fix crash with bracketed-paste-magic and undo

Resolves: rhbz#2484692

0011-zsh-memcpy-sigsegv-bracketed-paste.patch

@@ -0,0 +1,83 @@
+From b258cb7816323050d7e485171c92ad3f1046799e Mon Sep 17 00:00:00 2001
+From: Mikael Magnusson <mikachu@gmail.com>
+Date: Fri, 17 Jul 2026 22:53:21 +0200
+Subject: [PATCH] 54985: fix crash with bracketed-paste-magic and undo
+
+In particular, fc -P/-p didn't interact well with undo. Make sure we
+store/restore histline across those calls.
+
+(cherry-picked from commit 7708d466dfab8dd29f9ae5de12c74af37bf99a4d)
+---
+ Src/Zle/zle_main.c | 8 ++++++++
+ Src/hist.c         | 7 ++++++-
+ Src/zsh.h          | 3 ++-
+ 3 files changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/Src/Zle/zle_main.c b/Src/Zle/zle_main.c
+index 44ee63d..817e605 100644
+--- a/Src/Zle/zle_main.c
++++ b/Src/Zle/zle_main.c
+@@ -2168,6 +2168,14 @@ zle_main_entry(int cmd, va_list ap)
+ 	break;
+     }
+ 
++    case ZLE_CMD_GET_HIST_LINE:
++    {
++	zlong *p = va_arg(ap, zlong *);
++	*p = histline;
++
++	break;
++    }
++
+     default:
+ #ifdef DEBUG
+ 	    dputs("Bad command %d in zle_main_entry", cmd);
+diff --git a/Src/hist.c b/Src/hist.c
+index f58db23..85f329c 100644
+--- a/Src/hist.c
++++ b/Src/hist.c
+@@ -226,6 +226,7 @@ static struct histsave {
+     HashTable histtab;
+     Histent hist_ring;
+     zlong curhist;
++    zlong histline;
+     zlong histlinect;
+     zlong histsiz;
+     zlong savehistsiz;
+@@ -3846,6 +3847,10 @@ pushhiststack(char *hf, zlong hs, zlong shs, int level)
+     h->histsiz = histsiz;
+     h->savehistsiz = savehistsiz;
+     h->locallevel = level;
++    if (zleactive)
++	zleentry(ZLE_CMD_GET_HIST_LINE, &h->histline);
++    else
++	h->histline = 0;
+ 
+     memset(&lasthist, 0, sizeof lasthist);
+     if (hf) {
+@@ -3898,7 +3903,7 @@ pophiststack(void)
+     hist_ring = h->hist_ring;
+     curhist = h->curhist;
+     if (zleactive)
+-	zleentry(ZLE_CMD_SET_HIST_LINE, curhist);
++	zleentry(ZLE_CMD_SET_HIST_LINE, h->histline);
+     histlinect = h->histlinect;
+     histsiz = h->histsiz;
+     savehistsiz = h->savehistsiz;
+diff --git a/Src/zsh.h b/Src/zsh.h
+index 8fab0eb..32302ec 100644
+--- a/Src/zsh.h
++++ b/Src/zsh.h
+@@ -3244,7 +3244,8 @@ enum {
+     ZLE_CMD_REFRESH,
+     ZLE_CMD_SET_KEYMAP,
+     ZLE_CMD_GET_KEY,
+-    ZLE_CMD_SET_HIST_LINE
++    ZLE_CMD_SET_HIST_LINE,
++    ZLE_CMD_GET_HIST_LINE,
+ };
+ 
+ /***************************************/
+-- 
+2.55.0
+

0100-zsh-_IO_putc-SIGSEGV.patch

@@ -0,0 +1,25 @@
+diff --git a/Src/Zle/zle_tricky.c b/Src/Zle/zle_tricky.c
+index 8f32c68e3..bd4a67cee 100644
+--- a/Src/Zle/zle_tricky.c
++++ b/Src/Zle/zle_tricky.c
+@@ -2490,15 +2490,17 @@ printfmt(char *fmt, int n, int dopr, int doesc)
+ 			    p--;
+ 		    } else
+ 			atr = match_colour(NULL, is_fg, arg);
+-		    if (atr != TXT_ERROR)
++		    if (atr != TXT_ERROR && dopr)
+ 			set_colour_attribute(atr, is_fg ? COL_SEQ_FG :
+ 					     COL_SEQ_BG, 0);
+ 		    break;
+ 		case 'f':
+-		    set_colour_attribute(TXTNOFGCOLOUR, COL_SEQ_FG, 0);
++		    if (dopr)
++			set_colour_attribute(TXTNOFGCOLOUR, COL_SEQ_FG, 0);
+ 		    break;
+ 		case 'k':
+-		    set_colour_attribute(TXTNOBGCOLOUR, COL_SEQ_BG, 0);
++		    if (dopr)
++			set_colour_attribute(TXTNOBGCOLOUR, COL_SEQ_BG, 0);
+ 		    break;
+ 		case '{':
+ 		    if (arg)

zsh.spec

@@ -1,7 +1,7 @@
 Summary: Powerful interactive shell
 Name: zsh
 Version: 5.9
-Release: 18%{?dist}
+Release: 20%{?dist}
 License: MIT-Modern-Variant AND ISC AND GPL-2.0-only
 URL: http://zsh.sourceforge.net/
 Source0: https://downloads.sourceforge.net/%{name}/%{name}-%{version}.tar.xz
@@ -33,6 +33,13 @@ Patch8: 0008-zsh-deletefilelist-segfault.patch
 Patch9: 0009-zsh-support-dnf5.patch
 # upstream commit 071e325c826a89b792056c3faf0c400b8c0c5738
 Patch10: 0010-zsh-fix-dnf5-completion-with-rpm-files.patch
+# upstream commit 7708d466dfab8dd29f9ae5de12c74af37bf99a4d
+# fix crash with bracketed-paste-magic and undo (rhbz#2484692)
+Patch11: 0011-zsh-memcpy-sigsegv-bracketed-paste.patch
+
+# downstream patch for rhbz#2449939
+# already fixed upstream in a major refactor of term color attribute handling
+Patch100: 0100-zsh-_IO_putc-SIGSEGV.patch
 
 BuildRequires: autoconf
 BuildRequires: coreutils
@@ -178,6 +185,12 @@ fi
 %doc Doc/*.html
 
 %changelog
+* Wed Jul 22 2026 Lukáš Zaoral <lzaoral@redhat.com> - 5.9-20
+- fix crash with bracketed-paste-magic and undo (rhbz#2484692)
+
+* Tue Mar 24 2026 Lukáš Zaoral <lzaoral@redhat.com> - 5.9-19
+- fix segfault in _IO_putc (rhbz#2449939)
+
 * Mon Sep 29 2025 Christoph Erhardt <fedora@sicherha.de> - 5.9-18
 - Add completion support for dnf5