Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2022-0629: Stack-based Buffer Overflow (CWE-121)
value: Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
CWE description: A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CVSS v3 base score: 7.8
Published: 2022-02-17T12:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/testdir/test_assert.vim, src/testing.c, src/version.c
Commit date: 2022-02-16 12:16:19 +0000
Commit message: patch 8.2.4397: crash when using many composing characters in error message

Problem:    Crash when using many composing characters in error message.
Solution:   Use mb_cptr2char_adv() instead of mb_ptr2char_adv().

Diff: diff --git a/src/testdir/test_assert.vim b/src/testdir/test_assert.vim
index 8987f3f8dfc..27b2d73fbfc 100644
--- a/src/testdir/test_assert.vim
+++ b/src/testdir/test_assert.vim
@@ -51,10 +51,18 @@ func Test_assert_equal()
 
   " special characters are escaped
   call assert_equal("\b\e\f\n\t\r\\\x01\x7f", 'x')
   call assert_match('Expected ''\\b\\e\\f\\n\\t\\r\\\\\\x01\\x7f'' but got ''x''', v:errors[0])
   call remove(v:errors, 0)
+
+  " many composing characters are handled properly
+  call setline(1, ' ')
+  norm 100gr݀
+  call assert_equal(1, getline(1))
+  call assert_match("Expected 1 but got '.* occurs 100 times]'", v:errors[0])
+  call remove(v:errors, 0)
+  bwipe!
 endfunc
 
 func Test_assert_equal_dict()
   call assert_equal(0, assert_equal(#{one: 1, two: 2}, #{two: 2, one: 1}))
 
diff --git a/src/testing.c b/src/testing.c
index 448c01c1e96..48ba14d2caf 100644
--- a/src/testing.c
+++ b/src/testing.c
@@ -99,11 +99,11 @@ ga_concat_shorten_esc(garray_T *gap, char_u *str)
 
     for (p = str; *p != NUL; ++p)
     {
 	same_len = 1;
 	s = p;
-	c = mb_ptr2char_adv(&s);
+	c = mb_cptr2char_adv(&s);
 	clen = s - p;
 	while (*s != NUL && c == mb_ptr2char(s))
 	{
 	    ++same_len;
 	    s += clen;
diff --git a/src/version.c b/src/version.c
index fb1b8476e1a..b4983661cad 100644
--- a/src/version.c
+++ b/src/version.c
@@ -748,10 +748,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4397,
 /**/
     4396,
 /**/
     4395,
 /**/

Vulnerable code: 	c = mb_ptr2char_adv(&s);
Fixed code: 
  " many composing characters are handled properly
  call setline(1, ' ')
  norm 100gr݀
  call assert_equal(1, getline(1))
  call assert_match("Expected 1 but got '.* occurs 100 times]'", v:errors[0])
  call remove(v:errors, 0)
  bwipe!
	c = mb_cptr2char_adv(&s);
/**/
    4397,
CVE-2022-0714: Heap-based Buffer Overflow (CWE-122)
value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 5.5
Published: 2022-02-22T20:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/indent.c, src/testdir/test_vartabs.vim, src/version.c
Commit date: 2022-02-21 19:36:12 +0000
Commit message: patch 8.2.4436: crash with weird 'vartabstop' value

Problem:    Crash with weird 'vartabstop' value.
Solution:   Check for running into the end of the line.

Diff: diff --git a/src/indent.c b/src/indent.c
index 95fc74ee46ab..95bda20725ed 100644
--- a/src/indent.c
+++ b/src/indent.c
@@ -1336,10 +1336,12 @@ change_indent(
 	    last_vcol = vcol;
 	    if (has_mbyte && new_cursor_col >= 0)
 		new_cursor_col += (*mb_ptr2len)(ptr + new_cursor_col);
 	    else
 		++new_cursor_col;
+	    if (ptr[new_cursor_col] == NUL)
+		break;
 	    vcol += lbr_chartabsize(ptr, ptr + new_cursor_col, (colnr_T)vcol);
 	}
 	vcol = last_vcol;
 
 	// May need to insert spaces to be able to position the cursor on
diff --git a/src/testdir/test_vartabs.vim b/src/testdir/test_vartabs.vim
index 156233dca70d..d21acfe3a76c 100644
--- a/src/testdir/test_vartabs.vim
+++ b/src/testdir/test_vartabs.vim
@@ -440,6 +440,18 @@ func Test_shiftwidth_vartabstop()
   call assert_fails('set shiftwidth=-1', 'E487:')
   call assert_equal(5, &shiftwidth)
   setlocal shiftwidth& vartabstop& tabstop&
 endfunc
 
+func Test_vartabstop_latin1()
+  let save_encoding = &encoding
+  new
+  set encoding=iso8859
+  silent norm :se 
+  set vartabstop=400
+  norm i00	
+  bwipe!
+  let &encoding = save_encoding
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 9e21411946d1..6eae5e66fdf6 100644
--- a/src/version.c
+++ b/src/version.c
@@ -748,10 +748,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4436,
 /**/
     4435,
 /**/
     4434,
 /**/

Fixed code: 	    if (ptr[new_cursor_col] == NUL)
		break;
func Test_vartabstop_latin1()
  let save_encoding = &encoding
  new
  set encoding=iso8859
  silent norm :se 
  set vartabstop=400
  norm i00	
  bwipe!
  let &encoding = save_encoding
endfunc


/**/
    4436,
CVE-2022-0943: Heap-based Buffer Overflow (CWE-122)
value: Heap-based Buffer Overflow occurs in vim in GitHub repository vim/vim prior to 8.2.4563.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 7.8
Published: 2022-03-14T21:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/spellsuggest.c, src/testdir/test_spell.vim, src/version.c
Commit date: 2022-03-13 20:12:25 +0000
Commit message: patch 8.2.4563: "z=" in Visual mode may go beyond the end of the line

Problem:    "z=" in Visual mode may go beyond the end of the line.
Solution:   Adjust "badlen".

