diff --git a/c_ulimit.c b/c_ulimit.c
index b3169a2..b4f1999 100644
--- a/c_ulimit.c
+++ b/c_ulimit.c
@@ -1,11 +1,11 @@
-/*	$MirBSD: c_ulimit.c,v 1.2 2003/03/23 21:47:52 tg Exp $	*/
-/*	$OpenBSD: c_ulimit.c,v 1.9 2002/06/09 05:47:27 todd Exp $	*/
+/*	$MirBSD: c_ulimit.c,v 1.3 2003/12/23 13:41:48 tg Exp $	*/
+/*	$OpenBSD: c_ulimit.c,v 1.10 2003/10/22 07:40:38 jmc Exp $	*/
 
 /*
 	ulimit -- handle "ulimit" builtin
 
 	Reworked to use getrusage() and ulimit() at once (as needed on
-	some schizophenic systems, eg, HP-UX 9.01), made argument parsing
+	some schizophrenic systems, eg, HP-UX 9.01), made argument parsing
 	conform to at&t ksh, added autoconf support.  Michael Rendell, May, '94
 
 	Eric Gisin, September 1988
diff --git a/emacs.c b/emacs.c
index 55bac08..a9d2a48 100644
--- a/emacs.c
+++ b/emacs.c
@@ -1,5 +1,5 @@
-/*	$MirBSD: emacs.c,v 1.6 2003/09/25 20:59:35 tg Exp $	*/
-/*	$OpenBSD: emacs.c,v 1.27 2003/09/01 15:47:40 naddy Exp $	*/
+/*	$MirBSD: emacs.c,v 1.7 2003/12/23 13:41:48 tg Exp $	*/
+/*	$OpenBSD: emacs.c,v 1.28 2003/10/22 07:40:38 jmc Exp $	*/
 
 /*
  *  Emacs-like command line editing and history
@@ -213,7 +213,7 @@ static const struct x_ftab x_ftab[] = {
 	{ x_yank,		"yank",				0 },
         { x_comp_list,		"complete-list",		0 },
         { x_expand,		"expand-file",			0 },
-        { x_fold_capitialize,	"capitalize-word",		XF_ARG },
+        { x_fold_capitalize,	"capitalize-word",		XF_ARG },
         { x_fold_lower,		"downcase-word",		XF_ARG },
         { x_fold_upper,		"upcase-word",			XF_ARG },
         { x_set_arg,		"set-arg",			XF_NOBIND },
@@ -308,8 +308,8 @@ static	struct x_defbindings const x_defbindings[] = {
         { XFUNC_fold_upper,		1,	'u'  },
         { XFUNC_fold_lower,		1,	'L'  },
         { XFUNC_fold_lower,		1,	'l'  },
-        { XFUNC_fold_capitialize,	1,	'C'  },
-        { XFUNC_fold_capitialize,	1,	'c'  },
+        { XFUNC_fold_capitalize,	1,	'C'  },
+        { XFUNC_fold_capitalize,	1,	'c'  },
 #ifdef OS2
 	{ XFUNC_meta3,			0,	0xE0 },
 	{ XFUNC_mv_back,		3,	'K'  },
@@ -1136,7 +1136,7 @@ x_transpose(c)
 	 *     gnu emacs:		abCd	acbD   abcd_	abdc_
 	 * Pdksh currently goes with GNU behavior since I believe this is the
 	 * most common version of emacs, unless in gmacs mode, in which case
-	 * it does the at&t ksh gmacs mdoe.
+	 * it does the at&t ksh gmacs mode.
 	 * This should really be broken up into 3 functions so users can bind
 	 * to the one they want.
 	 */
@@ -2104,7 +2104,7 @@ x_fold_lower(c)
 
