  norm O0
++  call assert_fails("s/\\%#=1\\%')", 'E486:')
++  bwipe!
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab

SOURCES/0001-patch-8.2.4774-crash-when-using-a-number-for-lambda-.patch

@@ -0,0 +1,51 @@
+diff -up vim82/src/errors.h.cve1420 vim82/src/errors.h
+--- vim82/src/errors.h.cve1420	2022-04-25 16:01:03.559985019 +0200
++++ vim82/src/errors.h	2022-04-25 16:01:58.113332024 +0200
+@@ -383,3 +383,7 @@ EXTERN char e_cannot_use_default_values_
+ 	INIT(= N_("E1172: Cannot use default values in a lambda"));
+ EXTERN char e_resulting_text_too_long[]
+ 	INIT(= N_("E1240: Resulting text too long"));
++#ifdef FEAT_EVAL
++EXTERN char e_string_or_function_required_for_arrow_parens_expr[]
++	INIT(= N_("E1275: String or function required for ->(expr)"));
++#endif
+diff -up vim82/src/eval.c.cve1420 vim82/src/eval.c
+--- vim82/src/eval.c.cve1420	2022-04-25 16:01:03.560985007 +0200
++++ vim82/src/eval.c	2022-04-25 16:14:11.746600369 +0200
+@@ -3718,13 +3718,20 @@ eval_lambda(
+ 	if (**arg != ')')
+ 	{
+ 	    emsg(_(e_missing_close));
+-	    ret = FAIL;
++	    return FAIL;
++	}
++	if (rettv->v_type != VAR_STRING && rettv->v_type != VAR_FUNC
++					       && rettv->v_type != VAR_PARTIAL)
++	{
++	    emsg(_(e_string_or_function_required_for_arrow_parens_expr));
++	    return FAIL;
+ 	}
+ 	++*arg;
+     }
+     if (ret != OK)
+ 	return FAIL;
+-    else if (**arg != '(')
++
++    if (**arg != '(')
+     {
+ 	if (verbose)
+ 	{
+diff -up vim82/src/testdir/test_lambda.vim.cve1420 vim82/src/testdir/test_lambda.vim
+--- vim82/src/testdir/test_lambda.vim.cve1420	2022-04-25 16:01:03.560985007 +0200
++++ vim82/src/testdir/test_lambda.vim	2022-04-25 16:17:01.694886566 +0200
+@@ -64,6 +64,10 @@ function Test_lambda_fails()
+   call assert_fails('echo {a, a -> a + a}(1, 2)', 'E853:')
+   call assert_fails('echo {a, b -> a + b)}(1, 2)', 'E451:')
+   echo assert_fails('echo 10->{a -> a + 2}', 'E107:')
++  call assert_fails('eval 0->(3)()', "E1275:")
++  call assert_fails('eval 0->([3])()', "E1275:")
++  call assert_fails('eval 0->({"a": 3})()', "E1275:")
++  call assert_fails('eval 0->(xxx)()', "E121:")
+ endfunc
+ 
+ func Test_not_lamda()

