patch 8.2.5007: spell suggestion may use uninitialized memory

Problem:    Spell suggestion may use uninitialized memory. (Zdenek Dohnal)
Solution:   Avoid going over the end of the word.

diff --git a/src/spellsuggest.c b/src/spellsuggest.c
index 4a714388185e45bd95934757d3b0c1960d859240..5b460a3eaaef6f1c5d6ad57f0502b0ae6f54d7ea 100644 (file)
--- a/src/spellsuggest.c
+++ b/src/spellsuggest.c
@@ -1953,7 +1953,8 @@ suggest_trie_walk(
 #endif
                    ++depth;
                    sp = &stack[depth];
-                   ++sp->ts_fidx;
+                   if (fword[sp->ts_fidx] != NUL)
+                       ++sp->ts_fidx;
                    tword[sp->ts_twordlen++] = c;
                    sp->ts_arridx = idxs[arridx];
                    if (newscore == SCORE_SUBST)

diff --git a/src/testdir/test_spell_utf8.vim b/src/testdir/test_spell_utf8.vim
index 17fa23555818baad0819a0c455fd833c3e7dc3b4..ef08f953521c79cd2d63b96605c7698a4427f670 100644 (file)
--- a/src/testdir/test_spell_utf8.vim
+++ b/src/testdir/test_spell_utf8.vim
@@ -629,7 +629,7 @@ func Test_spell_affix()
         \ ["bar", "barbork", "end", "fooa1", "fooa\u00E9", "nouend", "prebar", "prebarbork", "start"],
         \ [
         \   ["bad", ["bar", "end", "fooa1"]],
-        \   ["foo", ["fooa1", "fooa\u00E9", "bar"]],
+        \   ["foo", ["fooa1", "bar", "end"]],
         \   ["fooa2", ["fooa1", "fooa\u00E9", "bar"]],
         \   ["prabar", ["prebar", "bar", "bar bar"]],
         \   ["probarbirk", ["prebarbork"]],
@@ -647,7 +647,7 @@ func Test_spell_affix()
         \ ["bar", "barbork", "end", "lead", "meea1", "meea\u00E9", "prebar", "prebarbork"],
         \ [
         \   ["bad", ["bar", "end", "lead"]],
-        \   ["mee", ["meea1", "meea\u00E9", "bar"]],
+        \   ["mee", ["meea1", "bar", "end"]],
         \   ["meea2", ["meea1", "meea\u00E9", "lead"]],
         \   ["prabar", ["prebar", "bar", "leadbar"]],
         \   ["probarbirk", ["prebarbork"]],
@@ -664,7 +664,7 @@ func Test_spell_affix()
         \ ["bar", "barmeat", "lead", "meea1", "meea\u00E9", "meezero", "prebar", "prebarmeat", "tail"],
         \ [
         \   ["bad", ["bar", "lead", "tail"]],
-        \   ["mee", ["meea1", "meea\u00E9", "bar"]],
+        \   ["mee", ["meea1", "bar", "lead"]],
         \   ["meea2", ["meea1", "meea\u00E9", "lead"]],
         \   ["prabar", ["prebar", "bar", "leadbar"]],
         \   ["probarmaat", ["prebarmeat"]],
@@ -758,11 +758,15 @@ func Test_spell_sal_and_addition()
   set spl=Xtest_ca.utf-8.spl
   call assert_equal("elequint", FirstSpellWord())
   call assert_equal("elekwint", SecondSpellWord())
+
+  set spellfile=
+  set spl&
 endfunc
 
 func Test_spellfile_value()
   set spellfile=Xdir/Xtest.utf-8.add
   set spellfile=Xdir/Xtest.utf-8.add,Xtest_other.add
+  set spellfile=
 endfunc
 
 func Test_no_crash_with_weird_text()
@@ -785,5 +789,18 @@ func Test_check_for_valid_word()
   call assert_fails("spellgood! 0\ 2\xac", 'E1280:')
 endfunc
 
+" This was going over the end of the word
+func Test_word_index()
+  new
+  norm R0
+  spellgood! fl0
+  sil norm z=
+
+  bwipe!
+  " clear the word list
+  set enc=utf-8
+  call delete('Xtmpfile')
+endfunc
+
 
 " vim: shiftwidth=2 sts=2 expandtab

diff --git a/src/version.c b/src/version.c
index 43390faa6d919f16a7ffd06041d703ae57a3c4d5..c652b312b37aace002481cf6931d4a9346eea91a 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -734,6 +734,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    5007,
 /**/
     5006,
 /**/