 /* Lowercase N(1) words */
 static int
-x_fold_capitialize(c)
+x_fold_capitalize(c)
   int c;
 {
 	return x_fold_case('C');
@@ -2133,7 +2133,7 @@ x_fold_case(c)
 	}
 	while (x_arg--) {
 		/*
-		 * fisrt skip over any white-space
+		 * first skip over any white-space
 		 */
 		while (cp != xep && is_mfs(*cp))
 			cp++;
@@ -2145,7 +2145,7 @@ x_fold_case(c)
 			if (c == 'L') {		/* lowercase */
 				if (isupper(*cp))
 					*cp = tolower(*cp);
-			} else {		/* uppercase, capitialize */
+			} else {		/* uppercase, capitalize */
 				if (islower(*cp))
 					*cp = toupper(*cp);
 			}
@@ -2158,7 +2158,7 @@ x_fold_case(c)
 			if (c == 'U') {		/* uppercase */
 				if (islower(*cp))
 					*cp = toupper(*cp);
-			} else {		/* lowercase, capitialize */
+			} else {		/* lowercase, capitalize */
 				if (isupper(*cp))
 					*cp = tolower(*cp);
 			}
diff --git a/ksh.1tbl b/ksh.1tbl
index 4a84cee..646129f 100644
--- a/ksh.1tbl
+++ b/ksh.1tbl
@@ -1,5 +1,5 @@
-.\"	$MirBSD: ksh.1tbl,v 1.10 2003/09/25 20:59:36 tg Exp $
-.\"	$OpenBSD: ksh.1tbl,v 1.58 2003/09/04 14:21:43 jmc Exp $
+.\"	$MirBSD: ksh.1tbl,v 1.11 2003/12/23 13:41:48 tg Exp $
+.\"	$OpenBSD: ksh.1tbl,v 1.62 2003/12/22 11:54:02 jmc Exp $
 .\"
 .\" Copyright (c) 1980, 1990, 1993
 .\"     The Regents of the University of California.  All rights reserved.
@@ -410,6 +410,19 @@ have equal precedence which is higher than that of
 and
 .Ql \&; ,
 which also have equal precedence.
+Note that the
+.Ql &&
+and
+.Ql ||
+operators are
+.Qq left-associative .
+For example, both of these commands will print only
+.Qq bar :
+.Bd -literal -offset indent
+false && echo foo || echo bar
+true || echo foo && echo bar
+.Ed
+.Pp
 The
 .Ql &
 token causes the preceding command to be executed asynchronously; that is,
@@ -1032,7 +1045,10 @@ Parameter substitutions take the form
 .Ic ${ Ns Ar name Ns Ic \&} ,
 or
 .Sm off
-.Ic ${ Ar name Oo Ar expr Oc Ic \&} ,
+.Xo
+.Ic ${ Ar name Oo Ar expr Oc
+.Ic \&} ,
+.Xc
 .Sm on
 where
 .Ar name
@@ -2474,7 +2490,10 @@ loop
 .It
 .Ic alias a='for ' i='j'
 .It
-.Ic a i in 1 2; do echo i=$i j=$j; done
+.Xo
+.Ic a i in 1 2; do echo i=$i j=$j;
+.Ic done
+.Xc
 .El
 .Pp
 uses parameter
@@ -2547,7 +2566,7 @@ Additional ksh special commands
 Very special commands
 .Pq Pf non- Tn POSIX
 .Pp
-.Ic alias , readonly , set , typset
+.Ic alias , readonly , set , typeset
 .Pp
 .Tn POSIX
 regular commands
@@ -5122,6 +5141,22 @@ deleted and a new prompt to be printed.
 .%D 1993
 .%O "ISBN 1-55937-266-9"
 .Re
+.Sh VERSION
+This page documents version @(#)PD KSH v5.2.14 99/07/13.2 of the public
+domain Korn shell.
+.Sh AUTHORS
+This shell is based on the public domain 7th edition Bourne shell clone by
+Charles Forsyth and parts of the BRL shell by Doug A. Gwyn, Doug Kingston,
+Ron Natalie, Arnold Robbins, Lou Salkind, and others.
+The first release of
+.Nm pdksh
+was created by Eric Gisin, and it was subsequently maintained by John R.
+MacMillan (change!john@sq.sq.com) and Simon J. Gerraty (sjg@zen.void.oz.au).
+The current maintainer is Michael Rendell (michael@cs.mun.ca).
+The
+.Pa CONTRIBUTORS
+file in the source distribution contains a more complete list of people and
+their part in the shell's development.
 .Sh BUGS
 Any bugs in
 .Nm pdksh
@@ -5154,19 +5189,3 @@ echo hi | read a; echo $a\ \ \ # Does not print hi
 .Ed
 .Pp
 I'm aware of this and there is no need to report it.
-.Sh VERSION
-This page documents version @(#)PD KSH v5.2.14 99/07/13.2 of the public
-domain Korn shell.
-.Sh AUTHORS
-This shell is based on the public domain 7th edition Bourne shell clone by
-Charles Forsyth and parts of the BRL shell by Doug A. Gwyn, Doug Kingston,
-Ron Natalie, Arnold Robbins, Lou Salkind, and others.
-The first release of
-.Nm pdksh
-was created by Eric Gisin, and it was subsequently maintained by John R.
-MacMillan (change!john@sq.sq.com) and Simon J. Gerraty (sjg@zen.void.oz.au).
-The current maintainer is Michael Rendell (michael@cs.mun.ca).
-The
-.Pa CONTRIBUTORS
-file in the source distribution contains a more complete list of people and
-their part in the shell's development.
diff --git a/misc.c b/misc.c
index e15f11f..6c735ce 100644
--- a/misc.c
+++ b/misc.c
@@ -1,5 +1,5 @@
-/*	$MirBSD: misc.c,v 1.4 2003/09/25 20:59:37 tg Exp $	*/
-/*	$OpenBSD: misc.c,v 1.19 2003/09/01 15:47:40 naddy Exp $	*/
+/*	$MirBSD: misc.c,v 1.5 2003/12/23 13:41:50 tg Exp $	*/
+/*	$OpenBSD: misc.c,v 1.20 2003/10/22 07:40:38 jmc Exp $	*/
 
