!723 [sync] PR-720: fix some tests failed

From: @openeuler-sync-bot 
Reviewed-by: @dillon_chen 
Signed-off-by: @dillon_chen

backport-CVE-2025-1215.patch

@@ -0,0 +1,124 @@
+From c5654b84480822817bb7b69ebc97c174c91185e9 Mon Sep 17 00:00:00 2001
+From: Hirohito Higashi <h.east.727@gmail.com>
+Date: Mon, 10 Feb 2025 20:55:17 +0100
+Subject: [PATCH] patch 9.1.1097: --log with non-existent path causes a crash
+
+Problem:  --log with non-existent path causes a crash
+          (Ekkosun)
+Solution: split initialization phase and init the execution stack
+          earlier (Hirohito Higashi)
+
+fixes: #16606
+closes: #16610
+
+Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+---
+ src/main.c                   | 21 +++++++++++++++++----
+ src/message_test.c           |  3 ++-
+ src/proto/main.pro           |  3 ++-
+ src/testdir/test_startup.vim |  7 +++++++
+ 4 files changed, 28 insertions(+), 6 deletions(-)
+
+diff --git a/src/main.c b/src/main.c
+index ecc61f4d0be886..f603a52a52e09d 100644
+--- a/src/main.c
++++ b/src/main.c
+@@ -138,6 +138,11 @@ main
+     atexit(vim_mem_profile_dump);
+ #endif
+ 
++    /*
++     * Various initialisations #1 shared with tests.
++     */
++    common_init_1();
++
+ #if defined(STARTUPTIME) || defined(FEAT_JOB_CHANNEL)
+     // Need to find "--startuptime" and "--log" before actually parsing
+     // arguments.
+@@ -180,9 +185,9 @@ main
+ #endif
+ 
+     /*
+-     * Various initialisations shared with tests.
++     * Various initialisations #2 shared with tests.
+      */
+-    common_init(&params);
++    common_init_2(&params);
+ 
+ #ifdef VIMDLL
+     // Check if the current executable file is for the GUI subsystem.
+@@ -890,10 +895,10 @@ vim_main2(void)
+ }
+ 
+ /*
+- * Initialisation shared by main() and some tests.
++ * Initialisation #1 shared by main() and some tests.
+  */
+     void
+-common_init(mparm_T *paramp)
++common_init_1(void)
+ {
+     estack_init();
+     cmdline_init();
+@@ -915,7 +920,15 @@ common_init(mparm_T *paramp)
+ 	    || (NameBuff = alloc(MAXPATHL)) == NULL)
+ 	mch_exit(0);
+     TIME_MSG("Allocated generic buffers");
++}
++
+ 
++/*
++ * Initialisation #2 shared by main() and some tests.
++ */
++    void
++common_init_2(mparm_T *paramp)
++{
+ #ifdef NBDEBUG
+     // Wait a moment for debugging NetBeans.  Must be after allocating
+     // NameBuff.
+diff --git a/src/message_test.c b/src/message_test.c
+index 62f7772470d0e4..83767ece930899 100644
+--- a/src/message_test.c
++++ b/src/message_test.c
+@@ -312,7 +312,8 @@ main(int argc, char **argv)
+     CLEAR_FIELD(params);
+     params.argc = argc;
+     params.argv = argv;
+-    common_init(&params);
++    common_init_1();
++    common_init_2(&params);
+ 
+     set_option_value_give_err((char_u *)"encoding", 0, (char_u *)"utf-8", 0);
+     init_chartab();
+diff --git a/src/proto/main.pro b/src/proto/main.pro
+index 496fe66be6950d..7e4c50803e8ef2 100644
+--- a/src/proto/main.pro
++++ b/src/proto/main.pro
+@@ -1,6 +1,7 @@
+ /* main.c */
+ int vim_main2(void);
+-void common_init(mparm_T *paramp);
++void common_init_1(void);
++void common_init_2(mparm_T *paramp);
+ int is_not_a_term(void);
+ char_u *get_gui_dialog_file(void);
+ int op_pending(void);
+diff --git a/src/testdir/test_startup.vim b/src/testdir/test_startup.vim
+index 7c703916045e70..c16e4ae27de3b2 100644
+--- a/src/testdir/test_startup.vim
++++ b/src/testdir/test_startup.vim
+@@ -747,6 +747,13 @@ func Test_log()
+   call delete('Xlogfile')
+ endfunc
+ 
++func Test_log_nonexistent()
++  " this used to crash Vim
++  CheckFeature channel
++  let result = join(systemlist(GetVimCommand() .. ' --log /X/Xlogfile -c qa!'))
++  call assert_match("E484: Can't open file", result)
++endfunc
++
+ func Test_read_stdin()
+   let after =<< trim [CODE]
+     write Xtestout

backport-CVE-2025-22134.patch

@@ -0,0 +1,126 @@
+From c9a1e257f1630a0866447e53a564f7ff96a80ead Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Sat, 11 Jan 2025 15:25:00 +0100
+Subject: [PATCH] patch 9.1.1003: [security]: heap-buffer-overflow with visual
+ mode
+
+Problem:  [security]: heap-buffer-overflow with visual mode when
+          using :all, causing Vim trying to access beyond end-of-line
+          (gandalf)
+Solution: Reset visual mode on :all, validate position in gchar_pos()
+          and charwise_block_prep()
+
+This fixes CVE-2025-22134
+
+Github Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-5rgf-26wj-48v8
+
+Co-authored-by: zeertzjq <zeertzjq@outlook.com>
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+---
+ src/arglist.c               |  4 ++++
+ src/misc1.c                 |  4 ++++
+ src/testdir/test_visual.vim | 26 ++++++++++++++++++++++----
+ 3 files changed, 30 insertions(+), 4 deletions(-)
+
+diff --git a/src/arglist.c b/src/arglist.c
+index 8825c8e252ccc5..4eec079df438a3 100644
+--- a/src/arglist.c
++++ b/src/arglist.c
+@@ -979,6 +979,10 @@ do_arg_all(
+     need_mouse_correct = TRUE;
+ #endif
+ 
++    // Stop Visual mode, the cursor and "VIsual" may very well be invalid after
++    // switching to another buffer.
++    reset_VIsual_and_resel();
++
+     // Try closing all windows that are not in the argument list.
+     // Also close windows that are not full width;
+     // When 'hidden' or "forceit" set the buffer becomes hidden.
+diff --git a/src/misc1.c b/src/misc1.c
+index 90cf914742b115..142a6161ea6c8a 100644
+--- a/src/misc1.c
++++ b/src/misc1.c
+@@ -514,11 +514,15 @@ plines_m_win(win_T *wp, linenr_T first, linenr_T last)
+ gchar_pos(pos_T *pos)
+ {
+     char_u	*ptr;
++    int		ptrlen;
+ 
+     // When searching columns is sometimes put at the end of a line.
+     if (pos->col == MAXCOL)
+ 	return NUL;
++    ptrlen = STRLEN(ml_get(pos->lnum));
+     ptr = ml_get_pos(pos);
++    if (pos->col > ptrlen)
++	return NUL;
+     if (has_mbyte)
+ 	return (*mb_ptr2char)(ptr);
+     return (int)*ptr;
+diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
+index 0be73ecc1342b9..03335a464d62f3 100644
+--- a/src/testdir/test_visual.vim
++++ b/src/testdir/test_visual.vim
+@@ -469,7 +469,7 @@ func Test_Visual_Block()
+ 	      \ "\t{",
+ 	      \ "\t}"], getline(1, '$'))
+ 
+-  close!
++  bw!
+ endfunc
+ 
+ " Test for 'p'ut in visual block mode
+@@ -1079,7 +1079,7 @@ func Test_star_register()
+ 
+   delmarks < >
+   call assert_fails('*yank', 'E20:')
+-  close!
++  bw!
+ endfunc
+ 
+ " Test for changing text in visual mode with 'exclusive' selection
+@@ -1095,7 +1095,7 @@ func Test_exclusive_selection()
+   call assert_equal('l      one', getline(1))
+   set virtualedit&
+   set selection&
+-  close!
++  bw!
+ endfunc
+ 
+ " Test for starting linewise visual with a count.
+@@ -1152,7 +1152,7 @@ func Test_visual_inner_block()
+   8,9d
+   call cursor(5, 1)
+   call assert_beeps('normal ViBiB')
+-  close!
++  bw!
+ endfunc
+ 
+ func Test_visual_put_in_block()
+@@ -1513,4 +1513,22 @@ func Test_heap_buffer_overflow()
+   set updatecount&
+ endfunc
+ 
++" the following caused a Heap-Overflow, because Vim was accessing outside of a
++" line end
++func Test_visual_pos_buffer_heap_overflow()
++  set virtualedit=all
++  args Xa Xb
++  all
++  call setline(1, ['', '', ''])
++  call cursor(3, 1)
++  wincmd w
++  call setline(1, 'foobar')
++  normal! $lv0
++  all
++  call setreg('"', 'baz')
++  normal! [P
++  set virtualedit=
++  bw! Xa Xb
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+2.43.0
+