SOURCES/0001-patch-8.2.4919-can-add-invalid-bytes-with-spellgood.patch

@@ -0,0 +1,50 @@
+diff -up vim82/src/errors.h.cve1621 vim82/src/errors.h
+--- vim82/src/errors.h.cve1621	2022-05-24 13:36:23.883370040 +0200
++++ vim82/src/errors.h	2022-05-24 13:36:47.665487703 +0200
+@@ -387,3 +387,7 @@ EXTERN char e_resulting_text_too_long[]
+ EXTERN char e_string_or_function_required_for_arrow_parens_expr[]
+ 	INIT(= N_("E1275: String or function required for ->(expr)"));
+ #endif
++#ifdef FEAT_SPELL
++EXTERN char e_illegal_character_in_word[]
++	INIT(= N_("E1280: Illegal character in word"));
++#endif
+diff -up vim82/src/mbyte.c.cve1621 vim82/src/mbyte.c
+--- vim82/src/mbyte.c.cve1621	2021-03-22 10:02:42.000000000 +0100
++++ vim82/src/mbyte.c	2022-05-24 13:36:23.884370045 +0200
+@@ -4181,7 +4181,7 @@ theend:
+     convert_setup(&vimconv, NULL, NULL);
+ }
+ 
+-#if defined(FEAT_GUI_GTK) || defined(PROTO)
++#if defined(FEAT_GUI_GTK) || defined(FEAT_SPELL) || defined(PROTO)
+ /*
+  * Return TRUE if string "s" is a valid utf-8 string.
+  * When "end" is NULL stop at the first NUL.
+diff -up vim82/src/spellfile.c.cve1621 vim82/src/spellfile.c
+--- vim82/src/spellfile.c.cve1621	2021-03-22 10:02:42.000000000 +0100
++++ vim82/src/spellfile.c	2022-05-24 13:36:23.885370049 +0200
+@@ -4391,6 +4391,10 @@ store_word(
+     int		res = OK;
+     char_u	*p;
+ 
++    // Avoid adding illegal bytes to the word tree.
++    if (enc_utf8 && !utf_valid_string(word, NULL))
++	return FAIL;
++
+     (void)spell_casefold(word, len, foldword, MAXWLEN);
+     for (p = pfxlist; res == OK; ++p)
+     {
+@@ -6191,6 +6195,12 @@ spell_add_word(
+     int		i;
+     char_u	*spf;
+ 
++    if (enc_utf8 && !utf_valid_string(word, NULL))
++    {
++	emsg(_(e_illegal_character_in_word));
++	return;
++    }
++
+     if (idx == 0)	    // use internal wordlist
+     {
+ 	if (int_wordlist == NULL)

SOURCES/0001-patch-8.2.4925-trailing-backslash-may-cause-reading-.patch

@@ -0,0 +1,33 @@
+From 53a70289c2712808e6d4e88927e03cac01b470dd Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Mon, 9 May 2022 13:15:07 +0100
+Subject: [PATCH] patch 8.2.4925: trailing backslash may cause reading past end
+ of line
+
+Problem:    Trailing backslash may cause reading past end of line.
+Solution:   Check for NUL after backslash.
+---
+ src/testdir/test_textobjects.vim | 10 +++++++++-
+ src/textobject.c                 |  4 ++++
+ src/version.c                    |  2 ++
+ 3 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/src/textobject.c b/src/textobject.c
+index e4a7db38e..edaa64c51 100644
+--- a/src/textobject.c
++++ b/src/textobject.c
+@@ -1664,7 +1664,11 @@ find_next_quote(
+ 	if (c == NUL)
+ 	    return -1;
+ 	else if (escape != NULL && vim_strchr(escape, c))
++	{
+ 	    ++col;
++	    if (line[col] == NUL)
++		return -1;
++	}
+ 	else if (c == quotechar)
+ 	    break;
+ 	if (has_mbyte)
+-- 
+2.36.1
+

SOURCES/0001-patch-8.2.4977-memory-access-error-when-substitute-e.patch

@@ -0,0 +1,59 @@
+diff -up vim82/src/ex_cmds.c.cve1785 vim82/src/ex_cmds.c
+--- vim82/src/ex_cmds.c.cve1785	2022-06-10 10:26:16.883312704 +0200
++++ vim82/src/ex_cmds.c	2022-06-10 10:26:16.910312568 +0200
+@@ -4356,12 +4356,17 @@ ex_substitute(exarg_T *eap)
+ 		// Save flags for recursion.  They can change for e.g.
+ 		// :s/^/\=execute("s#^##gn")
+ 		subflags_save = subflags;
++
++		// Disallow changing text or switching window in an expression.
++		++textwinlock;
+ #endif
+ 		// get length of substitution part
+ 		sublen = vim_regsub_multi(&regmatch,
+ 				    sub_firstlnum - regmatch.startpos[0].lnum,
+ 			       sub, sub_firstline, FALSE, magic_isset(), TRUE);
+ #ifdef FEAT_EVAL
++		--textwinlock;
++
+ 		// If getting the substitute string caused an error, don't do
+ 		// the replacement.
+ 		// Don't keep flags set by a recursive call.
+@@ -4462,9 +4467,15 @@ ex_substitute(exarg_T *eap)
+ 		mch_memmove(new_end, sub_firstline + copycol, (size_t)copy_len);
+ 		new_end += copy_len;
+ 
++#ifdef FEAT_EVAL
++		++textwinlock;
++#endif
+ 		(void)vim_regsub_multi(&regmatch,
+ 				    sub_firstlnum - regmatch.startpos[0].lnum,
+ 				      sub, new_end, TRUE, magic_isset(), TRUE);
++#ifdef FEAT_EVAL
++		--textwinlock;
++#endif
+ 		sub_nsubs++;
+ 		did_sub = TRUE;
+ 
+diff -up vim82/src/testdir/test_substitute.vim.cve1785 vim82/src/testdir/test_substitute.vim
+--- vim82/src/testdir/test_substitute.vim.cve1785	2022-06-10 10:26:16.910312568 +0200
++++ vim82/src/testdir/test_substitute.vim	2022-06-10 10:27:02.166084629 +0200
+@@ -942,5 +942,18 @@ func Test_using_old_sub()
+   set nocompatible
+ endfunc
+ 
++" This was switching windows in between computing the length and using it.
++func Test_sub_change_window()
++  silent! lfile
++  sil! norm o0000000000000000000000000000000000000000000000000000
++  func Repl()
++    lopen
++  endfunc
++  silent!  s/\%')/\=Repl()
++  bwipe!
++  bwipe!
++  delfunc Repl
++endfunc
++
+ 
+ " vim: shiftwidth=2 sts=2 expandtab

