patch 9.0.0035: spell dump may go beyond end of an array

Problem:    Spell dump may go beyond end of an array.
Solution:   Limit the word length.

diff --git a/src/spell.c b/src/spell.c
index d866a2df7265c126ff859f43ab854981cba7701e..24abce4625dd392f971e6581cb326dc4267e9786 100644 (file)
--- a/src/spell.c
+++ b/src/spell.c
@@ -3996,9 +3996,10 @@ spell_dump_compl(
                    n = arridx[depth] + curi[depth];
                    ++curi[depth];
                    c = byts[n];
-                   if (c == 0)
+                   if (c == 0 || depth >= MAXWLEN - 1)
                    {
-                       // End of word, deal with the word.
+                       // End of word or reached maximum length, deal with the
+                       // word.
                        // Don't use keep-case words in the fold-case tree,
                        // they will appear in the keep-case tree.
                        // Only use the word when the region matches.

diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
index d3f56d8d1498f206909cd33f9e548234335c0d4a..a291eb5c7a4d62363a9ad5ef4e14ad42a99c4f59 100644 (file)
--- a/src/testdir/test_spell.vim
+++ b/src/testdir/test_spell.vim
@@ -285,6 +285,18 @@ func Test_spellreall()
   bwipe!
 endfunc
 
+func Test_spell_dump_word_length()
+  " this was running over MAXWLEN
+  new
+  noremap 0 0a0zW0000000
+  sil! norm \160z=0\18\v
+  sil norm 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  sil! norm \160z=0\18\v
+
+  bwipe!
+  nunmap 0
+endfunc
+
 " Test spellsuggest({word} [, {max} [, {capital}]])
 func Test_spellsuggest()
   " Verify suggestions are given even when spell checking is not enabled.

diff --git a/src/version.c b/src/version.c
index 180a4cf8c97742f8c1c58c70d04a76cb1080d8cc..e22fb5673cec7847b3f3a336d3ad126862d287e2 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -735,6 +735,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    35,
 /**/
     34,
 /**/