diffstat for vim-8.2.2434 vim-8.2.2434

 .gitlab-ci.yml                                                                   |   12 
 changelog                                                                        |   13 
 gbp.conf                                                                         |    2 
 patches/debian/Detect-the-rst-filetype-using-the-contents-of-the-file.patch      |    4 
 patches/debian/Document-Debian-s-decision-to-disable-modelines-by-defaul.patch   |    2 
 patches/debian/Support-sourcing-a-vimrc.tiny-when-Vim-is-invoked-as-vi.patch     |    4 
 patches/series                                                                   |    4 
 patches/upstream/patch-8.2.3402-invalid-memory-access-when-using-retab-wit.patch |  203 ++++++++++
 patches/upstream/patch-8.2.3403-memory-leak-for-retab-with-invalid-argumen.patch |   61 +++
 patches/upstream/patch-8.2.3409-reading-beyond-end-of-line-with-invalid-ut.patch |   56 ++
 patches/upstream/patch-8.2.3428-using-freed-memory-when-replacing.patch          |   76 +++
 vim-gtk.preinst                                                                  |   27 +
 12 files changed, 448 insertions(+), 16 deletions(-)

diff -Nru vim-8.2.2434/debian/changelog vim-8.2.2434/debian/changelog
--- vim-8.2.2434/debian/changelog	2021-03-01 21:58:09.000000000 -0500
+++ vim-8.2.2434/debian/changelog	2021-09-30 21:51:08.000000000 -0400
@@ -1,3 +1,16 @@
+vim (2:8.2.2434-3+deb11u1) bullseye; urgency=medium
+
+  * Switch gbp.conf and CI to bullseye
+  * Remove vim-gtk alternatives during vim-gtk -> vim-gtk3 transition
+    (Closes: #993766)
+  * Backport patches 8.2.3402 and 8.2.3403 to fix heap overflow in :retab
+    (Closes: #994076, CVE-2021-3770)
+  * Backport 8.2.3409 to fix heap overflow (Closes: #994498, CVE-2021-3778)
+  * Backport patch 8.2.3428 to fix use after free (Closes: #994497,
+    CVE-2021-3796)
+
+ -- James McCoy <jamessan@debian.org>  Thu, 30 Sep 2021 21:51:08 -0400
+
 vim (2:8.2.2434-3) unstable; urgency=medium
 
   * Add pkg.vim.noruby Build-Profile
diff -Nru vim-8.2.2434/debian/gbp.conf vim-8.2.2434/debian/gbp.conf
--- vim-8.2.2434/debian/gbp.conf	2021-03-01 21:58:09.000000000 -0500
+++ vim-8.2.2434/debian/gbp.conf	2021-09-30 21:51:08.000000000 -0400
@@ -1,7 +1,7 @@
 [DEFAULT]
 upstream-tag = v%(version)s
 debian-tag = debian/%(version)s
-debian-branch = debian/sid
+debian-branch = debian/bullseye
 
 [pq]
 patch-numbers = False
diff -Nru vim-8.2.2434/debian/.gitlab-ci.yml vim-8.2.2434/debian/.gitlab-ci.yml
--- vim-8.2.2434/debian/.gitlab-ci.yml	2021-03-01 21:58:09.000000000 -0500
+++ vim-8.2.2434/debian/.gitlab-ci.yml	2021-09-30 21:51:08.000000000 -0400
@@ -14,14 +14,6 @@
     - cd ../deb-packages/vim/vim-"$UPSTREAM_VERSION"
     - sudo -u ci dpkg-buildpackage -us -uc
 