SOURCES/0001-patch-8.2.5023-substitute-overwrites-allocated-buffe.patch

@@ -0,0 +1,121 @@
+diff -up vim82/src/normal.c.cve1897 vim82/src/normal.c
+--- vim82/src/normal.c.cve1897	2022-06-13 09:31:42.880768567 +0200
++++ vim82/src/normal.c	2022-06-13 09:35:38.560084927 +0200
+@@ -479,6 +479,22 @@ find_command(int cmdchar)
+ }
+ 
+ /*
++ * If currently editing a cmdline or text is locked: beep and give an error
++ * message, return TRUE.
++ */
++    static int
++check_text_locked(oparg_T *oap)
++{
++    if (text_locked())
++    {
++	clearopbeep(oap);
++	text_locked_msg();
++	return TRUE;
++    }
++    return FALSE;
++}
++
++/*
+  * Execute a command in Normal mode.
+  */
+     void
+@@ -742,14 +758,9 @@ getcount:
+ 	goto normal_end;
+     }
+ 
+-    if (text_locked() && (nv_cmds[idx].cmd_flags & NV_NCW))
+-    {
+-	// This command is not allowed while editing a cmdline: beep.
+-	clearopbeep(oap);
+-	text_locked_msg();
+-	goto normal_end;
+-    }
+-    if ((nv_cmds[idx].cmd_flags & NV_NCW) && curbuf_locked())
++    if ((nv_cmds[idx].cmd_flags & NV_NCW)
++				&& (check_text_locked(oap) || curbuf_locked()))
++	// this command is not allowed now
+ 	goto normal_end;
+ 
+     /*
+@@ -4212,12 +4223,8 @@ nv_gotofile(cmdarg_T *cap)
+     char_u	*ptr;
+     linenr_T	lnum = -1;
+ 
+-    if (text_locked())
+-    {
+-	clearopbeep(cap->oap);
+-	text_locked_msg();
++    if (check_text_locked(cap->oap))
+ 	return;
+-    }
+     if (curbuf_locked())
+     {
+ 	clearop(cap->oap);
+@@ -6343,14 +6350,7 @@ nv_g_cmd(cmdarg_T *cap)
+ 
+     // "gQ": improved Ex mode
+     case 'Q':
+-	if (text_locked())
+-	{
+-	    clearopbeep(cap->oap);
+-	    text_locked_msg();
+-	    break;
+-	}
+-
+-	if (!checkclearopq(oap))
++	if (!check_text_locked(cap->oap) && !checkclearopq(oap))
+ 	    do_exmode(TRUE);
+ 	break;
+ 
+diff -up vim82/src/testdir/test_substitute.vim.cve1897 vim82/src/testdir/test_substitute.vim
+--- vim82/src/testdir/test_substitute.vim.cve1897	2022-06-13 09:31:42.938768884 +0200
++++ vim82/src/testdir/test_substitute.vim	2022-06-13 09:36:39.013406036 +0200
+@@ -955,5 +955,27 @@ func Test_sub_change_window()
+   delfunc Repl
+ endfunc
+ 
++" This was undoign a change in between computing the length and using it.
++func Do_Test_sub_undo_change()
++  new
++  norm o0000000000000000000000000000000000000000000000000000
++  silent! s/\%')/\=Repl()
++  bwipe!
++endfunc
++
++func Test_sub_undo_change()
++  func Repl()
++    silent! norm g-
++  endfunc
++  call Do_Test_sub_undo_change()
++
++  func! Repl()
++    silent earlier
++  endfunc
++  call Do_Test_sub_undo_change()
++
++  delfunc Repl
++endfunc
++
+ 
+ " vim: shiftwidth=2 sts=2 expandtab
+diff -up vim82/src/undo.c.cve1897 vim82/src/undo.c
+--- vim82/src/undo.c.cve1897	2022-06-13 09:31:42.904768698 +0200
++++ vim82/src/undo.c	2022-06-13 09:31:42.938768884 +0200
+@@ -2323,6 +2323,12 @@ undo_time(
+     int		    above = FALSE;
+     int		    did_undo = TRUE;
+ 
++    if (text_locked())
++    {
++	text_locked_msg();
++	return;
++    }
++
+     // First make sure the current undoable change is synced.
+     if (curbuf->b_u_synced == FALSE)
+ 	u_sync(TRUE);