Diff: diff --git a/src/spellsuggest.c b/src/spellsuggest.c
index ba3aaf349d47..3be917f868a0 100644
--- a/src/spellsuggest.c
+++ b/src/spellsuggest.c
@@ -504,10 +504,14 @@ spell_suggest(int count)
 	    badlen = -badlen;
 	else
 	    curwin->w_cursor.col = VIsual.col;
 	++badlen;
 	end_visual_mode();
+	// make sure we don't include the NUL at the end of the line
+	line = ml_get_curline();
+	if (badlen > STRLEN(line) - curwin->w_cursor.col)
+	    badlen = STRLEN(line) - curwin->w_cursor.col;
     }
     // Find the start of the badly spelled word.
     else if (spell_move_to(curwin, FORWARD, TRUE, TRUE, NULL) == 0
 	    || curwin->w_cursor.col > prev_cursor.col)
     {
diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
index e6f535be1460..804c5dede78e 100644
--- a/src/testdir/test_spell.vim
+++ b/src/testdir/test_spell.vim
@@ -454,10 +454,25 @@ func Test_spellsuggest_timeout()
   call assert_fails('set spellsuggest=timeout:x', 'E474:')
   call assert_fails('set spellsuggest=timeout:-x', 'E474:')
   call assert_fails('set spellsuggest=timeout:--9', 'E474:')
 endfunc
 
+func Test_spellsuggest_visual_end_of_line()
+  let enc_save = &encoding
+  set encoding=iso8859
+
+  " This was reading beyond the end of the line.
+  norm R00000000000
+  sil norm 0
+  sil! norm i00000)
+  sil! norm i00000)
+  call feedkeys("\<CR>")
+  norm z=
+
+  let &encoding = enc_save
+endfunc
+
 func Test_spellinfo()
   new
   let runtime = substitute($VIMRUNTIME, '\\', '/', 'g')
 
   set enc=latin1 spell spelllang=en
diff --git a/src/version.c b/src/version.c
index 7ac37a41f496..e5ff441653d8 100644
--- a/src/version.c
+++ b/src/version.c
@@ -748,10 +748,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4563,
 /**/
     4562,
 /**/
     4561,
 /**/

Fixed code: 	// make sure we don't include the NUL at the end of the line
	line = ml_get_curline();
	if (badlen > STRLEN(line) - curwin->w_cursor.col)
	    badlen = STRLEN(line) - curwin->w_cursor.col;
func Test_spellsuggest_visual_end_of_line()
  let enc_save = &encoding
  set encoding=iso8859

  " This was reading beyond the end of the line.
  norm R00000000000
  sil norm 0
  sil! norm i00000)
  sil! norm i00000)
  call feedkeys("\<CR>")
  norm z=

  let &encoding = enc_save
endfunc

/**/
    4563,
CVE-2022-1154: Use After Free (CWE-416)
value: Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.8
Published: 2022-03-30T12:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/regexp_bt.c, src/testdir/test_regexp_latin.vim, src/version.c
Commit date: 2022-03-29 13:24:58 +0100
Commit message: patch 8.2.4646: using buffer line after it has been freed

Problem:    Using buffer line after it has been freed in old regexp engine.
Solution:   After getting mark get the line again.

Diff: diff --git a/src/regexp_bt.c b/src/regexp_bt.c
index 4082f59d35cc..793faaf6bc0f 100644
--- a/src/regexp_bt.c
+++ b/src/regexp_bt.c
@@ -3358,12 +3358,21 @@ regmatch(
 	    // Compare the mark position to the match position.
 	    {
 		int	mark = OPERAND(scan)[0];
 		int	cmp = OPERAND(scan)[1];
 		pos_T	*pos;
+		size_t	col = REG_MULTI ? rex.input - rex.line : 0;
 
 		pos = getmark_buf(rex.reg_buf, mark, FALSE);
+
+		// Line may have been freed, get it again.
+		if (REG_MULTI)
+		{
+		    rex.line = reg_getline(rex.lnum);
+		    rex.input = rex.line + col;
+		}
+
 		if (pos == NULL		     // mark doesn't exist
 			|| pos->lnum <= 0)   // mark isn't set in reg_buf
 		{
 		    status = RA_NOMATCH;
 		}
diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim
index 71915be9eda8..fc9c81bfeea7 100644
--- a/src/testdir/test_regexp_latin.vim
+++ b/src/testdir/test_regexp_latin.vim
@@ -1040,14 +1040,21 @@ func Test_matching_pos()
   set re&
 endfunc
 
 func Test_using_mark_position()
   " this was using freed memory
+  " new engine
   new
   norm O0
   call assert_fails("s/\\%')", 'E486:')
   bwipe!
+
+  " old engine
+  new
+  norm O0
+  call assert_fails("s/\\%#=1\\%')", 'E486:')
+  bwipe!
 endfunc
 
 func Test_using_visual_position()
   " this was using freed memory
   new
diff --git a/src/version.c b/src/version.c
index 03778bd5caa2..14fd1c369c95 100644
--- a/src/version.c
+++ b/src/version.c
@@ -748,10 +748,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4646,
 /**/
     4645,
 /**/
     4644,
 /**/

Fixed code: 		size_t	col = REG_MULTI ? rex.input - rex.line : 0;

		// Line may have been freed, get it again.
		if (REG_MULTI)
		{
		    rex.line = reg_getline(rex.lnum);
		    rex.input = rex.line + col;
		}

  " new engine

  " old engine
  new
  norm O0
  call assert_fails("s/\\%#=1\\%')", 'E486:')
  bwipe!
/**/
    4646,
CVE-2022-1160: Heap-based Buffer Overflow (CWE-122)
value: heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 7.8
Published: 2022-03-30T19:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/scriptfile.c, src/testdir/test_source.vim, src/version.c
Commit date: 2022-03-29 19:52:12 +0100
Commit message: patch 8.2.4647: "source" can read past end of copied line

Problem:    "source" can read past end of copied line.
Solution:   Add a terminating NUL.

