Mercurial > vim
comparison src/spellsuggest.c @ 29536:6d93f09815c1 v9.0.0109
patch 9.0.0109: writing over the end of a buffer on stack
Commit: https://github.com/vim/vim/commit/1eead4cf1daf87ee41aeb4de3b3e38708417f9d5
Author: Bram Moolenaar <Bram@vim.org>
Date: Sat Jul 30 11:39:57 2022 +0100
patch 9.0.0109: writing over the end of a buffer on stack
Problem: Writing over the end of a buffer on stack when making list of
spell suggestions.
Solution: Make sure suggested word is not too long. (closes #10812)
author | Bram Moolenaar <Bram@vim.org> |
---|---|
date | Sat, 30 Jul 2022 12:45:02 +0200 |
parents | b8dc0a76911e |
children | c7983f593fa7 |
comparison
equal
deleted
inserted
replaced
29535:0dea4955e34b | 29536:6d93f09815c1 |
---|---|
590 msg_putchar('\n'); | 590 msg_putchar('\n'); |
591 | 591 |
592 msg_scroll = TRUE; | 592 msg_scroll = TRUE; |
593 for (i = 0; i < sug.su_ga.ga_len; ++i) | 593 for (i = 0; i < sug.su_ga.ga_len; ++i) |
594 { | 594 { |
595 int el; | |
596 | |
595 stp = &SUG(sug.su_ga, i); | 597 stp = &SUG(sug.su_ga, i); |
596 | 598 |
597 // The suggested word may replace only part of the bad word, add | 599 // The suggested word may replace only part of the bad word, add |
598 // the not replaced part. | 600 // the not replaced part. But only when it's not getting too long. |
599 vim_strncpy(wcopy, stp->st_word, MAXWLEN); | 601 vim_strncpy(wcopy, stp->st_word, MAXWLEN); |
600 if (sug.su_badlen > stp->st_orglen) | 602 el = sug.su_badlen - stp->st_orglen; |
603 if (el > 0 && stp->st_wordlen + el <= MAXWLEN) | |
601 vim_strncpy(wcopy + stp->st_wordlen, | 604 vim_strncpy(wcopy + stp->st_wordlen, |
602 sug.su_badptr + stp->st_orglen, | 605 sug.su_badptr + stp->st_orglen, el); |
603 sug.su_badlen - stp->st_orglen); | |
604 vim_snprintf((char *)IObuff, IOSIZE, "%2d", i + 1); | 606 vim_snprintf((char *)IObuff, IOSIZE, "%2d", i + 1); |
605 #ifdef FEAT_RIGHTLEFT | 607 #ifdef FEAT_RIGHTLEFT |
606 if (cmdmsg_rl) | 608 if (cmdmsg_rl) |
607 rl_mirror(IObuff); | 609 rl_mirror(IObuff); |
608 #endif | 610 #endif |