SOURCES/0001-patch-8.2.5037-cursor-position-may-be-invalid-after-.patch

@@ -0,0 +1,106 @@
+diff -up vim82/src/ex_docmd.c.cve1927 vim82/src/ex_docmd.c
+--- vim82/src/ex_docmd.c.cve1927	2021-03-22 10:02:42.000000000 +0100
++++ vim82/src/ex_docmd.c	2022-06-13 15:29:45.099472751 +0200
+@@ -3081,6 +3081,8 @@ parse_cmd_address(exarg_T *eap, char **e
+ {
+     int		address_count = 1;
+     linenr_T	lnum;
++    int		need_check_cursor = FALSE;
++    int		ret = FAIL;
+ 
+     // Repeat for all ',' or ';' separated addresses.
+     for (;;)
+@@ -3091,7 +3093,7 @@ parse_cmd_address(exarg_T *eap, char **e
+ 	lnum = get_address(eap, &eap->cmd, eap->addr_type, eap->skip, silent,
+ 					eap->addr_count == 0, address_count++);
+ 	if (eap->cmd == NULL)	// error detected
+-	    return FAIL;
++	    goto theend;
+ 	if (lnum == MAXLNUM)
+ 	{
+ 	    if (*eap->cmd == '%')   // '%' - all lines
+@@ -3136,14 +3138,14 @@ parse_cmd_address(exarg_T *eap, char **e
+ 			    // there is no Vim command which uses '%' and
+ 			    // ADDR_WINDOWS or ADDR_TABS
+ 			    *errormsg = _(e_invrange);
+-			    return FAIL;
++			    goto theend;
+ 			}
+ 			break;
+ 		    case ADDR_TABS_RELATIVE:
+ 		    case ADDR_UNSIGNED:
+ 		    case ADDR_QUICKFIX:
+ 			*errormsg = _(e_invrange);
+-			return FAIL;
++			goto theend;
+ 		    case ADDR_ARGUMENTS:
+ 			if (ARGCOUNT == 0)
+ 			    eap->line1 = eap->line2 = 0;
+@@ -3175,7 +3177,7 @@ parse_cmd_address(exarg_T *eap, char **e
+ 		if (eap->addr_type != ADDR_LINES)
+ 		{
+ 		    *errormsg = _(e_invrange);
+-		    return FAIL;
++		    goto theend;
+ 		}
+ 
+ 		++eap->cmd;
+@@ -3183,11 +3185,11 @@ parse_cmd_address(exarg_T *eap, char **e
+ 		{
+ 		    fp = getmark('<', FALSE);
+ 		    if (check_mark(fp) == FAIL)
+-			return FAIL;
++			goto theend;
+ 		    eap->line1 = fp->lnum;
+ 		    fp = getmark('>', FALSE);
+ 		    if (check_mark(fp) == FAIL)
+-			return FAIL;
++			goto theend;
+ 		    eap->line2 = fp->lnum;
+ 		    ++eap->addr_count;
+ 		}
+@@ -3202,10 +3204,13 @@ parse_cmd_address(exarg_T *eap, char **e
+ 	    if (!eap->skip)
+ 	    {
+ 		curwin->w_cursor.lnum = eap->line2;
++
+ 		// Don't leave the cursor on an illegal line or column, but do
+ 		// accept zero as address, so 0;/PATTERN/ works correctly.
++		// Check the cursor position before returning.
+ 		if (eap->line2 > 0)
+ 		    check_cursor();
++		need_check_cursor = TRUE;
+ 	    }
+ 	}
+ 	else if (*eap->cmd != ',')
+@@ -3221,7 +3226,12 @@ parse_cmd_address(exarg_T *eap, char **e
+ 	if (lnum == MAXLNUM)
+ 	    eap->addr_count = 0;
+     }
+-    return OK;
++    ret = OK;
++
++theend:
++    if (need_check_cursor)
++	check_cursor();
++    return ret;
+ }
+ 
+ /*
+diff -up vim82/src/testdir/test_excmd.vim.cve1927 vim82/src/testdir/test_excmd.vim
+--- vim82/src/testdir/test_excmd.vim.cve1927	2022-06-13 15:26:53.941517542 +0200
++++ vim82/src/testdir/test_excmd.vim	2022-06-13 15:30:53.972860361 +0200
+@@ -536,4 +536,13 @@ func Test_sandbox()
+   sandbox call Sandbox_tests()
+ endfunc
+ 
++" This was leaving the cursor in line zero
++func Test_using_zero_in_range()
++  new
++  norm o00
++  silent!  0;s/\%')
++  bwipe!
++endfunc
++
++
+ " vim: shiftwidth=2 sts=2 expandtab

