diff options
| author | Bram Moolenaar <Bram@vim.org> | 2013-11-21 17:42:31 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2013-11-21 17:42:31 +0100 |
| commit | ace8d8ee2f5d6ddd6d47272609c75155ce533f97 (patch) | |
| tree | 2d7927db652b4fe25f64a84cb01dd08cfd208edb | |
| parent | 438ee5bf603f3cee2c8ec924d081885c0086ba19 (diff) | |
updated for version 7.4.102v7.4.102
Problem: Crash when interrupting "z=".
Solution: Add safety check for word length. (Christian Brabandt, Dominique
Pelle)
| -rw-r--r-- | src/spell.c | 6 | ||||
| -rw-r--r-- | src/version.c | 2 |
2 files changed, 5 insertions, 3 deletions
diff --git a/src/spell.c b/src/spell.c index 6e0d986d7c..18a39570d8 100644 --- a/src/spell.c +++ b/src/spell.c @@ -13398,9 +13398,8 @@ add_sound_suggest(su, goodword, score, lp) /* Lookup the word "orgnr" one of the two tries. */ n = 0; - wlen = 0; wordcount = 0; - for (;;) + for (wlen = 0; wlen < MAXWLEN - 3; ++wlen) { i = 1; if (wordcount == orgnr && byts[n + 1] == NUL) @@ -13414,6 +13413,7 @@ add_sound_suggest(su, goodword, score, lp) if (i > byts[n]) /* safety check */ { STRCPY(theword + wlen, "BAD"); + wlen += 3; goto badword; } @@ -13426,7 +13426,7 @@ add_sound_suggest(su, goodword, score, lp) wordcount += wc; } - theword[wlen++] = byts[n + i]; + theword[wlen] = byts[n + i]; n = idxs[n + i]; } badword: diff --git a/src/version.c b/src/version.c index 47deb0c43e..4a0538707e 100644 --- a/src/version.c +++ b/src/version.c @@ -739,6 +739,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 102, +/**/ 101, /**/ 100, |