-test:unstable:
+test:bullseye:
   <<: *build
-  image: debian:unstable
-
-test:testing:
-  <<: *build
-  image: debian:testing
-
-test:ubuntu-devel:
-  <<: *build
-  image: ubuntu:devel
+  image: debian:bullseye
diff -Nru vim-8.2.2434/debian/patches/debian/Detect-the-rst-filetype-using-the-contents-of-the-file.patch vim-8.2.2434/debian/patches/debian/Detect-the-rst-filetype-using-the-contents-of-the-file.patch
--- vim-8.2.2434/debian/patches/debian/Detect-the-rst-filetype-using-the-contents-of-the-file.patch	2021-03-01 21:58:09.000000000 -0500
+++ vim-8.2.2434/debian/patches/debian/Detect-the-rst-filetype-using-the-contents-of-the-file.patch	2021-09-30 21:51:08.000000000 -0400
@@ -8,10 +8,10 @@
  1 file changed, 8 insertions(+)
 
 diff --git a/runtime/scripts.vim b/runtime/scripts.vim
-index 9217b44..37e05d5 100644
+index 6448c54..426a9ba 100644
 --- a/runtime/scripts.vim
 +++ b/runtime/scripts.vim
-@@ -367,6 +367,14 @@ else
+@@ -371,6 +371,14 @@ else
    elseif s:line1 =~# 'exec\s\+\S*scheme' || s:line2 =~# 'exec\s\+\S*scheme'
      set ft=scheme
  
diff -Nru vim-8.2.2434/debian/patches/debian/Document-Debian-s-decision-to-disable-modelines-by-defaul.patch vim-8.2.2434/debian/patches/debian/Document-Debian-s-decision-to-disable-modelines-by-defaul.patch
--- vim-8.2.2434/debian/patches/debian/Document-Debian-s-decision-to-disable-modelines-by-defaul.patch	2021-03-01 21:58:09.000000000 -0500
+++ vim-8.2.2434/debian/patches/debian/Document-Debian-s-decision-to-disable-modelines-by-defaul.patch	2021-09-30 21:51:08.000000000 -0400
@@ -15,7 +15,7 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/runtime/doc/options.txt b/runtime/doc/options.txt
-index 2963193..38c5998 100644
+index 8b655dc..e03af4f 100644
 --- a/runtime/doc/options.txt
 +++ b/runtime/doc/options.txt
 @@ -5155,7 +5155,7 @@ A jump table for the options with a short description can be found at |Q_op|.
diff -Nru vim-8.2.2434/debian/patches/debian/Support-sourcing-a-vimrc.tiny-when-Vim-is-invoked-as-vi.patch vim-8.2.2434/debian/patches/debian/Support-sourcing-a-vimrc.tiny-when-Vim-is-invoked-as-vi.patch
--- vim-8.2.2434/debian/patches/debian/Support-sourcing-a-vimrc.tiny-when-Vim-is-invoked-as-vi.patch	2021-03-01 21:58:09.000000000 -0500
+++ vim-8.2.2434/debian/patches/debian/Support-sourcing-a-vimrc.tiny-when-Vim-is-invoked-as-vi.patch	2021-09-30 21:51:08.000000000 -0400
@@ -70,10 +70,10 @@
  # define SYS_VIMRC_FILE "$VIM/vimrc"
  #endif
 diff --git a/src/structs.h b/src/structs.h
-index d6bf667..b978559 100644
+index bd59656..6e6499c 100644
 --- a/src/structs.h
 +++ b/src/structs.h
-@@ -4118,6 +4118,9 @@ typedef struct
+@@ -4130,6 +4130,9 @@ typedef struct
  #ifdef FEAT_DIFF
      int		diff_mode;		// start with 'diff' set
  #endif