SOURCES/vim-7.0-fixkeys.patch

@@ -1,26 +1,26 @@
 diff -up vim82/src/term.c.fixkeys vim82/src/term.c
---- vim82/src/term.c.fixkeys	2022-02-07 09:23:09.195365881 +0100
+--- vim82/src/term.c.fixkeys	2021-01-08 10:12:59.191309539 +0100
-+++ vim82/src/term.c	2022-02-07 09:31:31.279695977 +0100
++++ vim82/src/term.c	2021-01-08 10:18:05.410470981 +0100
-@@ -921,14 +921,14 @@ static struct builtin_term builtin_termc
+@@ -919,14 +919,14 @@ static struct builtin_term builtin_termc
-     {K_XRIGHT,		"\033[@;*C"},
+     {K_XRIGHT,		IF_EB("\033[@;*C", ESC_STR "[@;*C")},
-     {K_XLEFT,		"\033[@;*D"},
+     {K_XLEFT,		IF_EB("\033[@;*D", ESC_STR "[@;*D")},
      // An extra set of function keys for vt100 mode
--    {K_XF1,		"\033O*P"},
+-    {K_XF1,		IF_EB("\033O*P", ESC_STR "O*P")},
--    {K_XF2,		"\033O*Q"},
+-    {K_XF2,		IF_EB("\033O*Q", ESC_STR "O*Q")},
--    {K_XF3,		"\033O*R"},
+-    {K_XF3,		IF_EB("\033O*R", ESC_STR "O*R")},
--    {K_XF4,		"\033O*S"},
+-    {K_XF4,		IF_EB("\033O*S", ESC_STR "O*S")},
--    {K_F1,		"\033[11;*~"},
+-    {K_F1,		IF_EB("\033[11;*~", ESC_STR "[11;*~")},
--    {K_F2,		"\033[12;*~"},
+-    {K_F2,		IF_EB("\033[12;*~", ESC_STR "[12;*~")},
--    {K_F3,		"\033[13;*~"},
+-    {K_F3,		IF_EB("\033[13;*~", ESC_STR "[13;*~")},
--    {K_F4,		"\033[14;*~"},
+-    {K_F4,		IF_EB("\033[14;*~", ESC_STR "[14;*~")},
-+    {K_XF1,		"\033[11~"},
++    {K_XF1,             IF_EB("\033[11~", ESC_STR "[11~")},
-+    {K_XF2,		"\033[12~"},
++    {K_XF2,             IF_EB("\033[12~", ESC_STR "[12~")},
-+    {K_XF3,		"\033[13~"},
++    {K_XF3,             IF_EB("\033[13~", ESC_STR "[13~")},
-+    {K_XF4,		"\033[14~"},
++    {K_XF4,             IF_EB("\033[14~", ESC_STR "[14~")},
-+    {K_F1,		"\033OP"},
++    {K_F1,              IF_EB("\033OP", ESC_STR "OP")},
-+    {K_F2,		"\033OQ"},
++    {K_F2,              IF_EB("\033OQ", ESC_STR "OQ")},
-+    {K_F3,		"\033OR"},
++    {K_F3,              IF_EB("\033OR", ESC_STR "OR")},
-+    {K_F4,		"\033OS"},
++    {K_F4,              IF_EB("\033OS", ESC_STR "OS")},
-     {K_F5,		"\033[15;*~"},
+     {K_F5,		IF_EB("\033[15;*~", ESC_STR "[15;*~")},
-     {K_F6,		"\033[17;*~"},
+     {K_F6,		IF_EB("\033[17;*~", ESC_STR "[17;*~")},
-     {K_F7,		"\033[18;*~"},
+     {K_F7,		IF_EB("\033[18;*~", ESC_STR "[18;*~")},