backport-CVE-2025-24014.patch

@@ -0,0 +1,42 @@
+From 9d1bed5eccdbb46a26b8a484f5e9163c40e63919 Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Mon, 20 Jan 2025 22:55:57 +0100
+Subject: [PATCH] patch 9.1.1043: [security]: segfault in win_line()
+
+Problem:  [security]: segfault in win_line()
+          (fizz-is-on-the-way)
+Solution: Check that ScreenLines is not NULL
+
+Github Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-j3g9-wg22-v955
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+---
+ src/gui.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/gui.c b/src/gui.c
+index 8e7b079a5a4ea4..86c40de632aa1e 100644
+--- a/src/gui.c
++++ b/src/gui.c
+@@ -4510,13 +4510,15 @@ gui_do_scroll(void)
+     /*
+      * Don't call updateWindow() when nothing has changed (it will overwrite
+      * the status line!).
++     *
++     * Check for ScreenLines, because in ex-mode, we don't have a valid display.
+      */
+-    if (old_topline != wp->w_topline
++    if (ScreenLines != NULL && (old_topline != wp->w_topline
+ 	    || wp->w_redr_type != 0
+ #ifdef FEAT_DIFF
+ 	    || old_topfill != wp->w_topfill
+ #endif
+-	    )
++	    ))
+     {
+ 	int type = VALID;
+ 
+-- 
+2.43.0
+

backport-CVE-2025-26603.patch

@@ -0,0 +1,62 @@
+From c0f0e2380e5954f4a52a131bf6b8499838ad1dae Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Sun, 16 Feb 2025 16:06:38 +0100
+Subject: [PATCH] patch 9.1.1115: [security]: use-after-free in str_to_reg()
+
+Problem:  [security]: use-after-free in str_to_reg()
+          (fizz-is-on-the-way)
+Solution: when redirecting the :display command, check that one
+          does not output to the register being displayed
+
+Github Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-63p5-mwg2-787v
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+---
+ src/register.c                 |  3 ++-
+ src/testdir/test_registers.vim | 20 ++++++++++++++++++++
+ 2 files changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/src/register.c b/src/register.c
+index 0df05054ca7229..a9630f8ef5db93 100644
+--- a/src/register.c
++++ b/src/register.c
+@@ -2394,7 +2394,8 @@ ex_display(exarg_T *eap)
+ 
+ #ifdef FEAT_EVAL
+ 	if (name == MB_TOLOWER(redir_reg)
+-		|| (redir_reg == '"' && yb == y_previous))
++		|| (vim_strchr((char_u *)"\"*+", redir_reg) != NULL &&
++		    (yb == y_previous || yb == &y_regs[0])))
+ 	    continue;	    // do not list register being written to, the
+ 			    // pointer can be freed
+ #endif
+diff --git a/src/testdir/test_registers.vim b/src/testdir/test_registers.vim
+index 1177c2395d3f09..13127022666e04 100644
+--- a/src/testdir/test_registers.vim
++++ b/src/testdir/test_registers.vim
+@@ -867,4 +867,24 @@ func Test_register_y_append_reset()
+   bwipe!
+ endfunc
+ 
++" This caused use-after-free
++func Test_register_redir_display()
++  " don't touch the clipboard, so only perform this, when the clipboard is not working
++  if has("clipboard_working")
++    throw "Skipped: skip touching the clipboard register!"
++  endif
++  let @"=''
++  redir @+>
++  disp +"
++  redir END
++  call assert_equal("\nType Name Content", getreg('+'))
++  let a = [getreg('1'), getregtype('1')]
++  let @1='register 1'
++  redir @+
++  disp 1
++  redir END
++  call assert_equal("register 1", getreg('1'))
++  call setreg(1, a[0], a[1])
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab

backport-CVE-2025-29768.patch

@@ -0,0 +1,44 @@
+From f209dcd3defb95bae21b2740910e6aa7bb940531 Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Wed, 12 Mar 2025 22:04:01 +0100
+Subject: [PATCH] patch 9.1.1198: [security]: potential data loss with zip.vim
+
+Problem:  [security]: potential data loss with zip.vim and special
+          crafted zip files (RyotaK)
+Solution: use glob '[-]' to protect filenames starting with '-'
+
+Github Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-693p-m996-3rmf
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+---
+ runtime/autoload/zip.vim | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/runtime/autoload/zip.vim b/runtime/autoload/zip.vim
+index 4a53fc5f28656..dae4ddeb9921e 100644
+--- a/runtime/autoload/zip.vim
++++ b/runtime/autoload/zip.vim
+@@ -8,6 +8,7 @@
+ " 2024 Aug 04 by Vim Project: escape '[' in name of file to be extracted
+ " 2024 Aug 05 by Vim Project: workaround for the FreeBSD's unzip
+ " 2024 Aug 18 by Vim Project: correctly handle special globbing chars
++" 2025 Mar 11 by Vim Project: handle filenames with leading '-' correctly
+ " License:	Vim License  (see vim's :help license)
+ " Copyright:    Copyright (C) 2005-2019 Charles E. Campbell {{{1
+ "               Permission is hereby granted to use and distribute this code,
+@@ -409,6 +410,11 @@ fun! zip#Extract()
+     return
+    endif
+    let target = fname->substitute('\[', '[[]', 'g')
++   " unzip 6.0 does not support -- to denote end-of-arguments
++   " unzip 6.1 (2010) apparently supports, it, but hasn't been released
++   " so the workaround is to use glob '[-]' so that it won't be considered an argument
++   " else, it would be possible to use 'unzip -o <file.zip> '-d/tmp' to extract the whole archive
++   let target = target->substitute('^-', '[&]', '')
+    if &shell =~ 'cmd' && (has("win32") || has("win64"))
+      let target = target
+  		\ ->substitute('[?*]', '[&]', 'g')
+-- 
+2.43.0
+