diff -Nru vim-8.2.2434/debian/patches/series vim-8.2.2434/debian/patches/series
--- vim-8.2.2434/debian/patches/series	2021-03-01 21:58:09.000000000 -0500
+++ vim-8.2.2434/debian/patches/series	2021-09-30 21:51:08.000000000 -0400
@@ -2,3 +2,7 @@
 debian/Detect-the-rst-filetype-using-the-contents-of-the-file.patch
 debian/Add-recognition-of-more-LaTeX-commands-for-tex-filetype-d.patch
 debian/Document-Debian-s-decision-to-disable-modelines-by-defaul.patch
+upstream/patch-8.2.3402-invalid-memory-access-when-using-retab-wit.patch
+upstream/patch-8.2.3403-memory-leak-for-retab-with-invalid-argumen.patch
+upstream/patch-8.2.3409-reading-beyond-end-of-line-with-invalid-ut.patch
+upstream/patch-8.2.3428-using-freed-memory-when-replacing.patch
diff -Nru vim-8.2.2434/debian/patches/upstream/patch-8.2.3402-invalid-memory-access-when-using-retab-wit.patch vim-8.2.2434/debian/patches/upstream/patch-8.2.3402-invalid-memory-access-when-using-retab-wit.patch
--- vim-8.2.2434/debian/patches/upstream/patch-8.2.3402-invalid-memory-access-when-using-retab-wit.patch	1969-12-31 19:00:00.000000000 -0500
+++ vim-8.2.2434/debian/patches/upstream/patch-8.2.3402-invalid-memory-access-when-using-retab-wit.patch	2021-09-30 21:51:08.000000000 -0400
@@ -0,0 +1,203 @@
+From: Bram Moolenaar <Bram@vim.org>
+Date: Sat, 4 Sep 2021 18:47:28 +0200
+Subject: patch 8.2.3402: invalid memory access when using :retab with large
+ value
+
+Problem:    Invalid memory access when using :retab with large value.
+Solution:   Check the number is positive.
+---
+ src/indent.c               | 34 +++++++++++++++++++++-------------
+ src/option.c               | 12 ++++++------
+ src/optionstr.c            |  4 ++--
+ src/testdir/test_retab.vim |  3 +++
+ src/version.c              |  1 +
+ 5 files changed, 33 insertions(+), 21 deletions(-)
+
+diff --git a/src/indent.c b/src/indent.c
+index a9d406e..9209a39 100644
+--- a/src/indent.c
++++ b/src/indent.c
+@@ -18,18 +18,19 @@
+ /*
+  * Set the integer values corresponding to the string setting of 'vartabstop'.
+  * "array" will be set, caller must free it if needed.
++ * Return FAIL for an error.
+  */
+     int
+ tabstop_set(char_u *var, int **array)
+ {
+-    int valcount = 1;
+-    int t;
+-    char_u *cp;
++    int	    valcount = 1;
++    int	    t;
++    char_u  *cp;
+ 
+     if (var[0] == NUL || (var[0] == '0' && var[1] == NUL))
+     {
+ 	*array = NULL;
+-	return TRUE;
++	return OK;
+     }
+ 
+     for (cp = var; *cp != NUL; ++cp)
+@@ -43,8 +44,8 @@ tabstop_set(char_u *var, int **array)
+ 		if (cp != end)
+ 		    emsg(_(e_positive));
+ 		else
+-		    emsg(_(e_invarg));
+-		return FALSE;
++		    semsg(_(e_invarg2), cp);
++		return FAIL;
+ 	    }
+ 	}
+ 
+@@ -55,26 +56,33 @@ tabstop_set(char_u *var, int **array)
+ 	    ++valcount;
+ 	    continue;
+ 	}