SOURCES/vim-8.0-copy-paste.patch

@@ -1,8 +1,8 @@
 diff --git a/runtime/defaults.vim b/runtime/defaults.vim
-index f1d5cd1..b08de8e 100644
+index f3c639b..20637e2 100644
 --- a/runtime/defaults.vim
 +++ b/runtime/defaults.vim
-@@ -74,18 +74,6 @@ sunmap Q
+@@ -73,18 +73,6 @@ map Q gq
  " Revert with ":iunmap <C-U>".
  inoremap <C-U> <C-G>u<C-U>
  
@@ -22,7 +22,7 @@ index f1d5cd1..b08de8e 100644
  if 1
  
 diff --git a/src/testdir/test_balloon.vim b/src/testdir/test_balloon.vim
-index ed0c6c1..90c8c40 100644
+index 319e546..8fcf63c 100644
 --- a/src/testdir/test_balloon.vim
 +++ b/src/testdir/test_balloon.vim
 @@ -9,6 +9,7 @@ source screendump.vim
@@ -31,10 +31,10 @@ index ed0c6c1..90c8c40 100644
  let s:common_script =<< trim [CODE]
 +  set mouse=a
    call setline(1, ["one one one", "two tXo two", "three three three"])
-   set balloonevalterm balloonexpr=MyBalloonExpr()..s:trailing balloondelay=100
+   set balloonevalterm balloonexpr=MyBalloonExpr() balloondelay=100
-   let s:trailing = '<'  " check that script context is set
+   func MyBalloonExpr()
 diff --git a/src/testdir/test_popupwin.vim b/src/testdir/test_popupwin.vim
-index b91689e..c6b70d1 100644
+index f13252b..ec755a4 100644
 --- a/src/testdir/test_popupwin.vim
 +++ b/src/testdir/test_popupwin.vim
 @@ -553,6 +553,7 @@ func Test_popup_drag()
@@ -45,23 +45,15 @@ index b91689e..c6b70d1 100644
  	split
  	vsplit
  	$wincmd w
-@@ -621,6 +622,7 @@ func Test_popup_drag_minwidth()
+@@ -599,6 +600,7 @@ func Test_popup_drag_termwin()
- 
-   " create a popup that does not fit
-   let lines =<< trim END
-+      set mouse=a
-       call range(40)
- 	      \ ->map({_,i -> string(i)})
- 	      \ ->popup_create({
-@@ -669,6 +671,7 @@ func Test_popup_drag_termwin()
    let lines =<< trim END
  	set foldmethod=marker
  	call setline(1, range(100))
-+	set mouse=a
++  set mouse=a
  	for nr in range(7)
  	  call setline(nr * 12 + 1, "fold {{{")
  	  call setline(nr * 12 + 11, "end }}}")
-@@ -722,6 +725,7 @@ func Test_popup_close_with_mouse()
+@@ -652,6 +654,7 @@ func Test_popup_close_with_mouse()
  