backport-patch-9.0.0313-using-common-name-in-tests-leads-to-flaky-tests.patch

@@ -0,0 +1,443 @@
+From e7cda97b6b578b33a42de0d27ac2876337c641ca Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Mon, 29 Aug 2022 11:02:59 +0100
+Subject: [PATCH] patch 9.0.0313: using common name in tests leads to flaky
+ tests
+
+Problem:    Using common name in tests leads to flaky tests.
+Solution:   Rename files and directories to be more specific.
+---
+ src/testdir/test_autochdir.vim |   8 +--
+ src/testdir/test_autocmd.vim   |  50 +++++++-------
+ src/testdir/test_backup.vim    |   6 +-
+ src/testdir/test_buffer.vim    | 116 ++++++++++++++++-----------------
+ 4 files changed, 90 insertions(+), 90 deletions(-)
+
+diff --git a/src/testdir/test_autochdir.vim b/src/testdir/test_autochdir.vim
+index 36b4695..332de8f 100644
+--- a/src/testdir/test_autochdir.vim
++++ b/src/testdir/test_autochdir.vim
+@@ -56,10 +56,10 @@ func Test_acd_win_execute()
+   set acd
+   call test_autochdir()
+ 
+-  call mkdir('Xfile')
++  call mkdir('XacdDir')
+   let winid = win_getid()
+-  new Xfile/file
+-  call assert_match('testdir.Xfile$', getcwd())
++  new XacdDir/file
++  call assert_match('testdir.XacdDir$', getcwd())
+   cd ..
+   call assert_match('testdir$', getcwd())
+   call win_execute(winid, 'echo')
+@@ -68,7 +68,7 @@ func Test_acd_win_execute()
+   bwipe!
+   set noacd
+   call chdir(cwd)
+-  call delete('Xfile', 'rf')
++  call delete('XacdDir', 'rf')
+ endfunc
+ 
+ func Test_verbose_pwd()
+diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
+index e251112..952b582 100644
+--- a/src/testdir/test_autocmd.vim
++++ b/src/testdir/test_autocmd.vim
+@@ -24,29 +24,29 @@ endfunc
+ " Test for the CursorHold autocmd
+ func Test_CursorHold_autocmd()
+   CheckRunVimInTerminal
+-  call writefile(['one', 'two', 'three'], 'Xfile')
++  call writefile(['one', 'two', 'three'], 'XoneTwoThree')
+   let before =<< trim END
+     set updatetime=10
+-    au CursorHold * call writefile([line('.')], 'Xoutput', 'a')
++    au CursorHold * call writefile([line('.')], 'XCHoutput', 'a')
+   END
+-  call writefile(before, 'Xinit')
+-  let buf = RunVimInTerminal('-S Xinit Xfile', {})
++  call writefile(before, 'XCHinit')
++  let buf = RunVimInTerminal('-S XCHinit XoneTwoThree', {})
+   call term_sendkeys(buf, "G")
+   call term_wait(buf, 50)
+   call term_sendkeys(buf, "gg")
+   call term_wait(buf)
+-  call WaitForAssert({-> assert_equal(['1'], readfile('Xoutput')[-1:-1])})
++  call WaitForAssert({-> assert_equal(['1'], readfile('XCHoutput')[-1:-1])})
+   call term_sendkeys(buf, "j")
+   call term_wait(buf)
+-  call WaitForAssert({-> assert_equal(['1', '2'], readfile('Xoutput')[-2:-1])})
++  call WaitForAssert({-> assert_equal(['1', '2'], readfile('XCHoutput')[-2:-1])})
+   call term_sendkeys(buf, "j")
+   call term_wait(buf)
+-  call WaitForAssert({-> assert_equal(['1', '2', '3'], readfile('Xoutput')[-3:-1])})
++  call WaitForAssert({-> assert_equal(['1', '2', '3'], readfile('XCHoutput')[-3:-1])})
+   call StopVimInTerminal(buf)
+ 
+-  call delete('Xinit')
+-  call delete('Xoutput')
+-  call delete('Xfile')
++  call delete('XCHinit')
++  call delete('XCHoutput')
++  call delete('XoneTwoThree')
+ endfunc
+ 
+ if has('timers')
+@@ -1447,21 +1447,21 @@ endfunc
+ 
+ " Test for Bufleave autocommand that deletes the buffer we are about to edit.
+ func Test_BufleaveWithDelete()
+-  new | edit Xfile1
++  new | edit XbufLeave1
+ 
+   augroup test_bufleavewithdelete
+       autocmd!
+-      autocmd BufLeave Xfile1 bwipe Xfile2
++      autocmd BufLeave XbufLeave1 bwipe XbufLeave2
+   augroup END
+ 
+-  call assert_fails('edit Xfile2', 'E143:')
+-  call assert_equal('Xfile1', bufname('%'))
++  call assert_fails('edit XbufLeave2', 'E143:')
++  call assert_equal('XbufLeave1', bufname('%'))
+ 
+-  autocmd! test_bufleavewithdelete BufLeave Xfile1
++  autocmd! test_bufleavewithdelete BufLeave XbufLeave1
+   augroup! test_bufleavewithdelete
+ 
+   new
+-  bwipe! Xfile1
++  bwipe! XbufLeave1
+ endfunc
+ 
+ " Test for autocommand that changes the buffer list, when doing ":ball".
+@@ -2893,13 +2893,13 @@ endfunc
+ func Test_BufReadPre_delfile()
+   augroup TestAuCmd
+     au!
+-    autocmd BufReadPre Xfile call delete('Xfile')
++    autocmd BufReadPre XbufreadPre call delete('XbufreadPre')
+   augroup END
+-  call writefile([], 'Xfile')
+-  call assert_fails('new Xfile', 'E200:')
+-  call assert_equal('Xfile', @%)
++  call writefile([], 'XbufreadPre')
++  call assert_fails('new XbufreadPre', 'E200:')
++  call assert_equal('XbufreadPre', @%)
+   call assert_equal(1, &readonly)
+-  call delete('Xfile')
++  call delete('XbufreadPre')
+   augroup TestAuCmd
+     au!
+   augroup END
+@@ -2910,13 +2910,13 @@ endfunc
+ func Test_BufReadPre_changebuf()
+   augroup TestAuCmd
+     au!
+-    autocmd BufReadPre Xfile edit Xsomeotherfile
++    autocmd BufReadPre Xchangebuf edit Xsomeotherfile
+   augroup END
+-  call writefile([], 'Xfile')
+-  call assert_fails('new Xfile', 'E201:')
++  call writefile([], 'Xchangebuf')
++  call assert_fails('new Xchangebuf', 'E201:')
+   call assert_equal('Xsomeotherfile', @%)
+   call assert_equal(1, &readonly)
+-  call delete('Xfile')
++  call delete('Xchangebuf')
+   augroup TestAuCmd
+     au!
+   augroup END
+diff --git a/src/testdir/test_backup.vim b/src/testdir/test_backup.vim
+index 4c7abe8..ee4b26f 100644
+--- a/src/testdir/test_backup.vim
++++ b/src/testdir/test_backup.vim
+@@ -78,11 +78,11 @@ endfunc
+ " Test for using a non-existing directory as a backup directory
+ func Test_non_existing_backupdir()
+   set backupdir=./non_existing_dir backupskip=
+-  call writefile(['line1'], 'Xfile')
+-  new Xfile
++  call writefile(['line1'], 'Xbackupdir')
++  new Xbackupdir
+   call assert_fails('write', 'E510:')
+   set backupdir&vim backupskip&vim
+-  call delete('Xfile')
++  call delete('Xbackupdir')
+ endfunc
+ 
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/testdir/test_buffer.vim b/src/testdir/test_buffer.vim
+index ce99c61..6eda0a6 100644
+--- a/src/testdir/test_buffer.vim
++++ b/src/testdir/test_buffer.vim
+@@ -76,14 +76,14 @@ func Test_buflist_browse()
+   %bwipe!
+   call assert_fails('buffer 1000', 'E86:')
+ 
+-  call writefile(['foo1', 'foo2', 'foo3', 'foo4'], 'Xfile1')
+-  call writefile(['bar1', 'bar2', 'bar3', 'bar4'], 'Xfile2')
+-  call writefile(['baz1', 'baz2', 'baz3', 'baz4'], 'Xfile3')
+-  edit Xfile1
++  call writefile(['foo1', 'foo2', 'foo3', 'foo4'], 'Xbrowse1')
++  call writefile(['bar1', 'bar2', 'bar3', 'bar4'], 'Xbrowse2')
++  call writefile(['baz1', 'baz2', 'baz3', 'baz4'], 'Xbrowse3')
++  edit Xbrowse1
+   let b1 = bufnr()
+-  edit Xfile2
++  edit Xbrowse2
+   let b2 = bufnr()
+-  edit +/baz4 Xfile3
++  edit +/baz4 Xbrowse3
+   let b3 = bufnr()
+ 
+   call assert_fails('buffer ' .. b1 .. ' abc', 'E488:')
+@@ -127,9 +127,9 @@ func Test_buflist_browse()
+ 
+   call assert_fails('sandbox bnext', 'E48:')
+ 
+-  call delete('Xfile1')
+-  call delete('Xfile2')
+-  call delete('Xfile3')
++  call delete('Xbrowse1')
++  call delete('Xbrowse2')
++  call delete('Xbrowse3')
+   %bwipe!
+ endfunc
+ 
+@@ -200,39 +200,39 @@ endfunc
+ " Test for quitting the 'swapfile exists' dialog with the split buffer
+ " command.
+ func Test_buffer_sbuf_cleanup()