Diff: diff --git a/src/scriptfile.c b/src/scriptfile.c
index a334b2f9fc53..39936a42650a 100644
--- a/src/scriptfile.c
+++ b/src/scriptfile.c
@@ -1916,11 +1916,14 @@ get_one_sourceline(source_cookie_T *sp)
 	{
 	    if (sp->buf_lnum >= sp->buflines.ga_len)
 		break;		    // all the lines are processed
 	    ga_concat(&ga, ((char_u **)sp->buflines.ga_data)[sp->buf_lnum]);
 	    sp->buf_lnum++;
+	    if (ga_grow(&ga, 1) == FAIL)
+		break;
 	    buf = (char_u *)ga.ga_data;
+	    buf[ga.ga_len++] = NUL;
 	}
 	else
 	{
 	    buf = (char_u *)ga.ga_data;
 	    if (fgets((char *)buf + ga.ga_len, ga.ga_maxlen - ga.ga_len,
diff --git a/src/testdir/test_source.vim b/src/testdir/test_source.vim
index 35d14537476d..5f45ab413c8d 100644
--- a/src/testdir/test_source.vim
+++ b/src/testdir/test_source.vim
@@ -644,6 +644,15 @@ func Test_source_buffer_vim9()
   call assert_fails('vim9cmd source ++abcde', 'E484:')
 
   %bw!
 endfunc
 
+func Test_source_buffer_long_line()
+  " This was reading past the end of the line.
+  new
+  norm300gr0
+  so
+  bwipe!
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 14fd1c369c95..b18de4c5e502 100644
--- a/src/version.c
+++ b/src/version.c
@@ -748,10 +748,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4647,
 /**/
     4646,
 /**/
     4645,
 /**/

Fixed code: 	    if (ga_grow(&ga, 1) == FAIL)
		break;
	    buf[ga.ga_len++] = NUL;
func Test_source_buffer_long_line()
  " This was reading past the end of the line.
  new
  norm300gr0
  so
  bwipe!
endfunc


/**/
    4647,
CVE-2022-1619: Heap-based Buffer Overflow (CWE-122)
value: Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing software, modify memory, and possible remote execution
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 7.8
Published: 2022-05-08T10:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/ex_getln.c, src/testdir/test_cmdline.vim, src/version.c
Commit date: 2022-05-07 10:49:10 +0100
Commit message: patch 8.2.4899: with latin1 encoding CTRL-W might go before the cmdline

Problem:    With latin1 encoding CTRL-W might go before the start of the
            command line.
Solution:   Check already being at the start of the command line.

Diff: diff --git a/src/ex_getln.c b/src/ex_getln.c
index a97024b35171..7020f5143a01 100644
--- a/src/ex_getln.c
+++ b/src/ex_getln.c
@@ -1080,14 +1080,17 @@ cmdline_erase_chars(
 	}
 	else if (c == Ctrl_W)
 	{
 	    while (p > ccline.cmdbuff && vim_isspace(p[-1]))
 		--p;
-	    i = vim_iswordc(p[-1]);
-	    while (p > ccline.cmdbuff && !vim_isspace(p[-1])
-		    && vim_iswordc(p[-1]) == i)
-		--p;
+	    if (p > ccline.cmdbuff)
+	    {
+		i = vim_iswordc(p[-1]);
+		while (p > ccline.cmdbuff && !vim_isspace(p[-1])
+			&& vim_iswordc(p[-1]) == i)
+		    --p;
+	    }
 	}
 	else
 	    --p;
 	ccline.cmdpos = (int)(p - ccline.cmdbuff);
 	ccline.cmdlen -= j - ccline.cmdpos;
diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
index 474638fb00d6..5a849f77f755 100644
--- a/src/testdir/test_cmdline.vim
+++ b/src/testdir/test_cmdline.vim
@@ -771,10 +771,13 @@ func Test_cmdline_remove_char()
     call feedkeys(":abc def ghi\<S-Left>\<C-W>\<C-B>\"\<CR>", 'tx')
     call assert_equal('"abc ghi', @:, e)
 
     call feedkeys(":abc def\<S-Left>\<C-U>\<C-B>\"\<CR>", 'tx')
     call assert_equal('"def', @:, e)
+
+    " This was going before the start in latin1.
+    call feedkeys(": \<C-W>\<CR>", 'tx')
   endfor
 
   let &encoding = encoding_save
 endfunc
 
diff --git a/src/version.c b/src/version.c
index 201d26f06eb9..05888c722e8e 100644
--- a/src/version.c
+++ b/src/version.c
@@ -744,10 +744,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4899,
 /**/
     4898,
 /**/
     4897,
 /**/

Vulnerable code: 	    i = vim_iswordc(p[-1]);
	    while (p > ccline.cmdbuff && !vim_isspace(p[-1])
		    && vim_iswordc(p[-1]) == i)
		--p;
Fixed code: 	    if (p > ccline.cmdbuff)
	    {
		i = vim_iswordc(p[-1]);
		while (p > ccline.cmdbuff && !vim_isspace(p[-1])
			&& vim_iswordc(p[-1]) == i)
		    --p;
	    }

    " This was going before the start in latin1.
    call feedkeys(": \<C-W>\<CR>", 'tx')
/**/
    4899,
CVE-2022-1620: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash) via a crafted input.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2022-05-08T11:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/buffer.c, src/testdir/test_buffer.vim, src/version.c
Commit date: 2022-05-07 11:28:06 +0100
Commit message: patch 8.2.4901: NULL pointer access when using invalid pattern

Problem:    NULL pointer access when using invalid pattern.
Solution:   Check for failed regexp program.