+-	emsg(_(e_invarg));
+-	return FALSE;
++	semsg(_(e_invarg2), var);
++	return FAIL;
+     }
+ 
+     *array = ALLOC_MULT(int, valcount + 1);
+     if (*array == NULL)
+-	return FALSE;
++	return FAIL;
+     (*array)[0] = valcount;
+ 
+     t = 1;
+     for (cp = var; *cp != NUL;)
+     {
+-	(*array)[t++] = atoi((char *)cp);
+-	while (*cp  != NUL && *cp != ',')
++	int n = atoi((char *)cp);
++
++	if (n < 0 || n > 9999)
++	{
++	    semsg(_(e_invarg2), cp);
++	    return FAIL;
++	}
++	(*array)[t++] = n;
++	while (*cp != NUL && *cp != ',')
+ 	    ++cp;
+ 	if (*cp != NUL)
+ 	    ++cp;
+     }
+ 
+-    return TRUE;
++    return OK;
+ }
+ 
+ /*
+@@ -1560,7 +1568,7 @@ ex_retab(exarg_T *eap)
+ 
+ #ifdef FEAT_VARTABS
+     new_ts_str = eap->arg;
+-    if (!tabstop_set(eap->arg, &new_vts_array))
++    if (tabstop_set(eap->arg, &new_vts_array) == FAIL)
+ 	return;
+     while (vim_isdigit(*(eap->arg)) || *(eap->arg) == ',')
+ 	++(eap->arg);
+diff --git a/src/option.c b/src/option.c
+index b4893a1..94986bf 100644
+--- a/src/option.c
++++ b/src/option.c
+@@ -2347,9 +2347,9 @@ didset_options2(void)
+ #endif
+ #ifdef FEAT_VARTABS
+     vim_free(curbuf->b_p_vsts_array);
+-    tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
++    (void)tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
+     vim_free(curbuf->b_p_vts_array);
+-    tabstop_set(curbuf->b_p_vts,  &curbuf->b_p_vts_array);
++    (void)tabstop_set(curbuf->b_p_vts,  &curbuf->b_p_vts_array);
+ #endif
+ }
+ 
+@@ -5808,7 +5808,7 @@ buf_copy_options(buf_T *buf, int flags)
+ 	    buf->b_p_vsts = vim_strsave(p_vsts);
+ 	    COPY_OPT_SCTX(buf, BV_VSTS);
+ 	    if (p_vsts && p_vsts != empty_option)
+-		tabstop_set(p_vsts, &buf->b_p_vsts_array);
++		(void)tabstop_set(p_vsts, &buf->b_p_vsts_array);
+ 	    else
+ 		buf->b_p_vsts_array = 0;
+ 	    buf->b_p_vsts_nopaste = p_vsts_nopaste
+@@ -5968,7 +5968,7 @@ buf_copy_options(buf_T *buf, int flags)
+ 		buf->b_p_isk = save_p_isk;
+ #ifdef FEAT_VARTABS
+ 		if (p_vts && p_vts != empty_option && !buf->b_p_vts_array)
+-		    tabstop_set(p_vts, &buf->b_p_vts_array);
++		    (void)tabstop_set(p_vts, &buf->b_p_vts_array);
+ 		else
+ 		    buf->b_p_vts_array = NULL;
+ #endif
+@@ -5983,7 +5983,7 @@ buf_copy_options(buf_T *buf, int flags)
+ 		buf->b_p_vts = vim_strsave(p_vts);
+ 		COPY_OPT_SCTX(buf, BV_VTS);
+ 		if (p_vts && p_vts != empty_option && !buf->b_p_vts_array)
+-		    tabstop_set(p_vts, &buf->b_p_vts_array);
++		    (void)tabstop_set(p_vts, &buf->b_p_vts_array);
+ 		else
+ 		    buf->b_p_vts_array = NULL;
+ #endif
+@@ -6676,7 +6676,7 @@ paste_option_changed(void)
+ 	    if (buf->b_p_vsts_array)
+ 		vim_free(buf->b_p_vsts_array);
+ 	    if (buf->b_p_vsts && buf->b_p_vsts != empty_option)
+-		tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