+-  call writefile([], 'Xfile')
++  call writefile([], 'XsplitCleanup')
+   " first open the file in a buffer
+-  new Xfile
++  new XsplitCleanup
+   let bnr = bufnr()
+   close
+   " create the swap file
+-  call writefile([], '.Xfile.swp')
++  call writefile([], '.XsplitCleanup.swp')
+   " Remove the catch-all that runtest.vim adds
+   au! SwapExists
+   augroup BufTest
+     au!
+-    autocmd SwapExists Xfile let v:swapchoice='q'
++    autocmd SwapExists XsplitCleanup let v:swapchoice='q'
+   augroup END
+   exe 'sbuf ' . bnr
+   call assert_equal(1, winnr('$'))
+-  call assert_equal(0, getbufinfo('Xfile')[0].loaded)
++  call assert_equal(0, getbufinfo('XsplitCleanup')[0].loaded)
+ 
+   " test for :sball
+   sball
+   call assert_equal(1, winnr('$'))
+-  call assert_equal(0, getbufinfo('Xfile')[0].loaded)
++  call assert_equal(0, getbufinfo('XsplitCleanup')[0].loaded)
+ 
+   %bw!
+   set shortmess+=F
+   let v:statusmsg = ''
+-  edit Xfile
++  edit XsplitCleanup
+   call assert_equal('', v:statusmsg)
+   call assert_equal(1, winnr('$'))
+-  call assert_equal(0, getbufinfo('Xfile')[0].loaded)
++  call assert_equal(0, getbufinfo('XsplitCleanup')[0].loaded)
+   set shortmess&
+ 
+-  call delete('Xfile')
+-  call delete('.Xfile.swp')
++  call delete('XsplitCleanup')
++  call delete('.XsplitCleanup.swp')
+   augroup BufTest
+     au!
+   augroup END
+@@ -266,23 +266,23 @@ func Test_goto_buf_with_confirm()
+   " call do_browse(), which will try to use a GUI file browser,
+   " which aborts if a GUI is not available.
+   CheckNotFeature dialog_con_gui
+-  new Xfile
++  new XgotoConf
+   enew
+   call setline(1, 'test')
+-  call assert_fails('b Xfile', 'E37:')
++  call assert_fails('b XgotoConf', 'E37:')
+   call feedkeys('c', 'L')
+-  call assert_fails('confirm b Xfile', 'E37:')
++  call assert_fails('confirm b XgotoConf', 'E37:')
+   call assert_true(&modified)
+   call assert_true(empty(bufname('%')))
+   call feedkeys('y', 'L')
+   confirm b XgotoConf
+-  call assert_equal('Xfile', bufname('%'))
++  call assert_equal('XgotoConf', bufname('%'))
+   call assert_equal(['test'], readfile('Untitled'))
+   e Untitled
+   call setline(2, 'test2')
+   call feedkeys('n', 'L')
+-  confirm b Xfile
+-  call assert_equal('Xfile', bufname('%'))
++  confirm b XgotoConf
++  call assert_equal('XgotoConf', bufname('%'))
+   call assert_equal(['test'], readfile('Untitled'))
+   call delete('Untitled')
+   close!
+@@ -290,15 +290,15 @@ endfunc
+ 
+ " Test for splitting buffer with 'switchbuf'
+ func Test_buffer_switchbuf()
+-  new Xfile
++  new Xswitchbuf
+   wincmd w
+   set switchbuf=useopen
+-  sbuf Xfile
++  sbuf Xswitchbuf
+   call assert_equal(1, winnr())
+   call assert_equal(2, winnr('$'))
+   set switchbuf=usetab
+   tabnew
+-  sbuf Xfile
++  sbuf Xswitchbuf
+   call assert_equal(1, tabpagenr())
+   call assert_equal(2, tabpagenr('$'))
+   set switchbuf&
+@@ -310,11 +310,11 @@ func Test_bufadd_autocmd_bwipe()
+   %bw!
+   augroup BufAdd_Wipe
+     au!
+-    autocmd BufAdd Xfile %bw!
++    autocmd BufAdd Xbwipe %bw!
+   augroup END
+-  edit Xfile
++  edit Xbwipe
+   call assert_equal('', @%)
+-  call assert_equal(0, bufexists('Xfile'))
++  call assert_equal(0, bufexists('Xbwipe'))
+   augroup BufAdd_Wipe
+     au!
+   augroup END
+@@ -334,40 +334,40 @@ endfunc
+ " Test for using CTRL-^ to edit the alternative file keeping the cursor
+ " position with 'nostartofline'. Also test using the 'buf' command.
+ func Test_buffer_edit_altfile()
+-  call writefile(repeat(['one two'], 50), 'Xfile1')
+-  call writefile(repeat(['five six'], 50), 'Xfile2')
++  call writefile(repeat(['one two'], 50), 'Xaltfile1')
++  call writefile(repeat(['five six'], 50), 'Xaltfile2')
+   set nosol
+-  edit Xfile1
++  edit Xaltfile1
+   call cursor(25, 5)
+-  edit Xfile2
++  edit Xaltfile2
+   call cursor(30, 4)
+   exe "normal \<C-^>"
+   call assert_equal([0, 25, 5, 0], getpos('.'))
+   exe "normal \<C-^>"
+   call assert_equal([0, 30, 4, 0], getpos('.'))
+-  buf Xfile1
++  buf Xaltfile1
+   call assert_equal([0, 25, 5, 0], getpos('.'))
+-  buf Xfile2
++  buf Xaltfile2
+   call assert_equal([0, 30, 4, 0], getpos('.'))
+   set sol&
+-  call delete('Xfile1')
+-  call delete('Xfile2')
++  call delete('Xaltfile1')
++  call delete('Xaltfile2')
+ endfunc
+ 
+ " Test for running the :sball command with a maximum window count and a
+ " modified buffer
+ func Test_sball_with_count()
+   %bw!
+-  edit Xfile1
++  edit Xcountfile1
+   call setline(1, ['abc'])
+-  new Xfile2
+-  new Xfile3
+-  new Xfile4
++  new Xcountfile2
++  new Xcountfile3
++  new Xcountfile4
+   2sball
+-  call assert_equal(bufnr('Xfile4'), winbufnr(1))
+-  call assert_equal(bufnr('Xfile1'), winbufnr(2))
+-  call assert_equal(0, getbufinfo('Xfile2')[0].loaded)
+-  call assert_equal(0, getbufinfo('Xfile3')[0].loaded)
++  call assert_equal(bufnr('Xcountfile4'), winbufnr(1))
++  call assert_equal(bufnr('Xcountfile1'), winbufnr(2))
++  call assert_equal(0, getbufinfo('Xcountfile2')[0].loaded)
++  call assert_equal(0, getbufinfo('Xcountfile3')[0].loaded)
+   %bw!
+ endfunc
+ 
+@@ -460,18 +460,18 @@ endfunc
+ func Test_buflist_alloc_failure()
+   %bw!
+ 
+-  edit Xfile1
++  edit XallocFail1
+   call test_alloc_fail(GetAllocId('newbuf_bvars'), 0, 0)
+-  call assert_fails('edit Xfile2', 'E342:')
++  call assert_fails('edit XallocFail2', 'E342:')
+ 
+   " test for bufadd()
+   call test_alloc_fail(GetAllocId('newbuf_bvars'), 0, 0)
+   call assert_fails('call bufadd("Xbuffer")', 'E342:')
+ 
+   " test for setting the arglist
+-  edit Xfile2
++  edit XallocFail2
+   call test_alloc_fail(GetAllocId('newbuf_bvars'), 0, 0)
+-  call assert_fails('next Xfile3', 'E342:')
++  call assert_fails('next XallocFail3', 'E342:')
+ 
+   " test for setting the alternate buffer name when writing a file
+   call test_alloc_fail(GetAllocId('newbuf_bvars'), 0, 0)
+@@ -498,17 +498,17 @@ func Test_buflist_alloc_failure()
+   endif
+ 
+   " test for loading a new buffer after wiping out all the buffers
+-  edit Xfile4
++  edit XallocFail4
+   call test_alloc_fail(GetAllocId('newbuf_bvars'), 0, 0)
+   call assert_fails('%bw!', 'E342:')
+ 
+   " test for :checktime loading the buffer
+-  call writefile(['one'], 'Xfile5')
++  call writefile(['one'], 'XallocFail5')
+   if has('unix')
+-    edit Xfile5
++    edit XallocFail5
+     " sleep for some time to make sure the timestamp is different
+     sleep 200m
+-    call writefile(['two'], 'Xfile5')
++    call writefile(['two'], 'XallocFail5')
+     set autoread
+     call test_alloc_fail(GetAllocId('newbuf_bvars'), 0, 0)
+     call assert_fails('checktime', 'E342:')
+@@ -518,12 +518,12 @@ func Test_buflist_alloc_failure()
+ 
+   " test for :vimgrep loading a dummy buffer
+   call test_alloc_fail(GetAllocId('newbuf_bvars'), 0, 0)
+-  call assert_fails('vimgrep two Xfile5', 'E342:')
+-  call delete('Xfile5')
++  call assert_fails('vimgrep two XallocFail5', 'E342:')
++  call delete('XallocFail5')
+ 
+   " test for quickfix command loading a buffer
+   call test_alloc_fail(GetAllocId('newbuf_bvars'), 0, 0)
+-  call assert_fails('cexpr "Xfile6:10:Line10"', 'E342:')
++  call assert_fails('cexpr "XallocFail6:10:Line10"', 'E342:')
+ endfunc
+ 
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+2.33.0
+

