updated for version 7.4.102

Problem:    Crash when interrupting "z=".
Solution:   Add safety check for word length. (Christian Brabandt, Dominique
            Pelle)

diff --git a/src/spell.c b/src/spell.c
index 6e0d986d7c43d7818d8972693fc843014348ba2e..18a39570d80d84387c146b6d2cc69b5c5252f6d0 100644 (file)
--- a/src/spell.c
+++ b/src/spell.c
@@ -13398,9 +13398,8 @@ add_sound_suggest(su, goodword, score, lp)
 
        /* Lookup the word "orgnr" one of the two tries. */
        n = 0;
-       wlen = 0;
        wordcount = 0;
-       for (;;)
+       for (wlen = 0; wlen < MAXWLEN - 3; ++wlen)
        {
            i = 1;
            if (wordcount == orgnr && byts[n + 1] == NUL)
@@ -13414,6 +13413,7 @@ add_sound_suggest(su, goodword, score, lp)
                if (i > byts[n])        /* safety check */
                {
                    STRCPY(theword + wlen, "BAD");
+                   wlen += 3;
                    goto badword;
                }
 
@@ -13426,7 +13426,7 @@ add_sound_suggest(su, goodword, score, lp)
                wordcount += wc;
            }
 
-           theword[wlen++] = byts[n + i];
+           theword[wlen] = byts[n + i];
            n = idxs[n + i];
        }
 badword:

diff --git a/src/version.c b/src/version.c
index 47deb0c43ee52429b33113983f3125b023fe0d55..4a0538707ed83540091f0ffedb718a779d2cc6a4 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -738,6 +738,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    102,
 /**/
     101,
 /**/