++		(void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
+ 	    else
+ 		buf->b_p_vsts_array = 0;
+ #endif
+diff --git a/src/optionstr.c b/src/optionstr.c
+index 8f3f0c5..24657fd 100644
+--- a/src/optionstr.c
++++ b/src/optionstr.c
+@@ -2180,7 +2180,7 @@ did_set_string_option(
+ 	    if (errmsg == NULL)
+ 	    {
+ 		int *oldarray = curbuf->b_p_vsts_array;
+-		if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)))
++		if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)) == OK)
+ 		{
+ 		    if (oldarray)
+ 			vim_free(oldarray);
+@@ -2219,7 +2219,7 @@ did_set_string_option(
+ 	    {
+ 		int *oldarray = curbuf->b_p_vts_array;
+ 
+-		if (tabstop_set(*varp, &(curbuf->b_p_vts_array)))
++		if (tabstop_set(*varp, &(curbuf->b_p_vts_array)) == OK)
+ 		{
+ 		    vim_free(oldarray);
+ #ifdef FEAT_FOLDING
+diff --git a/src/testdir/test_retab.vim b/src/testdir/test_retab.vim
+index b792da5..c7190aa 100644
+--- a/src/testdir/test_retab.vim
++++ b/src/testdir/test_retab.vim
+@@ -75,6 +75,9 @@ endfunc
+ func Test_retab_error()
+   call assert_fails('retab -1',  'E487:')
+   call assert_fails('retab! -1', 'E487:')
++  call assert_fails('ret -1000', 'E487:')
++  call assert_fails('ret 10000', 'E475:')
++  call assert_fails('ret 80000000000000000000', 'E475:')
+ endfunc
+ 
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/version.c b/src/version.c
+index 8159289..c5617f6 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -5631,6 +5631,7 @@ static int included_patches[] =
+  */
+ static char *(extra_patches[]) =
+ {   /* Add your patch description below this line */
++    "8.2.3402",
+ /**/
+     NULL
+ };
diff -Nru vim-8.2.2434/debian/patches/upstream/patch-8.2.3403-memory-leak-for-retab-with-invalid-argumen.patch vim-8.2.2434/debian/patches/upstream/patch-8.2.3403-memory-leak-for-retab-with-invalid-argumen.patch
--- vim-8.2.2434/debian/patches/upstream/patch-8.2.3403-memory-leak-for-retab-with-invalid-argumen.patch	1969-12-31 19:00:00.000000000 -0500
+++ vim-8.2.2434/debian/patches/upstream/patch-8.2.3403-memory-leak-for-retab-with-invalid-argumen.patch	2021-09-30 21:51:08.000000000 -0400
@@ -0,0 +1,61 @@
+From: Bram Moolenaar <Bram@vim.org>
+Date: Sat, 4 Sep 2021 21:20:41 +0200
+Subject: patch 8.2.3403: memory leak for :retab with invalid argument
+
+Problem:    Memory leak for :retab with invalid argument.
+Solution:   Free the memory.  Make error messages consistent.
+---
+ src/indent.c  | 13 +++++++++++--
+ src/version.c |  1 +
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/src/indent.c b/src/indent.c
+index 9209a39..a43413c 100644
+--- a/src/indent.c
++++ b/src/indent.c
+@@ -70,9 +70,12 @@ tabstop_set(char_u *var, int **array)
+     {
+ 	int n = atoi((char *)cp);
+ 
++	// Catch negative values, overflow and ridiculous big values.
