diff options
| author | Bram Moolenaar <Bram@vim.org> | 2020-07-10 20:03:03 +0200 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2020-07-10 20:03:03 +0200 |
| commit | 97d2f34c8763ab3a46c9f43284cc17bad3cf9568 (patch) | |
| tree | 1cb1f977901b0198046c501eb4b6b88b7ccb3d47 | |
| parent | 92053ce59ecf93838f4d6e3019eef1bc47be4184 (diff) | |
| download | vim-git-97d2f34c8763ab3a46c9f43284cc17bad3cf9568.tar.gz | |
patch 8.2.1169: write NUL past allocated space using corrupted spell filev8.2.1169
Problem: Write NUL past allocated space using corrupted spell file.
(Markus Vervier)
Solution: Init "c" every time.
| -rw-r--r-- | src/spellfile.c | 3 | ||||
| -rw-r--r-- | src/version.c | 2 |
2 files changed, 4 insertions, 1 deletions
diff --git a/src/spellfile.c b/src/spellfile.c index fc365e2a0..8a029dc71 100644 --- a/src/spellfile.c +++ b/src/spellfile.c @@ -993,7 +993,6 @@ read_sal_section(FILE *fd, slang_T *slang) salitem_T *smp; int ccnt; char_u *p; - int c = NUL; slang->sl_sofo = FALSE; @@ -1017,6 +1016,8 @@ read_sal_section(FILE *fd, slang_T *slang) // <sal> : <salfromlen> <salfrom> <saltolen> <salto> for (; gap->ga_len < cnt; ++gap->ga_len) { + int c = NUL; + smp = &((salitem_T *)gap->ga_data)[gap->ga_len]; ccnt = getc(fd); // <salfromlen> if (ccnt < 0) diff --git a/src/version.c b/src/version.c index 0b31e54b0..88bd908c6 100644 --- a/src/version.c +++ b/src/version.c @@ -755,6 +755,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 1169, +/**/ 1168, /**/ 1167, |