Diff: diff --git a/src/buffer.c b/src/buffer.c
index 461950307c4d..da0555e86f6d 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -2955,11 +2955,11 @@ fname_match(
     {
 	// Ignore case when 'fileignorecase' or the argument is set.
 	rmp->rm_ic = p_fic || ignore_case;
 	if (vim_regexec(rmp, name, (colnr_T)0))
 	    match = name;
-	else
+	else if (rmp->regprog != NULL)
 	{
 	    // Replace $(HOME) with '~' and try matching again.
 	    p = home_replace_save(NULL, name);
 	    if (p != NULL && vim_regexec(rmp, p, (colnr_T)0))
 		match = name;
diff --git a/src/testdir/test_buffer.vim b/src/testdir/test_buffer.vim
index fc391dcceee6..aea399558707 100644
--- a/src/testdir/test_buffer.vim
+++ b/src/testdir/test_buffer.vim
@@ -408,10 +408,17 @@ func Test_buffer_scheme()
   endfor
 
   set shellslash&
 endfunc
 
+" this was using a NULL pointer after failing to use the pattern
+func Test_buf_pattern_invalid()
+  vsplit 0000000
+  silent! buf [0--]\&\zs*\zs*e
+  bwipe!
+endfunc
+
 " Test for the 'maxmem' and 'maxmemtot' options
 func Test_buffer_maxmem()
   " use 1KB per buffer and 2KB for all the buffers
   set maxmem=1 maxmemtot=2
   new
diff --git a/src/version.c b/src/version.c
index ad38b8138e92..647011ae13ac 100644
--- a/src/version.c
+++ b/src/version.c
@@ -744,10 +744,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4901,
 /**/
     4900,
 /**/
     4899,
 /**/

Vulnerable code: 	else
Fixed code: 	else if (rmp->regprog != NULL)
" this was using a NULL pointer after failing to use the pattern
func Test_buf_pattern_invalid()
  vsplit 0000000
  silent! buf [0--]\&\zs*\zs*e
  bwipe!
endfunc

/**/
    4901,
CVE-2022-1629: Buffer Over-read (CWE-126)
value: Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are capable of crashing software, Modify Memory, and possible remote execution
CWE description: The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
CVSS v3 base score: 7.8
Published: 2022-05-10T14:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/testdir/test_textobjects.vim, src/textobject.c, src/version.c
Commit date: 2022-05-09 13:15:07 +0100
Commit message: patch 8.2.4925: trailing backslash may cause reading past end of line

Problem:    Trailing backslash may cause reading past end of line.
Solution:   Check for NUL after backslash.

Diff: diff --git a/src/testdir/test_textobjects.vim b/src/testdir/test_textobjects.vim
index debbfb357bf8..34894d068a2a 100644
--- a/src/testdir/test_textobjects.vim
+++ b/src/testdir/test_textobjects.vim
@@ -183,14 +183,22 @@ func Test_string_html_objects()
     $put =t
     normal! 2k0vaty
     call assert_equal("<div><div\nattr=\"attr\"\n></div></div>", @", e)
 
     set quoteescape&
+
+    " this was going beyond the end of the line
+    %del
+    sil! norm i"\
+    sil! norm i"\
+    sil! norm i"\
+    call assert_equal('"\', getline(1))
+
+    bwipe!
   endfor
 
   set enc=utf-8
-  bwipe!
 endfunc
 
 func Test_empty_html_tag()
   new
   call setline(1, '<div></div>')
diff --git a/src/textobject.c b/src/textobject.c
index e4a7db38ed42..edaa64c51cc3 100644
--- a/src/textobject.c
+++ b/src/textobject.c
@@ -1662,11 +1662,15 @@ find_next_quote(
     {
 	c = line[col];
 	if (c == NUL)
 	    return -1;
 	else if (escape != NULL && vim_strchr(escape, c))
+	{
 	    ++col;
+	    if (line[col] == NUL)
+		return -1;
+	}
 	else if (c == quotechar)
 	    break;
 	if (has_mbyte)
 	    col += (*mb_ptr2len)(line + col);
 	else
diff --git a/src/version.c b/src/version.c
index d790a754035f..8f33f05aac2e 100644
--- a/src/version.c
+++ b/src/version.c
@@ -744,10 +744,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4925,
 /**/
     4924,
 /**/
     4923,
 /**/

Vulnerable code:   bwipe!
Fixed code: 
    " this was going beyond the end of the line
    %del
    sil! norm i"\
    sil! norm i"\
    sil! norm i"\
    call assert_equal('"\', getline(1))

    bwipe!
	{
	    if (line[col] == NUL)
		return -1;
	}
/**/
    4925,
CVE-2022-1674: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 allows attackers to cause a denial of service (application crash) via a crafted input.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-05-12T11:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/buffer.c, src/testdir/test_buffer.vim, src/version.c
Commit date: 2022-05-11 11:42:28 +0100
Commit message: patch 8.2.4938: crash when matching buffer with invalid pattern

Problem:    Crash when matching buffer with invalid pattern.
Solution:   Check for NULL regprog.

Diff: diff --git a/src/buffer.c b/src/buffer.c
index 35711f5feb32..dfdb0c430d95 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -2930,11 +2930,11 @@ buflist_match(
 {
     char_u	*match;
 
     // First try the short file name, then the long file name.
     match = fname_match(rmp, buf->b_sfname, ignore_case);
-    if (match == NULL)
+    if (match == NULL && rmp->regprog != NULL)
 	match = fname_match(rmp, buf->b_ffname, ignore_case);
 
     return match;
 }
 
diff --git a/src/testdir/test_buffer.vim b/src/testdir/test_buffer.vim
index aea399558707..55ef0fda7620 100644
--- a/src/testdir/test_buffer.vim
+++ b/src/testdir/test_buffer.vim
@@ -413,10 +413,14 @@ endfunc
 " this was using a NULL pointer after failing to use the pattern
 func Test_buf_pattern_invalid()
   vsplit 0000000
   silent! buf [0--]\&\zs*\zs*e
   bwipe!
+
+  vsplit 00000000000000000000000000
+  silent! buf [0--]\&\zs*\zs*e
+  bwipe!
 endfunc
 
 " Test for the 'maxmem' and 'maxmemtot' options
 func Test_buffer_maxmem()
   " use 1KB per buffer and 2KB for all the buffers
diff --git a/src/version.c b/src/version.c
index 8cc9cebac386..0a3a5df8bc97 100644
--- a/src/version.c
+++ b/src/version.c
@@ -744,10 +744,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4938,
 /**/
     4937,
 /**/
     4936,
 /**/

Vulnerable code:     if (match == NULL)
Fixed code:     if (match == NULL && rmp->regprog != NULL)

  vsplit 00000000000000000000000000
  silent! buf [0--]\&\zs*\zs*e
  bwipe!
/**/
    4938,
CVE-2022-1733: Heap-based Buffer Overflow (CWE-122)
value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4968.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 7.8
Published: 2022-05-17T17:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/cindent.c, src/testdir/test_cindent.vim, src/version.c
Commit date: 2022-05-16 18:06:15 +0100
Commit message: patch 8.2.4968: reading past end of the line when C-indenting

Problem:    Reading past end of the line when C-indenting.
Solution:   Check for NUL.

