comparison src/spellsuggest.c @ 29536:6d93f09815c1 v9.0.0109

patch 9.0.0109: writing over the end of a buffer on stack Commit: https://github.com/vim/vim/commit/1eead4cf1daf87ee41aeb4de3b3e38708417f9d5 Author: Bram Moolenaar <Bram@vim.org> Date: Sat Jul 30 11:39:57 2022 +0100 patch 9.0.0109: writing over the end of a buffer on stack Problem: Writing over the end of a buffer on stack when making list of spell suggestions. Solution: Make sure suggested word is not too long. (closes #10812)
author Bram Moolenaar <Bram@vim.org>
date Sat, 30 Jul 2022 12:45:02 +0200
parents b8dc0a76911e
children c7983f593fa7
comparison
equal deleted inserted replaced
29535:0dea4955e34b 29536:6d93f09815c1
590 msg_putchar('\n'); 590 msg_putchar('\n');
591 591
592 msg_scroll = TRUE; 592 msg_scroll = TRUE;
593 for (i = 0; i < sug.su_ga.ga_len; ++i) 593 for (i = 0; i < sug.su_ga.ga_len; ++i)
594 { 594 {
595 int el;
596
595 stp = &SUG(sug.su_ga, i); 597 stp = &SUG(sug.su_ga, i);
596 598
597 // The suggested word may replace only part of the bad word, add 599 // The suggested word may replace only part of the bad word, add
598 // the not replaced part. 600 // the not replaced part. But only when it's not getting too long.
599 vim_strncpy(wcopy, stp->st_word, MAXWLEN); 601 vim_strncpy(wcopy, stp->st_word, MAXWLEN);
600 if (sug.su_badlen > stp->st_orglen) 602 el = sug.su_badlen - stp->st_orglen;
603 if (el > 0 && stp->st_wordlen + el <= MAXWLEN)
601 vim_strncpy(wcopy + stp->st_wordlen, 604 vim_strncpy(wcopy + stp->st_wordlen,
602 sug.su_badptr + stp->st_orglen, 605 sug.su_badptr + stp->st_orglen, el);
603 sug.su_badlen - stp->st_orglen);
604 vim_snprintf((char *)IObuff, IOSIZE, "%2d", i + 1); 606 vim_snprintf((char *)IObuff, IOSIZE, "%2d", i + 1);
605 #ifdef FEAT_RIGHTLEFT 607 #ifdef FEAT_RIGHTLEFT
606 if (cmdmsg_rl) 608 if (cmdmsg_rl)
607 rl_mirror(IObuff); 609 rl_mirror(IObuff);
608 #endif 610 #endif