From 0b15c019124965920c5f2df8c8ee75cd46311d27 Mon Sep 17 00:00:00 2001
From: zeertzjq <zeertzjq@outlook.com>
Date: Sat, 2 Jul 2022 06:32:24 +0800
Subject: [PATCH 1/3] vim-patch:9.0.0017: accessing memory beyond the end of
 the line

Problem:    Accessing memory beyond the end of the line.
Solution:   Stop Visual mode when closing a window.
https://github.com/vim/vim/commit/3d51ce18ab1be4f9f6061568a4e7fabf00b21794
---
 src/nvim/testdir/test_visual.vim | 12 ++++++++++++
 src/nvim/window.c                |  2 ++
 2 files changed, 14 insertions(+)

diff --git a/src/nvim/testdir/test_visual.vim b/src/nvim/testdir/test_visual.vim
index 41c29c5bb0..492750fa66 100644
--- a/src/nvim/testdir/test_visual.vim
+++ b/src/nvim/testdir/test_visual.vim
@@ -1431,5 +1431,17 @@ func Test_visual_paste_clipboard()
   bwipe!
 endfunc
 
+func Test_visual_area_adjusted_when_hiding()
+  " The Visual area ended after the end of the line after :hide
+  call setline(1, 'xxx')
+  vsplit Xfile
+  call setline(1, 'xxxxxxxx')
+  norm! $o
+  hid
+  norm! zW
+  bwipe!
+  bwipe!
+endfunc
+
 
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/nvim/window.c b/src/nvim/window.c
index 9ac027d80f..38597b8b77 100644
--- a/src/nvim/window.c
+++ b/src/nvim/window.c
@@ -2741,6 +2741,8 @@ int win_close(win_T *win, bool free_buf, bool force)
      * to be the last one left, return now.
      */
     if (wp->w_buffer != curbuf) {
+      reset_VIsual_and_resel();  // stop Visual mode
+
       other_buffer = true;
       win->w_closing = true;
       apply_autocmds(EVENT_BUFLEAVE, NULL, NULL, false, curbuf);

From 998a96803b32dada4da26d0dc7a636f99319f0e6 Mon Sep 17 00:00:00 2001
From: zeertzjq <zeertzjq@outlook.com>
Date: Sat, 2 Jul 2022 06:37:28 +0800
Subject: [PATCH 2/3] vim-patch:9.0.0021: invalid memory access when adding
 word to spell word list

Problem:    Invalid memory access when adding word with a control character to
            the internal spell word list.
Solution:   Disallow adding a word with control characters or a trailing
            slash.
https://github.com/vim/vim/commit/5e59ea54c0c37c2f84770f068d95280069828774
---
 src/nvim/spellfile.c            | 19 +++++++++++++++++--
 src/nvim/testdir/test_spell.vim | 15 +++++++++++++++
 2 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/src/nvim/spellfile.c b/src/nvim/spellfile.c
index 07f3d39886..423ed04176 100644
--- a/src/nvim/spellfile.c
+++ b/src/nvim/spellfile.c
@@ -3904,6 +3904,21 @@ static wordnode_T *wordtree_alloc(spellinfo_T *spin)
   return (wordnode_T *)getroom(spin, sizeof(wordnode_T), true);
 }
 
+/// Return true if "word" contains valid word characters.
+/// Control characters and trailing '/' are invalid.  Space is OK.
+static bool valid_spell_word(const char_u *word)
+{
+  if (!utf_valid_string(word, NULL)) {
+    return false;
+  }
+  for (const char_u *p = word; *p != NUL; p += utfc_ptr2len((const char *)p)) {
+    if (*p < ' ' || (p[0] == '/' && p[1] == NUL)) {
+      return false;
+    }
+  }
+  return true;
+}
+
 /// Store a word in the tree(s).
 /// Always store it in the case-folded tree.  For a keep-case word this is
 /// useful when the word can also be used with all caps (no WF_FIXCAP flag) and
@@ -3925,7 +3940,7 @@ static int store_word(spellinfo_T *spin, char_u *word, int flags, int region, co
   int res = OK;
 
   // Avoid adding illegal bytes to the word tree.
-  if (!utf_valid_string(word, NULL)) {
+  if (!valid_spell_word(word)) {
     return FAIL;
   }
 
@@ -5522,7 +5537,7 @@ void spell_add_word(char_u *word, int len, SpellAddType what, int idx, bool undo
   int i;
   char_u *spf;
 
-  if (!utf_valid_string(word, NULL)) {
+  if (!valid_spell_word(word)) {
     emsg(_(e_illegal_character_in_word));
     return;
   }
diff --git a/src/nvim/testdir/test_spell.vim b/src/nvim/testdir/test_spell.vim
index 215d4387d6..d0895a48b4 100644
--- a/src/nvim/testdir/test_spell.vim
+++ b/src/nvim/testdir/test_spell.vim
@@ -699,6 +699,21 @@ func Test_spellsuggest_too_deep()
   bwipe!
 endfunc
 
+func Test_spell_good_word_invalid()
+  " This was adding a word with a 0x02 byte, which causes havoc.
+  enew
+  norm o0
+  sil! norm rzzWs00/
+  2
+  sil! norm VzGprzzW
+  sil! norm z=
+
+  bwipe!
+  " clear the internal word list
+  " set enc=latin1
+  set enc=utf-8
+endfunc
+
 func LoadAffAndDic(aff_contents, dic_contents)
   throw 'skipped: Nvim does not support enc=latin1'
   set enc=latin1

From d358856a0c78d73f9d850df5f722c5572014e90c Mon Sep 17 00:00:00 2001
From: zeertzjq <zeertzjq@outlook.com>
Date: Sat, 2 Jul 2022 06:44:39 +0800
Subject: [PATCH 3/3] vim-patch:9.0.0022: spell test fails

Problem:    Spell test fails.
Solution:   Expect new error is given.
https://github.com/vim/vim/commit/95afae6d1760b2efcc4968dbd3784799d24e9fdf
---
 src/nvim/testdir/test_spell_utf8.vim | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/nvim/testdir/test_spell_utf8.vim b/src/nvim/testdir/test_spell_utf8.vim
index 3c07e0782b..3d240a8f2c 100644
--- a/src/nvim/testdir/test_spell_utf8.vim
+++ b/src/nvim/testdir/test_spell_utf8.vim
@@ -780,7 +780,12 @@ func Test_no_crash_with_weird_text()
       €
   END
   call setline(1, lines)
-  exe "%norm \<C-v>ez=>\<C-v>wzG"
+  try
+    exe "%norm \<C-v>ez=>\<C-v>wzG"
+  catch /E1280:/
+    let caught = 'yes'
+  endtry
+  call assert_equal('yes', caught)
 
   bwipe!
 endfunc