Diff: diff --git a/src/cindent.c b/src/cindent.c
index ec88036eb174..2d47e641be9c 100644
--- a/src/cindent.c
+++ b/src/cindent.c
@@ -87,11 +87,11 @@ skip_string(char_u *p)
 	    {
 		++i;
 		while (vim_isdigit(p[i - 1]))   // '\000'
 		    ++i;
 	    }
-	    if (p[i] == '\'')		    // check for trailing '
+	    if (p[i - 1] != NUL && p[i] == '\'')    // check for trailing '
 	    {
 		p += i;
 		continue;
 	    }
 	}
diff --git a/src/testdir/test_cindent.vim b/src/testdir/test_cindent.vim
index dbd4aa006e4f..c65a0dab3384 100644
--- a/src/testdir/test_cindent.vim
+++ b/src/testdir/test_cindent.vim
@@ -5317,10 +5317,17 @@ func Test_cindent_change_multline()
   normal! jc3jm = 2;
   call assert_equal("\tm = 2;", getline(2))
   close!
 endfunc
 
+" This was reading past the end of the line
+func Test_cindent_check_funcdecl()
+  new
+  sil norm o0('\0=L
+  bwipe!
+endfunc
+
 func Test_cindent_scopedecls()
   new
   setl cindent ts=4 sw=4
   setl cino=g0
   setl cinsd+=public\ slots,signals
diff --git a/src/version.c b/src/version.c
index 6359e0304d62..7397e6fb71b8 100644
--- a/src/version.c
+++ b/src/version.c
@@ -744,10 +744,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4968,
 /**/
     4967,
 /**/
     4966,
 /**/

Vulnerable code: 	    if (p[i] == '\'')		    // check for trailing '
Fixed code: 	    if (p[i - 1] != NUL && p[i] == '\'')    // check for trailing '
" This was reading past the end of the line
func Test_cindent_check_funcdecl()
  new
  sil norm o0('\0=L
  bwipe!
endfunc

/**/
    4968,
CVE-2022-1769: Buffer Over-read (CWE-126)
value: Buffer Over-read in GitHub repository vim/vim prior to 8.2.4974.
CWE description: The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
CVSS v3 base score: 7.8
Published: 2022-05-17T17:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/scriptfile.c, src/testdir/test_source.vim, src/version.c
Commit date: 2022-05-17 17:47:07 +0100
Commit message: patch 8.2.4974: ":so" command may read after end of buffer

Problem:    ":so" command may read after end of buffer.
Solution:   Compute length of text properly.

Diff: diff --git a/src/scriptfile.c b/src/scriptfile.c
index 03c733d35489..f3a5783db510 100644
--- a/src/scriptfile.c
+++ b/src/scriptfile.c
@@ -1963,19 +1963,20 @@ get_one_sourceline(source_cookie_T *sp)
 	    sp->buf_lnum++;
 	    if (ga_grow(&ga, 1) == FAIL)
 		break;
 	    buf = (char_u *)ga.ga_data;
 	    buf[ga.ga_len++] = NUL;
+	    len = ga.ga_len;
 	}
 	else
 	{
 	    buf = (char_u *)ga.ga_data;
 	    if (fgets((char *)buf + ga.ga_len, ga.ga_maxlen - ga.ga_len,
 			sp->fp) == NULL)
 		break;
+	    len = ga.ga_len + (int)STRLEN(buf + ga.ga_len);
 	}
-	len = ga.ga_len + (int)STRLEN(buf + ga.ga_len);
 #ifdef USE_CRNL
 	// Ignore a trailing CTRL-Z, when in Dos mode.	Only recognize the
 	// CTRL-Z by its own, or after a NL.
 	if (	   (len == 1 || (len >= 2 && buf[len - 2] == '\n'))
 		&& sp->fileformat == EOL_DOS
diff --git a/src/testdir/test_source.vim b/src/testdir/test_source.vim
index 5f45ab413c8d..4736e9354660 100644
--- a/src/testdir/test_source.vim
+++ b/src/testdir/test_source.vim
@@ -650,9 +650,20 @@ func Test_source_buffer_long_line()
   " This was reading past the end of the line.
   new
   norm300gr0
   so
   bwipe!
+
+  let lines =<< trim END
+      new
+      norm 10a0000000000ø00000000000
+      norm i0000000000000000000
+      silent! so
+  END
+  call writefile(lines, 'Xtest.vim')
+  source Xtest.vim
+  bwipe!
+  call delete('Xtest.vim')
 endfunc
 
 
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 68d11a2b0f7f..98bb40d1166d 100644
--- a/src/version.c
+++ b/src/version.c
@@ -744,10 +744,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4974,
 /**/
     4973,
 /**/
     4972,
 /**/

Vulnerable code: 	len = ga.ga_len + (int)STRLEN(buf + ga.ga_len);
Fixed code: 	    len = ga.ga_len;
	    len = ga.ga_len + (int)STRLEN(buf + ga.ga_len);

  let lines =<< trim END
      new
      norm 10a0000000000ø00000000000
      norm i0000000000000000000
      silent! so
  END
  call writefile(lines, 'Xtest.vim')
  source Xtest.vim
  bwipe!
  call delete('Xtest.vim')
/**/
    4974,
CVE-2022-1796: Use After Free (CWE-416)
value: Use After Free in GitHub repository vim/vim prior to 8.2.4979.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.8
Published: 2022-05-19T16:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/testdir/test_tagjump.vim, src/version.c, src/window.c
Commit date: 2022-05-18 16:29:08 +0100
Commit message: patch 8.2.4979: accessing freed memory when line is flushed

Problem:    Accessing freed memory when line is flushed.
Solution:   Make a copy of the pattern to search for.