+ 	if (n < 0 || n > 9999)
+ 	{
+ 	    semsg(_(e_invarg2), cp);
++	    vim_free(*array);
++	    *array = NULL;
+ 	    return FAIL;
+ 	}
+ 	(*array)[t++] = n;
+@@ -1584,12 +1587,18 @@ ex_retab(exarg_T *eap)
+     else
+ 	new_ts_str = vim_strnsave(new_ts_str, eap->arg - new_ts_str);
+ #else
+-    new_ts = getdigits(&(eap->arg));
+-    if (new_ts < 0)
++    ptr = eap->arg;
++    new_ts = getdigits(&ptr);
++    if (new_ts < 0 && *eap->arg == '-')
+     {
+ 	emsg(_(e_positive));
+ 	return;
+     }
++    if (new_ts < 0 || new_ts > 9999)
++    {
++	semsg(_(e_invarg2), eap->arg);
++	return;
++    }
+     if (new_ts == 0)
+ 	new_ts = curbuf->b_p_ts;
+ #endif
+diff --git a/src/version.c b/src/version.c
+index c5617f6..c3c64d5 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -5632,6 +5632,7 @@ static int included_patches[] =
+ static char *(extra_patches[]) =
+ {   /* Add your patch description below this line */
+     "8.2.3402",
++    "8.2.3403",
+ /**/
+     NULL
+ };
diff -Nru vim-8.2.2434/debian/patches/upstream/patch-8.2.3409-reading-beyond-end-of-line-with-invalid-ut.patch vim-8.2.2434/debian/patches/upstream/patch-8.2.3409-reading-beyond-end-of-line-with-invalid-ut.patch
--- vim-8.2.2434/debian/patches/upstream/patch-8.2.3409-reading-beyond-end-of-line-with-invalid-ut.patch	1969-12-31 19:00:00.000000000 -0500
+++ vim-8.2.2434/debian/patches/upstream/patch-8.2.3409-reading-beyond-end-of-line-with-invalid-ut.patch	2021-09-30 21:51:08.000000000 -0400
@@ -0,0 +1,56 @@
+From: Bram Moolenaar <Bram@vim.org>
+Date: Tue, 7 Sep 2021 19:26:53 +0200
+Subject: patch 8.2.3409: reading beyond end of line with invalid utf-8
+ character
+
+Problem:    Reading beyond end of line with invalid utf-8 character.
+Solution:   Check for NUL when advancing.
+---
+ src/regexp_nfa.c                 | 3 ++-
+ src/testdir/test_regexp_utf8.vim | 8 ++++++++
+ src/version.c                    | 1 +
+ 3 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c
+index 064d90a..46604bd 100644
+--- a/src/regexp_nfa.c
++++ b/src/regexp_nfa.c
+@@ -5479,7 +5479,8 @@ find_match_text(colnr_T startcol, int regstart, char_u *match_text)
+ 		match = FALSE;
+ 		break;
+ 	    }
+-	    len2 += MB_CHAR2LEN(c2);
++	    len2 += enc_utf8 ? utf_ptr2len(rex.line + col + len2)
++							     : MB_CHAR2LEN(c2);
+ 	}
+ 	if (match
+ 		// check that no composing char follows
+diff --git a/src/testdir/test_regexp_utf8.vim b/src/testdir/test_regexp_utf8.vim
+index a7d1020..58386ac 100644
+--- a/src/testdir/test_regexp_utf8.vim
++++ b/src/testdir/test_regexp_utf8.vim
+@@ -558,4 +558,12 @@ func Test_match_char_class_upper()
+   bwipe!
+ endfunc
+ 
++func Test_match_invalid_byte()
++  call writefile(0z630a.765d30aa0a.2e0a.790a.4030, 'Xinvalid')
++  new
++  source Xinvalid
++  bwipe!
++  call delete('Xinvalid')
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/version.c b/src/version.c
+index c3c64d5..b34d74a 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -5633,6 +5633,7 @@ static char *(extra_patches[]) =
+ {   /* Add your patch description below this line */
+     "8.2.3402",
+     "8.2.3403",
++    "8.2.3409",
+ /**/
+     NULL
+ };
diff -Nru vim-8.2.2434/debian/patches/upstream/patch-8.2.3428-using-freed-memory-when-replacing.patch vim-8.2.2434/debian/patches/upstream/patch-8.2.3428-using-freed-memory-when-replacing.patch
--- vim-8.2.2434/debian/patches/upstream/patch-8.2.3428-using-freed-memory-when-replacing.patch	1969-12-31 19:00:00.000000000 -0500
+++ vim-8.2.2434/debian/patches/upstream/patch-8.2.3428-using-freed-memory-when-replacing.patch	2021-09-30 21:51:08.000000000 -0400
@@ -0,0 +1,76 @@
+From: Bram Moolenaar <Bram@vim.org>
+Date: Sat, 11 Sep 2021 21:14:20 +0200
+Subject: patch 8.2.3428: using freed memory when replacing
+
+Problem:    Using freed memory when replacing. (Dhiraj Mishra)
+Solution:   Get the line pointer after calling ins_copychar().