    let lines =<< trim END
  	call setline(1, range(1, 20))
@@ -69,7 +61,7 @@ index b91689e..c6b70d1 100644
  	" With border, can click on X
  	let winid = popup_create('foobar', #{
  	      \ close: 'button',
-@@ -1557,6 +1561,7 @@ func Test_popup_beval()
+@@ -1479,6 +1482,7 @@ func Test_popup_beval()
    let lines =<< trim END
  	call setline(1, range(1, 20))
  	call setline(5, 'here is some text to hover over')
@@ -77,7 +69,7 @@ index b91689e..c6b70d1 100644
  	set balloonevalterm
  	set balloonexpr=BalloonExpr()
  	set balloondelay=100
-@@ -2262,6 +2267,7 @@ func Test_popup_scrollbar()
+@@ -2170,6 +2174,7 @@ func Test_popup_scrollbar()
  
    let lines =<< trim END
      call setline(1, range(1, 20))

SOURCES/vim-crypto-warning.patch

@@ -1,10 +1,11 @@
 diff -up vim82/src/config.h.in.fips-warning vim82/src/config.h.in
---- vim82/src/config.h.in.fips-warning	2022-02-24 08:13:59.017280243 +0100
+--- vim82/src/config.h.in.fips-warning	2021-03-01 12:20:20.887162181 +0100
-+++ vim82/src/config.h.in	2022-02-24 08:14:33.085580298 +0100
++++ vim82/src/config.h.in	2021-03-01 12:20:42.520977438 +0100
-@@ -508,5 +508,14 @@
+@@ -499,3 +499,12 @@
+ 
  /* Define if _SC_SIGSTKSZ is available via sysconf() */
  #undef HAVE_SYSCONF_SIGSTKSZ
- 
++
 +/* Do we need FIPS warning? */
 +#undef HAVE_FIPS_WARNING
 +
@@ -13,14 +14,11 @@ diff -up vim82/src/config.h.in.fips-warning vim82/src/config.h.in
 +
 +/* Link to fips_enabled file */
 +#undef FIPS_ENABLED_FILE_LINK
-+
- /* Define if you want to load libgpm dynamically */
- #undef DYNAMIC_GPM
 diff -up vim82/src/configure.ac.fips-warning vim82/src/configure.ac
---- vim82/src/configure.ac.fips-warning	2022-02-24 08:13:59.014280304 +0100
+--- vim82/src/configure.ac.fips-warning	2021-03-01 12:20:20.885162198 +0100
-+++ vim82/src/configure.ac	2022-02-24 08:13:59.018280222 +0100
++++ vim82/src/configure.ac	2021-03-01 12:20:20.888162173 +0100
-@@ -583,6 +583,38 @@ else
+@@ -541,6 +541,38 @@ else
-   AC_SUBST(XDIFF_OBJS_USED)
+   AC_MSG_RESULT(yes)
  fi
  
 +dnl Checking if we want FIPS warning
@@ -59,9 +57,9 @@ diff -up vim82/src/configure.ac.fips-warning vim82/src/configure.ac
  AC_MSG_CHECKING(--enable-luainterp argument)
  AC_ARG_ENABLE(luainterp,
 diff -up vim82/src/crypt.c.fips-warning vim82/src/crypt.c
---- vim82/src/crypt.c.fips-warning	2022-02-24 08:09:29.000000000 +0100
+--- vim82/src/crypt.c.fips-warning	2021-03-01 12:13:11.000000000 +0100
-+++ vim82/src/crypt.c	2022-02-24 08:13:59.018280222 +0100
++++ vim82/src/crypt.c	2021-03-01 12:20:20.888162173 +0100
-@@ -740,6 +740,21 @@ crypt_check_method(int method)
+@@ -523,6 +523,21 @@ crypt_check_method(int method)
  	msg_scroll = TRUE;
  	msg(_("Warning: Using a weak encryption method; see :help 'cm'"));
      }
@@ -82,4 +80,4 @@ diff -up vim82/src/crypt.c.fips-warning vim82/src/crypt.c
 +#endif
  }
  
- #ifdef FEAT_SODIUM
+     void

SOURCES/virc

@@ -27,6 +27,7 @@ if has("autocmd")
   augroup END
 endif
 
+
 if &term=="xterm"
      set t_Co=8
      set t_Sb=[4%dm