Diff: diff --git a/src/testdir/test_tagjump.vim b/src/testdir/test_tagjump.vim
index 97670bcfce91..8b19c634d4dc 100644
--- a/src/testdir/test_tagjump.vim
+++ b/src/testdir/test_tagjump.vim
@@ -1390,10 +1390,19 @@ func Test_macro_search()
   call assert_fails('dsplit BAR', 'E388:')
 
   close!
 endfunc
 
+func Test_define_search()
+  " this was accessing freed memory
+  new
+  call setline(1, ['first line', '', '#define something 0'])
+  sil norm o0
+  sil! norm 
+  bwipe!
+endfunc
+
 " Test for [*, [/, ]* and ]/
 func Test_comment_search()
   new
   call setline(1, ['', '/*', ' *', ' *', ' */'])
   normal! 4gg[/
diff --git a/src/version.c b/src/version.c
index 854de459729a..37e3d80f869e 100644
--- a/src/version.c
+++ b/src/version.c
@@ -744,10 +744,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4979,
 /**/
     4978,
 /**/
     4977,
 /**/
diff --git a/src/window.c b/src/window.c
index fca0eea32916..984fb4631c92 100644
--- a/src/window.c
+++ b/src/window.c
@@ -577,13 +577,20 @@ wingotofile:
     case 'd':			    // Go to definition, using 'define'
     case Ctrl_D:
 		CHECK_CMDWIN;
 		if ((len = find_ident_under_cursor(&ptr, FIND_IDENT)) == 0)
 		    break;
+
+		// Make a copy, if the line was changed it will be freed.
+		ptr = vim_strnsave(ptr, len);
+		if (ptr == NULL)
+		    break;
+
 		find_pattern_in_path(ptr, 0, len, TRUE,
 			Prenum == 0 ? TRUE : FALSE, type,
 			Prenum1, ACTION_SPLIT, (linenr_T)1, (linenr_T)MAXLNUM);
+		vim_free(ptr);
 		curwin->w_set_curswant = TRUE;
 		break;
 #endif
 
 // Quickfix window only: view the result under the cursor in a new split.

Fixed code: func Test_define_search()
  " this was accessing freed memory
  new
  call setline(1, ['first line', '', '#define something 0'])
  sil norm o0
  sil! norm 
  bwipe!
endfunc

/**/
    4979,

		// Make a copy, if the line was changed it will be freed.
		ptr = vim_strnsave(ptr, len);
		if (ptr == NULL)
		    break;

		vim_free(ptr);
CVE-2022-1851: Out-of-bounds Read (CWE-125)
value: Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2022-05-25T13:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/testdir/test_textformat.vim, src/textformat.c, src/version.c
Commit date: 2022-05-24 13:57:54 +0100
Commit message: patch 8.2.5013: after text formatting cursor may be in an invalid position

Problem:    After text formatting the cursor may be in an invalid position.
Solution:   Correct the cursor position after formatting.

Diff: diff --git a/src/testdir/test_textformat.vim b/src/testdir/test_textformat.vim
index d33e2508d279..c5f597580154 100644
--- a/src/testdir/test_textformat.vim
+++ b/src/testdir/test_textformat.vim
@@ -1289,6 +1289,18 @@ func Test_fo_2()
         \ "paragraph.  second line of the",
         \ "same paragraph.  third line."], getline(1, '$'))
   close!
 endfunc
 
+" This was leaving the cursor after the end of a line.  Complicated way to
+" have the problem show up with valgrind.
+func Test_correct_cursor_position()
+  set encoding=iso8859
+  new
+  norm a0000
+  sil! norm gggg0i0gw0gg
+
+  bwipe!
+  set encoding=utf8
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/textformat.c b/src/textformat.c
index 7e32c1ccc3cb..5ba2f1798ddb 100644
--- a/src/textformat.c
+++ b/src/textformat.c
@@ -868,10 +868,13 @@ op_format(
 
     if (keep_cursor)
     {
 	curwin->w_cursor = saved_cursor;
 	saved_cursor.lnum = 0;
+
+	// formatting may have made the cursor position invalid
+	check_cursor();
     }
 
     if (oap->is_VIsual)
     {
 	win_T	*wp;
diff --git a/src/version.c b/src/version.c
index dea37d6cdd0d..f737b1b7d140 100644
--- a/src/version.c
+++ b/src/version.c
@@ -732,10 +732,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    5013,
 /**/
     5012,
 /**/
     5011,
 /**/

Fixed code: " This was leaving the cursor after the end of a line.  Complicated way to
" have the problem show up with valgrind.
func Test_correct_cursor_position()
  set encoding=iso8859
  new
  norm a0000
  sil! norm gggg0i0gw0gg

  bwipe!
  set encoding=utf8
endfunc


	// formatting may have made the cursor position invalid
	check_cursor();
/**/
    5013,
CVE-2022-1886: Heap-based Buffer Overflow (CWE-122)
value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 7.8
Published: 2022-05-26T15:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/register.c, src/testdir/test_put.vim, src/version.c
Commit date: 2022-05-25 15:15:38 +0100
Commit message: patch 8.2.5016: access before start of text with a put command

Problem:    Access before start of text with a put command.
Solution:   Check the length is more than zero.