backport-patch-9.1.0038-Unnecessary-loop-in-getvcol.patch

@@ -0,0 +1,93 @@
+From 4ea37f88e8345ca830271636a2e197a1a46114d2 Mon Sep 17 00:00:00 2001
+From: zeertzjq <zeertzjq@outlook.com>
+Date: Wed, 17 Jan 2024 20:52:13 +0100
+Subject: [PATCH] patch 9.1.0038: Unnecessary loop in getvcol()
+
+Problem:  Unnecessary loop in getvcol().
+Solution: Compare next char position with pos->col directly.
+          (zeertzjq)
+
+The loop below already handles end of line before checking for posptr,
+and the next char is after pos->col whether pos->col is at the start or
+in the middle of the char in question, so neither the NUL check nor the
+mb_head_off() are needed when comparing the position of the next char
+with pos->col directly.
+
+closes: #13878
+
+Signed-off-by: zeertzjq <zeertzjq@outlook.com>
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+---
+ src/charset.c | 29 ++++++-----------------------
+ 1 file changed, 6 insertions(+), 23 deletions(-)
+
+diff --git a/src/charset.c b/src/charset.c
+index 3ea2ecb8e216c2..eef2e8983c280e 100644
+--- a/src/charset.c
++++ b/src/charset.c
+@@ -1178,7 +1178,6 @@ getvcol(
+ {
+     colnr_T	vcol;
+     char_u	*ptr;		// points to current char
+-    char_u	*posptr;	// points to char at pos->col
+     char_u	*line;		// start of the line
+     int		incr;
+     int		head;
+@@ -1190,24 +1189,6 @@ getvcol(
+ 
+     vcol = 0;
+     line = ptr = ml_get_buf(wp->w_buffer, pos->lnum, FALSE);
+-    if (pos->col == MAXCOL)
+-	posptr = NULL;  // continue until the NUL
+-    else
+-    {
+-	colnr_T i;
+-
+-	// In a few cases the position can be beyond the end of the line.
+-	for (i = 0; i < pos->col; ++i)
+-	    if (ptr[i] == NUL)
+-	    {
+-		pos->col = i;
+-		break;
+-	    }
+-	posptr = ptr + pos->col;
+-	if (has_mbyte)
+-	    // always start on the first byte
+-	    posptr -= (*mb_head_off)(line, posptr);
+-    }
+ 
+     /*
+      * This function is used very often, do some speed optimizations.
+@@ -1263,11 +1244,12 @@ getvcol(
+ 		    incr = g_chartab[c] & CT_CELL_MASK;
+ 	    }
+ 
+-	    if (posptr != NULL && ptr >= posptr) // character at pos->col
++	    char_u *next_ptr = ptr + (*mb_ptr2len)(ptr);
++	    if (next_ptr - line > pos->col) // character at pos->col
+ 		break;
+ 
+ 	    vcol += incr;
+-	    MB_PTR_ADV(ptr);
++	    ptr = next_ptr;
+ 	}
+     }
+     else
+@@ -1284,11 +1266,12 @@ getvcol(
+ 		break;
+ 	    }
+ 
+-	    if (posptr != NULL && ptr >= posptr) // character at pos->col
++	    char_u *next_ptr = ptr + (*mb_ptr2len)(ptr);
++	    if (next_ptr - line > pos->col) // character at pos->col
+ 		break;
+ 
+ 	    vcol += incr;
+-	    MB_PTR_ADV(ptr);
++	    ptr = next_ptr;
+ 	}
+     }
+     if (start != NULL)
+-- 
+2.43.0
+

backport-patch-9.1.0671-crash-with-WinNewPre-autocommand.patch

@@ -0,0 +1,35 @@
+From fb3f9699362f8d51c3b48fcaea1eb2ed16c81454 Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Sun, 11 Aug 2024 20:09:17 +0200
+Subject: [PATCH] Problem:  crash with WinNewPre autocommand
+
+Problem:  crash with WinNewPre autocommand, because window
+          structures are not yet safe to use
+Solution: Don't trigger WinNewPre on :tabnew
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+---
+ src/testdir/test_autocmd.vim | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
+index e251112..3df3af1 100644
+--- a/src/testdir/test_autocmd.vim
++++ b/src/testdir/test_autocmd.vim
+@@ -14,6 +14,13 @@ func s:cleanup_buffers() abort
+   endfor
+ endfunc
+ 
++func CleanUpTestAuGroup()
++  augroup testing
++    au!
++  augroup END
++  augroup! testing
++endfunc
++
+ func Test_vim_did_enter()
+   call assert_false(v:vim_did_enter)
+ 
+-- 
+2.33.0
+