+---
+ src/normal.c              | 10 +++++++---
+ src/testdir/test_edit.vim | 12 ++++++++++++
+ src/version.c             |  1 +
+ 3 files changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/src/normal.c b/src/normal.c
+index 9fbfadf..150aa18 100644
+--- a/src/normal.c
++++ b/src/normal.c
+@@ -5074,19 +5074,23 @@ nv_replace(cmdarg_T *cap)
+ 	    {
+ 		/*
+ 		 * Get ptr again, because u_save and/or showmatch() will have
+-		 * released the line.  At the same time we let know that the
+-		 * line will be changed.
++		 * released the line.  This may also happen in ins_copychar().
++		 * At the same time we let know that the line will be changed.
+ 		 */
+-		ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
+ 		if (cap->nchar == Ctrl_E || cap->nchar == Ctrl_Y)
+ 		{
+ 		  int c = ins_copychar(curwin->w_cursor.lnum
+ 					   + (cap->nchar == Ctrl_Y ? -1 : 1));
++
++		  ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
+ 		  if (c != NUL)
+ 		    ptr[curwin->w_cursor.col] = c;
+ 		}
+ 		else
++		{
++		    ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
+ 		    ptr[curwin->w_cursor.col] = cap->nchar;
++		}
+ 		if (p_sm && msg_silent == 0)
+ 		    showmatch(cap->nchar);
+ 		++curwin->w_cursor.col;
+diff --git a/src/testdir/test_edit.vim b/src/testdir/test_edit.vim
+index de3e3a1..9602682 100644
+--- a/src/testdir/test_edit.vim
++++ b/src/testdir/test_edit.vim
+@@ -1839,4 +1839,16 @@ func Test_read_invalid()
+   set encoding=utf-8
+ endfunc
+ 
++" Test for getting the character of the line below after "p"
++func Test_edit_put_CTRL_E()
++  set encoding=latin1
++  new
++  let @" = ''
++  sil! norm orggRx
++  sil! norm pr
++  call assert_equal(['r', 'r'], getline(1, 2))
++  bwipe!
++  set encoding=utf-8
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/version.c b/src/version.c
+index b34d74a..ea55117 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -5634,6 +5634,7 @@ static char *(extra_patches[]) =
+     "8.2.3402",
+     "8.2.3403",
+     "8.2.3409",
++    "8.2.3428",
+ /**/
+     NULL
+ };
diff -Nru vim-8.2.2434/debian/vim-gtk.preinst vim-8.2.2434/debian/vim-gtk.preinst
--- vim-8.2.2434/debian/vim-gtk.preinst	1969-12-31 19:00:00.000000000 -0500
+++ vim-8.2.2434/debian/vim-gtk.preinst	2021-09-30 21:51:08.000000000 -0400
@@ -0,0 +1,27 @@
+#!/bin/sh
+set -e
+
+variant=gtk
+
+# remove /usr/bin/vim.variant as alternative for /usr/bin/vim
+
+remove_variant_alternative () {
+  for i in vi view ex editor rvim rview vimdiff vim; do
+    update-alternatives --remove $i /usr/bin/vim.$variant
+  done
+  remove_gui_variant_alternative
+}
+
+remove_gui_variant_alternative () {
+  for i in eview evim gview gvimdiff rgview rgvim gvim; do
+    update-alternatives --remove $i /usr/bin/vim.$variant
+  done
+}
+
+if [ "$1" = "upgrade" ]; then
+  remove_variant_alternative
+fi
+
+#DEBHELPER#
+
+exit 0