Diff: diff --git a/src/register.c b/src/register.c
index 5ebaa05dbf09..d5a56ae0c604 100644
--- a/src/register.c
+++ b/src/register.c
@@ -2217,13 +2217,16 @@ error:
 	    // Correct the length for change in indent.
 	    curbuf->b_op_end.lnum = new_lnum;
 	    len = STRLEN(y_array[y_size - 1]);
 	    col = (colnr_T)len - lendiff;
 	    if (col > 1)
-		curbuf->b_op_end.col = col - 1
-				- mb_head_off(y_array[y_size - 1],
+	    {
+		curbuf->b_op_end.col = col - 1;
+		if (len > 0)
+		    curbuf->b_op_end.col -= mb_head_off(y_array[y_size - 1],
 						y_array[y_size - 1] + len - 1);
+	    }
 	    else
 		curbuf->b_op_end.col = 0;
 
 	    if (flags & PUT_CURSLINE)
 	    {
diff --git a/src/testdir/test_put.vim b/src/testdir/test_put.vim
index 0fde026401a9..aa5aa2b99061 100644
--- a/src/testdir/test_put.vim
+++ b/src/testdir/test_put.vim
@@ -208,7 +208,16 @@ func Test_multibyte_op_end_mark()
   call assert_equal([0, 1, v:maxcol, 0], getpos("'>"))
   call assert_equal([0, 2, 7, 0], getpos("']"))
   bwipe!
 endfunc
 
+" this was putting a mark before the start of a line
+func Test_put_empty_register()
+  new
+  norm yy
+  norm [Pi00ggv)s0
+  sil! norm [P
+  bwipe!
+endfunc
+
 
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 4682108ff8e6..250b73e7afff 100644
--- a/src/version.c
+++ b/src/version.c
@@ -732,10 +732,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    5016,
 /**/
     5015,
 /**/
     5014,
 /**/

Vulnerable code: 		curbuf->b_op_end.col = col - 1
				- mb_head_off(y_array[y_size - 1],
Fixed code: 	    {
		curbuf->b_op_end.col = col - 1;
		if (len > 0)
		    curbuf->b_op_end.col -= mb_head_off(y_array[y_size - 1],
	    }
" this was putting a mark before the start of a line
func Test_put_empty_register()
  new
  norm yy
  norm [Pi00ggv)s0
  sil! norm [P
  bwipe!
endfunc

/**/
    5016,
CVE-2022-1898: Use After Free (CWE-416)
value: Use After Free in GitHub repository vim/vim prior to 8.2.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.8
Published: 2022-05-27T09:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/normal.c, src/testdir/test_tagjump.vim, src/version.c
Commit date: 2022-05-26 16:32:44 +0100
Commit message: patch 8.2.5024: using freed memory with "]d"

Problem:    Using freed memory with "]d".
Solution:   Copy the pattern before searching.

Diff: diff --git a/src/normal.c b/src/normal.c
index 53c50dc8b368..f07598655145 100644
--- a/src/normal.c
+++ b/src/normal.c
@@ -4462,18 +4462,24 @@ nv_brackets(cmdarg_T *cap)
 
 	if ((len = find_ident_under_cursor(&ptr, FIND_IDENT)) == 0)
 	    clearop(cap->oap);
 	else
 	{
+	    // Make a copy, if the line was changed it will be freed.
+	    ptr = vim_strnsave(ptr, len);
+	    if (ptr == NULL)
+		return;
+
 	    find_pattern_in_path(ptr, 0, len, TRUE,
 		cap->count0 == 0 ? !isupper(cap->nchar) : FALSE,
 		((cap->nchar & 0xf) == ('d' & 0xf)) ?  FIND_DEFINE : FIND_ANY,
 		cap->count1,
 		isupper(cap->nchar) ? ACTION_SHOW_ALL :
 			    islower(cap->nchar) ? ACTION_SHOW : ACTION_GOTO,
 		cap->cmdchar == ']' ? curwin->w_cursor.lnum + 1 : (linenr_T)1,
 		(linenr_T)MAXLNUM);
+	    vim_free(ptr);
 	    curwin->w_set_curswant = TRUE;
 	}
     }
     else
 #endif
diff --git a/src/testdir/test_tagjump.vim b/src/testdir/test_tagjump.vim
index 8b19c634d4dc..aacfb9baeb56 100644
--- a/src/testdir/test_tagjump.vim
+++ b/src/testdir/test_tagjump.vim
@@ -1397,10 +1397,16 @@ func Test_define_search()
   new
   call setline(1, ['first line', '', '#define something 0'])
   sil norm o0
   sil! norm 
   bwipe!
+
+  new somefile
+  call setline(1, ['first line', '', '#define something 0'])
+  sil norm 0o0
+  sil! norm ]d
+  bwipe!
 endfunc
 
 " Test for [*, [/, ]* and ]/
 func Test_comment_search()
   new
diff --git a/src/version.c b/src/version.c
index cd6c33162204..ec52074c48bd 100644
--- a/src/version.c
+++ b/src/version.c
@@ -732,10 +732,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    5024,
 /**/
     5023,
 /**/
     5022,
 /**/

Fixed code: 	    // Make a copy, if the line was changed it will be freed.
	    ptr = vim_strnsave(ptr, len);
	    if (ptr == NULL)
		return;

	    vim_free(ptr);

  new somefile
  call setline(1, ['first line', '', '#define something 0'])
  sil norm 0o0
  sil! norm ]d
  bwipe!
/**/
    5024,
CVE-2022-2124: Buffer Over-read (CWE-126)
value: Buffer Over-read in GitHub repository vim/vim prior to 8.2.
CWE description: The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
CVSS v3 base score: 7.8
Published: 2022-06-19T10:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/textobject.c, src/version.c
Commit date: 2022-06-18 11:22:40 +0100
Commit message: patch 8.2.5120: searching for quotes may go over the end of the line

Problem:    Searching for quotes may go over the end of the line.
Solution:   Check for running into the NUL.