backport-patch-9.1.0918-tiny-vim-crashes-with-fuzzy-buffer-completion.patch

@@ -0,0 +1,103 @@
+From dff3c9c1a789351a741b6a430862c8b2a0eff383 Mon Sep 17 00:00:00 2001
+From: 826814741_6 <44406129+826814741-6@users.noreply.github.com>
+Date: Tue, 10 Dec 2024 17:15:14 +0100
+Subject: [PATCH] patch 9.1.0918: tiny Vim crashes with fuzzy buffer completion
+
+Problem:  tiny Vim crashes with fuzzy buffer completion
+Solution: Adjust #ifdefs in ExpandBufnames() (826814741_6)
+
+closes: #16200
+
+Signed-off-by: h-east <h.east.727@gmail.com>
+Signed-off-by: 826814741_6 <44406129+826814741-6@users.noreply.github.com>
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+---
+ src/buffer.c             |  4 ++--
+ src/testdir/Make_all.mak |  6 ++++--
+ src/testdir/test29.in    | 14 ++++++++++++++
+ src/testdir/test29.ok    |  1 +
+ 4 files changed, 21 insertions(+), 4 deletions(-)
+ create mode 100644 src/testdir/test29.in
+ create mode 100644 src/testdir/test29.ok
+
+diff --git a/src/buffer.c b/src/buffer.c
+index 3b05f25d7f705b..147d20dc78f0ff 100644
+--- a/src/buffer.c
++++ b/src/buffer.c
+@@ -2902,9 +2902,9 @@ ExpandBufnames(
+     if (!fuzzy && patc != pat)
+ 	vim_free(patc);
+ 
+-#ifdef FEAT_VIMINFO
+     if (!fuzzy)
+     {
++#ifdef FEAT_VIMINFO
+ 	if (matches != NULL)
+ 	{
+ 	    int i;
+@@ -2924,13 +2924,13 @@ ExpandBufnames(
+ 	    }
+ 	    vim_free(matches);
+ 	}
++#endif
+     }
+     else
+     {
+ 	if (fuzzymatches_to_strmatches(fuzmatch, file, count, FALSE) == FAIL)
+ 	    return FAIL;
+     }
+-#endif
+ 
+     *num_file = count;
+     return (count == 0 ? FAIL : OK);
+diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
+index bdf058c1ec43a1..7285354838805a 100644
+--- a/src/testdir/Make_all.mak
++++ b/src/testdir/Make_all.mak
+@@ -16,7 +16,8 @@ SCRIPTS_TINY = \
+ 	test24 \
+ 	test25 \
+ 	test26 \
+-	test27
++	test27 \
++	test29
+ 
+ SCRIPTS_TINY_OUT = \
+ 	test20.out \
+@@ -26,7 +27,8 @@ SCRIPTS_TINY_OUT = \
+ 	test24.out \
+ 	test25.out \
+ 	test26.out \
+-	test27.out
++	test27.out \
++	test29.out
+ 
+ # Tests for Vim9 script.
+ TEST_VIM9 = \
+diff --git a/src/testdir/test29.in b/src/testdir/test29.in
+new file mode 100644
+index 00000000000000..047803c60ff7bd
+--- /dev/null
++++ b/src/testdir/test29.in
+@@ -0,0 +1,14 @@
++Test for buffer name completion when 'wildoptions' contains "fuzzy"
++(Confirm that Vim does not crash)
++
++STARTTEST
++:set wildoptions=fuzzy
++:new buf_a
++:b buf_a
++:q!
++:set wildoptions&
++:$w! test.out
++:qa!
++ENDTEST
++
++I'm alive!
+diff --git a/src/testdir/test29.ok b/src/testdir/test29.ok
+new file mode 100644
+index 00000000000000..6a0a7c94510a8e
+--- /dev/null
++++ b/src/testdir/test29.ok
+@@ -0,0 +1 @@
++I'm alive!

backport-patch-9.1.1120-fix-Test_registers-fails.patch

@@ -0,0 +1,29 @@
+From 44c1c04ddb000bd03c6e8851dcdef07fd8c329ff Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Mon, 17 Feb 2025 22:26:00 +0100
+Subject: [PATCH] patch 9.1.1120: tests: Test_registers fails
+
+Problem:  tests: Test_registers fails
+          (T.J. Townsend, after v9.1.1115)
+Solution: require clipboard feature
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+---
+ src/testdir/test_registers.vim | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/testdir/test_registers.vim b/src/testdir/test_registers.vim
+index e0b9aa2..e748e8c 100644
+--- a/src/testdir/test_registers.vim
++++ b/src/testdir/test_registers.vim
+@@ -869,6 +869,7 @@ endfunc
+ 
+ " This caused use-after-free
+ func Test_register_redir_display()
++  CheckFeature clipboard
+   " don't touch the clipboard, so only perform this, when the clipboard is not working
+   if has("clipboard_working")
+     throw "Skipped: skip touching the clipboard register!"
+-- 
+2.33.0
+

backport-runtime-Fix-for-FreeBSD-unzip-command.patch

@@ -0,0 +1,64 @@
+From f0e9b72c8fdd47b9b410a11edf7479953cb2aed9 Mon Sep 17 00:00:00 2001
+From: Damien <141588647+xrandomname@users.noreply.github.com>
+Date: Mon, 5 Aug 2024 20:21:18 +0200
+Subject: [PATCH] runtime(zip): Fix for FreeBSD's unzip command
+
+Problem:  Cannot browse zipfiles with the unzip program found
+	  on FreeBSD.
+Solution: Adjust command arguments.
+
+Unzip found on FreeBSD complain about missing argument with the
+zipinfo modifier '-Z -1'. Joining arguments seems to work
+for both implementations.
+
+Also change `:sil!` to `:sil` so that error messages are properly
+reported (per review of Christian Brabandt).
+
+related: #15411
+
+Signed-off-by: Damien <141588647+xrandomname@users.noreply.github.com>
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+---
+ runtime/autoload/zip.vim | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/runtime/autoload/zip.vim b/runtime/autoload/zip.vim
+index e8973e3c80cc8a..8876ef08e60500 100644
+--- a/runtime/autoload/zip.vim
++++ b/runtime/autoload/zip.vim
+@@ -1,11 +1,12 @@
+ " zip.vim: Handles browsing zipfiles
+ "            AUTOLOAD PORTION
+-" Date:		Jul 23, 2024
++" Date:		Aug 05, 2024
+ " Version:	32
+ " Maintainer:	Charles E Campbell <NcampObell@SdrPchip.AorgM-NOSPAM>
+ " Last Change:
+ " 2024 Jul 23 by Vim Project: fix 'x' command
+ " 2024 Aug 04 by Vim Project: escape '[' in name of file to be extracted
++" 2024 Aug 05 by Vim Project: workaround for the FreeBSD's unzip
+ " License:	Vim License  (see vim's :help license)
+ " Copyright:    Copyright (C) 2005-2019 Charles E. Campbell {{{1
+ "               Permission is hereby granted to use and distribute this code,
+@@ -136,8 +137,7 @@ fun! zip#Browse(zipfile)
+  \                '" Select a file with cursor and press ENTER'])
+   keepj $
+ 
+-"  call Decho("exe silent r! ".g:zip_unzipcmd." -l -- ".s:Escape(a:zipfile,1))
+-  exe "keepj sil! r! ".g:zip_unzipcmd." -Z -1 -- ".s:Escape(a:zipfile,1)
++  exe $"keepj sil r! {g:zip_unzipcmd} -Z1 -- {s:Escape(a:zipfile, 1)}"
+   if v:shell_error != 0
+    redraw!
+    echohl WarningMsg | echo "***warning*** (zip#Browse) ".fnameescape(a:zipfile)." is not a zip file" | echohl None
+@@ -241,7 +241,7 @@ fun! zip#Read(fname,mode)
+   let temp = tempname()
+ "  call Decho("using temp file<".temp.">")
+   let fn   = expand('%:p')
+-  exe "sil! !".g:zip_unzipcmd." -p -- ".s:Escape(zipfile,1)." ".s:Escape(fnameescape(fname),1).' > '.temp
++  exe "sil !".g:zip_unzipcmd." -p -- ".s:Escape(zipfile,1)." ".s:Escape(fname,1).' > '.temp
+ "  call Decho("exe sil! !".g:zip_unzipcmd." -p -- ".s:Escape(zipfile,1)." ".s:Escape(fnameescape(fname),1).' > '.temp)
+   sil exe 'keepalt file '.temp
+   sil keepj e!
+-- 
+2.43.0
+

