Bug#1106491: unblock: vim/2:9.1.1230-2
Package: release.debian.org
Severity: normal
X-Debbugs-Cc: vim@packages.debian.org
Control: affects -1 + src:vim
User: release.debian.org@packages.debian.org
Usertags: unblock
Please unblock package vim
[ Reason ]
Fix a crash when executing executing certain vimscript constructs. In
the reported case, this was being triggered by the vim-airline plugin.
[ Impact ]
Vim will crash for some users.
[ Tests ]
No automated tests
[ Risks ]
Low risk. It's a very small code change to use strlen() rather than
pointer arithmetic.
[ Checklist ]
[x] all changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in testing
unblock vim/2:9.1.1230-2
diff --git a/debian/changelog b/debian/changelog
index ca7f9f08b..6ce46b970 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+vim (2:9.1.1230-2) unstable; urgency=medium
+
+ * Backport v9.1.1242 and v9.1.1244 to fix crash when evaluating a variable
+ name. (Closes: #1106133)
+
+ -- James McCoy <jamessan@debian.org> Thu, 22 May 2025 20:48:59 -0400
+
vim (2:9.1.1230-1) unstable; urgency=medium
* Merge upstream tag v9.1.1230
diff --git a/debian/patches/patch-9.1.1242-Crash-when-evaluating-variable-name.patch b/debian/patches/patch-9.1.1242-Crash-when-evaluating-variable-name.patch
new file mode 100644
index 000000000..bb05df723
--- /dev/null
+++ b/debian/patches/patch-9.1.1242-Crash-when-evaluating-variable-name.patch
@@ -0,0 +1,57 @@
+From: Christian Brabandt <cb@256bit.org>
+Date: Wed, 26 Mar 2025 19:25:57 +0100
+Subject: patch 9.1.1242: Crash when evaluating variable name
+
+Problem: Crash when evaluating variable name (after v9.1.0870)
+Solution: calculate the strlen() directly instead of pointer
+ arithmetics, fix missing assignment to lp->ll_name_end in
+ get_lval() (zeertzjq)
+
+closes: #16972
+fixes: vim-airline/vim-airline#2710
+related: #16066
+
+Co-authored-by: zeertzjq <zeertzjq@outlook.com>
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+(cherry picked from commit 06774a271a7d728f188175340154361255d6b0a4)
+Signed-off-by: James McCoy <jamessan@debian.org>
+---
+ src/eval.c | 4 +++-
+ src/version.c | 2 ++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/eval.c b/src/eval.c
+index 9a140c1..eb6b8d9 100644
+--- a/src/eval.c
++++ b/src/eval.c
+@@ -2051,6 +2051,8 @@ get_lval(
+ }
+ }
+ lp->ll_name = lp->ll_exp_name;
++ if (lp->ll_name != NULL)
++ lp->ll_name_end = lp->ll_name + STRLEN(lp->ll_name);
+ }
+ else
+ {
+@@ -2261,7 +2263,7 @@ set_var_lval(
+
+ // handle +=, -=, *=, /=, %= and .=
+ di = NULL;
+- if (eval_variable(lp->ll_name, (int)(lp->ll_name_end - lp->ll_name),
++ if (eval_variable(lp->ll_name, (int)STRLEN(lp->ll_name),
+ lp->ll_sid, &tv, &di, EVAL_VAR_VERBOSE) == OK)
+ {
+ if (di != NULL && check_typval_is_value(&di->di_tv) == FAIL)
+diff --git a/src/version.c b/src/version.c
+index 11ba12a..6b9759c 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -704,6 +704,8 @@ static char *(features[]) =
+
+ static int included_patches[] =
+ { /* Add new patch number below this line */
++/**/
++ 1242,
+ /**/
+ 1230,
+ /**/
diff --git a/debian/patches/patch-9.1.1244-part-of-patch-v9.1.1242-was-wrong.patch b/debian/patches/patch-9.1.1244-part-of-patch-v9.1.1242-was-wrong.patch
new file mode 100644
index 000000000..946ef2d27
--- /dev/null
+++ b/debian/patches/patch-9.1.1244-part-of-patch-v9.1.1242-was-wrong.patch
@@ -0,0 +1,44 @@
+From: Christian Brabandt <cb@256bit.org>
+Date: Wed, 26 Mar 2025 20:36:12 +0100
+Subject: patch 9.1.1244: part of patch v9.1.1242 was wrong
+
+Problem: part of patch v9.1.1242 was wrong
+Solution: revert part of the patch
+
+fixes: #16983
+related: #16972
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+(cherry picked from commit 35cb38d34b69e4263f0eb9f78a676a5fb6d11250)
+Signed-off-by: James McCoy <jamessan@debian.org>
+---
+ src/eval.c | 2 --
+ src/version.c | 2 ++
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/eval.c b/src/eval.c
+index eb6b8d9..4cdd1f2 100644
+--- a/src/eval.c
++++ b/src/eval.c
+@@ -2051,8 +2051,6 @@ get_lval(
+ }
+ }
+ lp->ll_name = lp->ll_exp_name;
+- if (lp->ll_name != NULL)
+- lp->ll_name_end = lp->ll_name + STRLEN(lp->ll_name);
+ }
+ else
+ {
+diff --git a/src/version.c b/src/version.c
+index 6b9759c..30f58fd 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -704,6 +704,8 @@ static char *(features[]) =
+
+ static int included_patches[] =
+ { /* Add new patch number below this line */
++/**/
++ 1244,
+ /**/
+ 1242,
+ /**/
diff --git a/debian/patches/series b/debian/patches/series
index ebea3657f..09620bfdc 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -3,3 +3,5 @@ debian/Detect-the-rst-filetype-using-the-contents-of-the-file.patch
debian/Add-recognition-of-more-LaTeX-commands-for-tex-filetype-d.patch
debian/Document-Debian-s-decision-to-disable-modelines-by-defaul.patch
Revert-patch-9.1.0949-popups-inconsistently-shifted-to-th.patch
+patch-9.1.1242-Crash-when-evaluating-variable-name.patch
+patch-9.1.1244-part-of-patch-v9.1.1242-was-wrong.patch
Reply to: