From: Bram Moolenaar <Bram@vim.org>
Date: Thu, 21 Nov 2013 16:42:31 +0000 (+0100)
Subject: updated for version 7.4.102
X-Git-Tag: v7.4.102
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ace8d8ee2f5d6ddd6d47272609c75155ce533f97;p=vim

updated for version 7.4.102
Problem:    Crash when interrupting "z=".
Solution:   Add safety check for word length. (Christian Brabandt, Dominique
            Pelle)
---

diff --git a/src/spell.c b/src/spell.c
index 6e0d986d7..18a39570d 100644
--- a/src/spell.c
+++ b/src/spell.c
@@ -13398,9 +13398,8 @@ add_sound_suggest(su, goodword, score, lp)
 
 	/* Lookup the word "orgnr" one of the two tries. */
 	n = 0;
-	wlen = 0;
 	wordcount = 0;
-	for (;;)
+	for (wlen = 0; wlen < MAXWLEN - 3; ++wlen)
 	{
 	    i = 1;
 	    if (wordcount == orgnr && byts[n + 1] == NUL)
@@ -13414,6 +13413,7 @@ add_sound_suggest(su, goodword, score, lp)
 		if (i > byts[n])	/* safety check */
 		{
 		    STRCPY(theword + wlen, "BAD");
+		    wlen += 3;
 		    goto badword;
 		}
 
@@ -13426,7 +13426,7 @@ add_sound_suggest(su, goodword, score, lp)
 		wordcount += wc;
 	    }
 
-	    theword[wlen++] = byts[n + i];
+	    theword[wlen] = byts[n + i];
 	    n = idxs[n + i];
 	}
 badword:
diff --git a/src/version.c b/src/version.c
index 47deb0c43..4a0538707 100644
--- a/src/version.c
+++ b/src/version.c
@@ -738,6 +738,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    102,
 /**/
     101,
 /**/