backport-runtime-correctly-extract-file-from-zip-browser.patch

@@ -0,0 +1,45 @@
+From 38ce71c1c323716cc4b130dbb3e8837a8b9a710b Mon Sep 17 00:00:00 2001
+From: Damien <141588647+xrandomname@users.noreply.github.com>
+Date: Tue, 23 Jul 2024 19:56:54 +0200
+Subject: [PATCH] runtime(zip): correctly extract file from zip browser
+
+Problem:  Enter 'x' in zip browser fail with E121
+Solution: Fix typo in zip#Extract()
+
+closes: #15321
+
+Signed-off-by: Damien <141588647+xrandomname@users.noreply.github.com>
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+---
+ runtime/autoload/zip.vim | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/runtime/autoload/zip.vim b/runtime/autoload/zip.vim
+index d0e706e83ac24..34bcad3368d13 100644
+--- a/runtime/autoload/zip.vim
++++ b/runtime/autoload/zip.vim
+@@ -1,8 +1,10 @@
+ " zip.vim: Handles browsing zipfiles
+ "            AUTOLOAD PORTION
+-" Date:		Nov 08, 2021
++" Date:		Jul 23, 2024
+ " Version:	32
+ " Maintainer:	Charles E Campbell <NcampObell@SdrPchip.AorgM-NOSPAM>
++" Last Change:
++" 2024 Jul 23 by Vim Project: fix 'x' command
+ " License:	Vim License  (see vim's :help license)
+ " Copyright:    Copyright (C) 2005-2019 Charles E. Campbell {{{1
+ "               Permission is hereby granted to use and distribute this code,
+@@ -396,8 +398,7 @@ fun! zip#Extract()
+   endif
+ 
+   " extract the file mentioned under the cursor
+-"  call Decho("system(".g:zip_extractcmd." ".shellescape(b:zipfile)." ".shellescape(shell).")")
+-  call system(g:zip_extractcmd." ".shellescape(b:zipfile)." ".shellescape(shell))
++  call system($"{g:zip_extractcmd} {shellescape(b:zipfile)} {shellescape(fname)}")
+ "  call Decho("zipfile<".b:zipfile.">")
+   if v:shell_error != 0
+    echohl Error | echo "***error*** ".g:zip_extractcmd." ".b:zipfile." ".fname.": failed!" | echohl NONE
+-- 
+2.43.0
+

backport-runtime-escape-on-Unix-as-well.patch

@@ -0,0 +1,57 @@
+From c5bdd66558b14f04424a22d9714a9b7d0c277dac Mon Sep 17 00:00:00 2001
+From: zeertzjq <zeertzjq@outlook.com>
+Date: Sun, 4 Aug 2024 18:35:50 +0200
+Subject: [PATCH] runtime(zip): escape '[' on Unix as well
+
+Problem:  After 6f1cbfc9ab483a09877e153ad130164875c40b1d fnameescape()
+          is no longer called on the name of the file to be extracted.
+          However, while spaces indeed don't need to be escaped, unzip
+          treats '[' as a wildcard character, so it need to be escaped.
+Solution: Escape '[' on both MS-Windows and Unix.
+
+From the docs it seems '*' and '?' also need escaping, but they seem to
+actually work without escaping.
+
+fixes: neovim/neovim#29977
+closes: #15427
+
+Signed-off-by: zeertzjq <zeertzjq@outlook.com>
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+---
+ runtime/autoload/zip.vim | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/runtime/autoload/zip.vim b/runtime/autoload/zip.vim
+index f77d729f036557..e8973e3c80cc8a 100644
+--- a/runtime/autoload/zip.vim
++++ b/runtime/autoload/zip.vim
+@@ -5,6 +5,7 @@
+ " Maintainer:	Charles E Campbell <NcampObell@SdrPchip.AorgM-NOSPAM>
+ " Last Change:
+ " 2024 Jul 23 by Vim Project: fix 'x' command
++" 2024 Aug 04 by Vim Project: escape '[' in name of file to be extracted
+ " License:	Vim License  (see vim's :help license)
+ " Copyright:    Copyright (C) 2005-2019 Charles E. Campbell {{{1
+ "               Permission is hereby granted to use and distribute this code,
+@@ -220,8 +221,8 @@ fun! zip#Read(fname,mode)
+   else
+    let zipfile = substitute(a:fname,'^.\{-}zipfile://\(.\{-}\)::[^\\].*$','\1','')
+    let fname   = substitute(a:fname,'^.\{-}zipfile://.\{-}::\([^\\].*\)$','\1','')
+-   let fname   = substitute(fname, '[', '[[]', 'g')
+   endif
++  let fname    = substitute(fname, '[', '[[]', 'g')
+ "  call Decho("zipfile<".zipfile.">")
+ "  call Decho("fname  <".fname.">")
+   " sanity check
+@@ -235,7 +236,7 @@ fun! zip#Read(fname,mode)
+   endif
+ 
+   " the following code does much the same thing as
+-  "   exe "keepj sil! r! ".g:zip_unzipcmd." -p -- ".s:Escape(zipfile,1)." ".s:Escape(fnameescape(fname),1)
++  "   exe "keepj sil! r! ".g:zip_unzipcmd." -p -- ".s:Escape(zipfile,1)." ".s:Escape(fname,1)
+   " but allows zipfile://... entries in quickfix lists
+   let temp = tempname()
+ "  call Decho("using temp file<".temp.">")
+-- 
+2.43.0
+

backport-runtime-zip-plugin-has-problems-with-special.patch

@@ -0,0 +1,100 @@
+From 7790ea0c680a9f951a86066e5940ec16b2333c9a Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Tue, 20 Aug 2024 22:41:52 +0200
+Subject: [PATCH] patch 9.1.0686: zip-plugin has problems with special
+ characters
+
+Problem:  zip-plugin has problems with special characters
+          (user202729)
+Solution: escape '*?[\' on Unix and handle those chars
+          a bit differently on MS-Windows, add a test, check
+          before overwriting files
+
+runtime(zip): small fixes for zip plugin
+
+This does the following:
+- verify the unzip plugin is executable when loading the autoload plugin
+- handle extracting file names with '[*?\' in its name correctly by
+  escaping those characters for the unzip command (and handle those
+  characters a bit differently on MS-Windows, since the quoting is different)
+- verify, that the extract plugin is not overwriting a file (could cause
+  a hang, because unzip asking for confirmation)
+- add a test zip file which contains those special file names
+
+fixes: #15505
+closes: #15519
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+---
+ runtime/autoload/zip.vim | 28 +++++++++++++++++++++++++---
+ 1 file changed, 25 insertions(+), 3 deletions(-)
+
+diff --git a/runtime/autoload/zip.vim b/runtime/autoload/zip.vim
+index 31fb32779f86d8..a7a7e579a2f319 100644
+--- a/runtime/autoload/zip.vim
++++ b/runtime/autoload/zip.vim
+@@ -1,12 +1,13 @@
+ " zip.vim: Handles browsing zipfiles
+ "            AUTOLOAD PORTION
+-" Date:		Aug 05, 2024
++" Date:		Aug 18, 2024
+ " Version:	32
+ " Maintainer:	Charles E Campbell <NcampObell@SdrPchip.AorgM-NOSPAM>
+ " Last Change:
+ " 2024 Jul 23 by Vim Project: fix 'x' command
+ " 2024 Aug 04 by Vim Project: escape '[' in name of file to be extracted
+ " 2024 Aug 05 by Vim Project: workaround for the FreeBSD's unzip
++" 2024 Aug 18 by Vim Project: correctly handle special globbing chars
+ " License:	Vim License  (see vim's :help license)
+ " Copyright:    Copyright (C) 2005-2019 Charles E. Campbell {{{1
+ "               Permission is hereby granted to use and distribute this code,
+@@ -61,6 +62,11 @@ if !exists("g:zip_extractcmd")
+  let g:zip_extractcmd= g:zip_unzipcmd
+ endif
+ 
++" sanity checks
++ if !executable(g:zip_unzipcmd)
++  echohl Error | echo "***error*** (zip#Browse) unzip not available on your system" | echohl None
++  finish
++ endif
+ if fnamemodify(exepath(g:zip_unzipcmd), ":p:h") ==# getcwd()
+  echoerr "Warning: NOT executing " .. g:zip_unzipcmd .. " from current directory!"
+  finish
+@@ -222,7 +228,7 @@ fun! zip#Read(fname,mode)
+    let zipfile = substitute(a:fname,'^.\{-}zipfile://\(.\{-}\)::[^\\].*$','\1','')
+    let fname   = substitute(a:fname,'^.\{-}zipfile://.\{-}::\([^\\].*\)$','\1','')
+   endif
+-  let fname    = substitute(fname, '[', '[[]', 'g')
++  let fname    = fname->substitute('[', '[[]', 'g')->escape('?*\\')
+ "  call Decho("zipfile<".zipfile.">")
+ "  call Decho("fname  <".fname.">")
+   " sanity check
+@@ -398,8 +404,24 @@ fun! zip#Extract()
+    return
+   endif
+ 
++  if filereadable(fname)
++    echohl Error | echo "***error*** (zip#Extract) <".fname."> already exists in directory, not overwriting!" | echohl None
++    return
++   endif
++   let target = fname->substitute('\[', '[[]', 'g')
++   if &shell =~ 'cmd' && (has("win32") || has("win64"))
++     let target = target
++ 		\ ->substitute('[?*]', '[&]', 'g')
++ 		\ ->substitute('[\\]', '?', 'g')
++ 		\ ->shellescape()
++     " there cannot be a file name with '\' in its name, unzip replaces it by _
++     let fname = fname->substitute('[\\?*]', '_', 'g')
++   else
++     let target = target->escape('*?\\')->shellescape()
++   endif
++
+   " extract the file mentioned under the cursor
+-  call system($"{g:zip_extractcmd} {shellescape(b:zipfile)} {shellescape(fname)}")
++  call system($"{g:zip_extractcmd} -o {shellescape(b:zipfile)} {target}")
+ "  call Decho("zipfile<".b:zipfile.">")
+   if v:shell_error != 0
+    echohl Error | echo "***error*** ".g:zip_extractcmd." ".b:zipfile." ".fname.": failed!" | echohl NONE
+-- 
+2.43.0
+