 /*
  * Miscellaneous functions
@@ -184,7 +184,7 @@ const struct option options[] = {
 #endif
 	{ "xtrace",	'x',		OF_ANY },
 	/* Anonymous flags: used internally by shell only
-	 * (not visable to user)
+	 * (not visible to user)
 	 */
 	{ (char *) 0,	0,		OF_INTERNAL }, /* FTALKING_I */
 };
diff --git a/sh.h b/sh.h
index 7d07f22..c084bb0 100644
--- a/sh.h
+++ b/sh.h
@@ -1,5 +1,5 @@
-/*	$MirBSD: sh.h,v 1.5 2003/09/25 20:59:37 tg Exp $	*/
-/*	$OpenBSD: sh.h,v 1.14 2003/09/01 15:47:40 naddy Exp $	*/
+/*	$MirBSD: sh.h,v 1.6 2003/12/23 13:41:50 tg Exp $	*/
+/*	$OpenBSD: sh.h,v 1.15 2003/10/22 07:40:38 jmc Exp $	*/
 
 /*
  * Public Domain Bourne/Korn shell
@@ -483,7 +483,7 @@ enum sh_flag {
 #endif
 	FIGNOREEOF,	/* eof does not exit */
 	FTALKING,	/* -i: interactive */
-	FKEYWORD,	/* -k: name=value anywere */
+	FKEYWORD,	/* -k: name=value anywhere */
 	FLOGIN,		/* -l: a login shell */
 	FMARKDIRS,	/* mark dirs with / in file name completion */
 	FMONITOR,	/* -m: job control monitoring */
@@ -500,7 +500,7 @@ enum sh_flag {
 	FPOSIX,		/* -o posix: be posixly correct */
 	FPRIVILEGED,	/* -p: use suid_profile */
 	FRESTRICTED,	/* -r: restricted shell */
-	FSH,		/* -o sh: favor sh behavour */
+	FSH,		/* -o sh: favor sh behaviour */
 	FSTDIN,		/* -s: (invocation) parse stdin */
 	FTRACKALL,	/* -h: create tracked aliases for all commands */
 	FVERBOSE,	/* -v: echo input */
@@ -690,11 +690,11 @@ EXTERN char	*current_wd;
 EXTERN int	current_wd_size;
 