Diff: diff --git a/src/textobject.c b/src/textobject.c
index 9a8a91626042..153c14ddddb6 100644
--- a/src/textobject.c
+++ b/src/textobject.c
@@ -1796,15 +1796,21 @@ current_quote(
 	    col_end = VIsual.col;
 	}
 
 	// Find out if we have a quote in the selection.
 	while (i <= col_end)
+	{
+	    // check for going over the end of the line, which can happen if
+	    // the line was changed after the Visual area was selected.
+	    if (line[i] == NUL)
+		break;
 	    if (line[i++] == quotechar)
 	    {
 		selected_quote = TRUE;
 		break;
 	    }
+	}
     }
 
     if (!vis_empty && line[col_start] == quotechar)
     {
 	// Already selecting something and on a quote character.  Find the
diff --git a/src/version.c b/src/version.c
index b9b334785677..df9d576ad44f 100644
--- a/src/version.c
+++ b/src/version.c
@@ -732,10 +732,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    5120,
 /**/
     5119,
 /**/
     5118,
 /**/

Fixed code: 	{
	    // check for going over the end of the line, which can happen if
	    // the line was changed after the Visual area was selected.
	    if (line[i] == NUL)
		break;
	}
/**/
    5120,
CVE-2022-2125: Heap-based Buffer Overflow (CWE-122)
value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 7.8
Published: 2022-06-19T12:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/indent.c, src/testdir/test_indent.vim, src/version.c
Commit date: 2022-06-18 12:51:11 +0100
Commit message: patch 8.2.5122: lisp indenting my run over the end of the line

Problem:    Lisp indenting my run over the end of the line.
Solution:   Check for NUL earlier.

Diff: diff --git a/src/indent.c b/src/indent.c
index 794fa2c3430..fa177bcf2c7 100644
--- a/src/indent.c
+++ b/src/indent.c
@@ -2027,10 +2027,12 @@ get_lisp_indent(void)
 				++that;
 				break;
 			    }
 			}
 		    }
+		    if (*that == NUL)
+			break;
 		}
 		if (*that == '(' || *that == '[')
 		    ++parencount;
 		else if (*that == ')' || *that == ']')
 		    --parencount;
diff --git a/src/testdir/test_indent.vim b/src/testdir/test_indent.vim
index be55227bd20..3b5b643177b 100644
--- a/src/testdir/test_indent.vim
+++ b/src/testdir/test_indent.vim
@@ -142,10 +142,20 @@ func Test_lisp_indent()
   normal! jostr2"
   call assert_equal(['  ;; comment', '  ;; comment', '  \ abc', '  \ abc', '', '  ;; ret', '  " str1\', '  str1"', '  " st\b', '  str2"'], getline(2, 11))
   close!
 endfunc
 
+func Test_lisp_indent_quoted()
+  " This was going past the end of the line
+  new
+  setlocal lisp autoindent
+  call setline(1, ['"[', '='])
+  normal Gvk=
+
+  bwipe!
+endfunc
+
 " Test for setting the 'indentexpr' from a modeline
 func Test_modeline_indent_expr()
   let modeline = &modeline
   set modeline
   func GetIndent()
diff --git a/src/version.c b/src/version.c
index 89e1fa1b7af..5411e1c189f 100644
--- a/src/version.c
+++ b/src/version.c
@@ -732,10 +732,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    5122,
 /**/
     5121,
 /**/
     5120,
 /**/

Fixed code: 		    if (*that == NUL)
			break;
func Test_lisp_indent_quoted()
  " This was going past the end of the line
  new
  setlocal lisp autoindent
  call setline(1, ['"[', '='])
  normal Gvk=

  bwipe!
endfunc

/**/
    5122,
CVE-2022-2126: Out-of-bounds Read (CWE-125)
value: Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2022-06-19T13:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/spellsuggest.c, src/testdir/test_spell.vim, src/version.c
Commit date: 2022-06-18 14:09:08 +0100
Commit message: patch 8.2.5123: using invalid index when looking for spell suggestions

Problem:    Using invalid index when looking for spell suggestions.
Solution:   Do not decrement the index when it is zero.

Diff: diff --git a/src/spellsuggest.c b/src/spellsuggest.c
index 5b460a3eaae..8f9756534fa 100644
--- a/src/spellsuggest.c
+++ b/src/spellsuggest.c
@@ -1971,11 +1971,12 @@ suggest_trie_walk(
 			    sp->ts_tcharlen = MB_BYTE2LEN(c);
 			    sp->ts_fcharstart = sp->ts_fidx - 1;
 			    sp->ts_isdiff = (newscore != 0)
 						       ? DIFF_YES : DIFF_NONE;
 			}
-			else if (sp->ts_isdiff == DIFF_INSERT)
+			else if (sp->ts_isdiff == DIFF_INSERT
+							    && sp->ts_fidx > 0)
 			    // When inserting trail bytes don't advance in the
 			    // bad word.
 			    --sp->ts_fidx;
 			if (++sp->ts_tcharidx == sp->ts_tcharlen)
 			{
diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
index aa574447533..0fd5ed91780 100644
--- a/src/testdir/test_spell.vim
+++ b/src/testdir/test_spell.vim
@@ -68,10 +68,20 @@ func Test_z_equal_on_invalid_utf8_word()
   norm z=
   set nospell
   bwipe!
 endfunc
 
+func Test_z_equal_on_single_character()
+  " this was decrementing the index below zero
+  new
+  norm a0\Ê
+  norm zW
+  norm z=
+
+  bwipe!
+endfunc
+
 " Test spellbadword() with argument
 func Test_spellbadword()
   set spell
 
   call assert_equal(['bycycle', 'bad'],  spellbadword('My bycycle.'))
diff --git a/src/version.c b/src/version.c
index 5411e1c189f..0a422742f1a 100644
--- a/src/version.c
+++ b/src/version.c
@@ -732,10 +732,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    5123,
 /**/
     5122,
 /**/
     5121,
 /**/

Vulnerable code: 			else if (sp->ts_isdiff == DIFF_INSERT)
Fixed code: 			else if (sp->ts_isdiff == DIFF_INSERT
							    && sp->ts_fidx > 0)
func Test_z_equal_on_single_character()
  " this was decrementing the index below zero
  new
  norm a0\Ê
  norm zW
  norm z=

  bwipe!
endfunc

/**/
    5123,