fix-autocmd_BufWinLeave_with_vsp-and-tag_stack.patch

@@ -0,0 +1,59 @@
+From 919addfdcd0ef3f7b662dc9e32beb1c4da3d77bf Mon Sep 17 00:00:00 2001
+From: wjiang <app@cameyan.com>
+Date: Thu, 3 Apr 2025 14:07:33 +0800
+Subject: [PATCH] fix Test_autocmd_BufWinLeave_with_vsp and Test_tag_stack
+
+---
+ src/testdir/test_autocmd.vim | 5 +++--
+ src/testdir/test_tagjump.vim | 5 ++---
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
+index cea5e41..580a14d 100644
+--- a/src/testdir/test_autocmd.vim
++++ b/src/testdir/test_autocmd.vim
+@@ -3647,8 +3647,6 @@ func Test_autocmd_BufWinLeave_with_vsp()
+   let dummy = 'XXXDummy.txt'
+   call writefile([], fname)
+   call writefile([], dummy)
+-  defer delete(fname)
+-  defer delete(dummy)
+   exe "e " fname
+   vsp
+   augroup testing
+@@ -3657,6 +3655,9 @@ func Test_autocmd_BufWinLeave_with_vsp()
+   bw
+   call CleanUpTestAuGroup()
+   exe "bw! " .. dummy
++
++  call delete(fname)
++  call delete(dummy)
+ endfunc
+ 
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/testdir/test_tagjump.vim b/src/testdir/test_tagjump.vim
+index 7de1926..b2d962f 100644
+--- a/src/testdir/test_tagjump.vim
++++ b/src/testdir/test_tagjump.vim
+@@ -994,9 +994,6 @@ func Test_tag_stack()
+   call settagstack(1, {'items' : []})
+   call assert_fails('pop', 'E73:')
+ 
+-  call delete('Xtags')
+-  call delete('Xfoo')
+-
+   " References to wiped buffer are deleted.
+   for i in range(10, 20)
+     edit Xtest
+@@ -1014,6 +1011,8 @@ func Test_tag_stack()
+   call assert_equal(0, t.length)
+   call assert_equal(1, t.curidx)
+ 
++  call delete('Xtags')
++  call delete('Xfoo')
+   set tags&
+   %bwipe
+ endfunc
+-- 
+2.33.0
+

vim.spec

@@ -12,7 +12,7 @@
 Name:           vim
 Epoch:          2
 Version:        9.0
-Release:        29
+Release:        34
 Summary:        Vim is a highly configurable text editor for efficiently creating and changing any kind of text.
 License:        Vim and MIT
 URL:            http://www.vim.org
@@ -127,10 +127,25 @@ Patch6097:      backport-CVE-2024-41957.patch
 Patch6098:      backport-CVE-2024-43374.patch
 Patch6099:      backport-CVE-2024-43802.patch
 Patch6100:      backport-patch-9.1.0730-crash-with-cursor-screenline-and-narrow-window.patch
+Patch6101:      backport-patch-9.1.0918-tiny-vim-crashes-with-fuzzy-buffer-completion.patch
+Patch6102:      backport-patch-9.1.0038-Unnecessary-loop-in-getvcol.patch
+Patch6103:      backport-CVE-2025-22134.patch
+Patch6104:      backport-CVE-2025-24014.patch
+Patch6105:      backport-CVE-2025-1215.patch
+Patch6106:      backport-CVE-2025-26603.patch
+Patch6107:      backport-runtime-correctly-extract-file-from-zip-browser.patch
+Patch6108:      backport-runtime-escape-on-Unix-as-well.patch
+Patch6109:      backport-runtime-Fix-for-FreeBSD-unzip-command.patch
+Patch6110:      backport-runtime-zip-plugin-has-problems-with-special.patch
+Patch6111:      backport-CVE-2025-29768.patch
+Patch6112:      backport-patch-9.0.0313-using-common-name-in-tests-leads-to-flaky-tests.patch
+Patch6113:      backport-patch-9.1.0671-crash-with-WinNewPre-autocommand.patch
+Patch6114:      backport-patch-9.1.1120-fix-Test_registers-fails.patch
 
 Patch9000:      bugfix-rm-modify-info-version.patch
 Patch9001:      vim-Add-sw64-architecture.patch
 Patch9002:      fix-CVE-2024-47814.patch
+Patch9003:      fix-autocmd_BufWinLeave_with_vsp-and-tag_stack.patch
 
 BuildRequires:  autoconf python3-devel ncurses-devel gettext perl-devel perl-generators gcc
 BuildRequires:  perl(ExtUtils::Embed) perl(ExtUtils::ParseXS) libacl-devel gpm-devel file
@@ -538,6 +553,36 @@ LANG=en_US.UTF-8 make -j1 test
 %{_mandir}/man1/evim.*
 
 %changelog
+* Thu Apr 03 2025 wangjiang <app@cameyan.com> - 2:9.0-34
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:fix some tests failed
+
+* Tue Mar 18 2025 wangjiang <app@cameyan.com> - 2:9.0-33
+- Type:CVE
+- ID:CVE-2025-29768
+- SUG:NA
+- DESC:fix CVE-2025-29768
+
+* Tue Feb 18 2025 wangjiang <app@cameyan.com> - 2:9.0-32
+- Type:CVE
+- ID:CVE-2025-1215 CVE-2025-26603
+- SUG:NA
+- DESC:fix CVE-2025-1215 CVE-2025-26603
+
+* Mon Jan 20 2025 wangjiang <app@cameyan.com> - 2:9.0-31
+- Type:CVE
+- ID:CVE-2025-22134 CVE-2025-24014
+- SUG:NA
+- DESC:CVE-2025-22134 CVE-2025-24014
+
+* Fri Dec 13 2024 wangjiang <app@cameyan.com> - 2:9.0-30
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:fix tiny-Vim crashes with fuzzy buffer completion
+
 * Tue Nov 12 2024 wangjiang <app@cameyan.com> - 2:9.0-29
 - Type:bugfix
 - ID:NA