 #ifdef EDIT
-/* Minimium required space to work with on a line - if the prompt leaves less
+/* Minimum required space to work with on a line - if the prompt leaves less
  * space than this on a line, the prompt is truncated.
  */
 # define MIN_EDIT_SPACE	7
-/* Minimium allowed value for x_cols: 2 for prompt, 3 for " < " at end of line
+/* Minimum allowed value for x_cols: 2 for prompt, 3 for " < " at end of line
  */
 # define MIN_COLS	(2 + MIN_EDIT_SPACE + 3)
 EXTERN	int	x_cols I__(80);	/* tty columns */
diff --git a/vi.c b/vi.c
index f4cf894..038c8f6 100644
--- a/vi.c
+++ b/vi.c
@@ -1,5 +1,5 @@
-/*	$MirBSD: vi.c,v 1.2 2003/04/12 14:32:14 tg Exp $	*/
-/*	$OpenBSD: vi.c,v 1.11 2003/03/13 09:03:07 deraadt Exp $	*/
+/*	$MirBSD: vi.c,v 1.3 2003/12/23 13:41:51 tg Exp $	*/
+/*	$OpenBSD: vi.c,v 1.12 2003/10/16 22:08:48 millert Exp $	*/
 
 /*
  *	vi command editing
@@ -239,7 +239,7 @@ x_vi(buf, len)
 
 	x_putc('\r'); x_putc('\n'); x_flush();
 
-	if (c == -1)
+	if (c == -1 || len <= es->linelen)
 		return -1;
 
 	if (es->cbuf != buf)
@@ -463,15 +463,22 @@ vi_hook(ch)
 			else {
 				locpat[srchlen++] = ch;
 				if ((ch & 0x80) && Flag(FVISHOW8)) {
+					if (es->linelen + 2 > es->cbufsize)
+						vi_error();
 					es->cbuf[es->linelen++] = 'M';
 					es->cbuf[es->linelen++] = '-';
 					ch &= 0x7f;
 				}
 				if (ch < ' ' || ch == 0x7f) {
+					if (es->linelen + 2 > es->cbufsize)
+						vi_error();
 					es->cbuf[es->linelen++] = '^';
 					es->cbuf[es->linelen++] = ch ^ '@';
-				} else
+				} else {
+					if (es->linelen >= es->cbufsize)
+						vi_error();
 					es->cbuf[es->linelen++] = ch;
+				}
 				es->cursor = es->linelen;
 				refresh(0);
 			}
@@ -694,7 +701,7 @@ vi_insert(ch)
 	/* End nonstandard vi commands } */
 
 	default:
-		if (es->linelen == es->cbufsize - 1)
+		if (es->linelen >= es->cbufsize - 1)
 			return -1;
 		ibuf[inslen++] = ch;
 		if (insert == INSERT) {
@@ -1406,8 +1413,8 @@ save_edstate(old)
 
 	new = (struct edstate *)alloc(sizeof(struct edstate), APERM);
 	new->cbuf = alloc(old->cbufsize, APERM);
+	memcpy(new->cbuf, old->cbuf, old->linelen);
 	new->cbufsize = old->cbufsize;
-	strlcpy(new->cbuf, old->cbuf, new->cbufsize);
 	new->linelen = old->linelen;
 	new->cursor = old->cursor;
 	new->winleft = old->winleft;
@@ -1418,7 +1425,7 @@ static void
 restore_edstate(new, old)
 	struct edstate *old, *new;
 {
-	strncpy(new->cbuf, old->cbuf, old->linelen);
+	memcpy(new->cbuf, old->cbuf, old->linelen);
 	new->linelen = old->linelen;
 	new->cursor = old->cursor;
 	new->winleft = old->winleft;