# HG changeset patch
# User Bram Moolenaar <Bram@vim.org>
# Date 1653304504 -7200
# Node ID 77cd4bf3ad7dc4bef0cc1e2d806d8620267060cf
# Parent  c0a54e5eeb3bef5a00479097c46572ab90fe2aa7
patch 8.2.5007: spell suggestion may use uninitialized memory

Commit: https://github.com/vim/vim/commit/6d24b4ff69913270ce1e5267dd6bd8454f75e2b9
Author: Bram Moolenaar <Bram@vim.org>
Date:   Mon May 23 12:01:50 2022 +0100

    patch 8.2.5007: spell suggestion may use uninitialized memory

    Problem:    Spell suggestion may use uninitialized memory. (Zdenek Dohnal)
    Solution:   Avoid going over the end of the word.

diff --git a/src/spellsuggest.c b/src/spellsuggest.c
--- a/src/spellsuggest.c
+++ b/src/spellsuggest.c
@@ -1953,7 +1953,8 @@ suggest_trie_walk(
 #endif
 		    ++depth;
 		    sp = &stack[depth];
-		    ++sp->ts_fidx;
+		    if (fword[sp->ts_fidx] != NUL)
+			++sp->ts_fidx;
 		    tword[sp->ts_twordlen++] = c;
 		    sp->ts_arridx = idxs[arridx];
 		    if (newscore == SCORE_SUBST)
diff --git a/src/testdir/test_spell_utf8.vim b/src/testdir/test_spell_utf8.vim
--- a/src/testdir/test_spell_utf8.vim
+++ b/src/testdir/test_spell_utf8.vim
@@ -629,7 +629,7 @@ func Test_spell_affix()
         \ ["bar", "barbork", "end", "fooa1", "fooa\u00E9", "nouend", "prebar", "prebarbork", "start"],
         \ [
         \   ["bad", ["bar", "end", "fooa1"]],
-        \   ["foo", ["fooa1", "fooa\u00E9", "bar"]],
+        \   ["foo", ["fooa1", "bar", "end"]],
         \   ["fooa2", ["fooa1", "fooa\u00E9", "bar"]],
         \   ["prabar", ["prebar", "bar", "bar bar"]],
         \   ["probarbirk", ["prebarbork"]],
@@ -647,7 +647,7 @@ func Test_spell_affix()
         \ ["bar", "barbork", "end", "lead", "meea1", "meea\u00E9", "prebar", "prebarbork"],
         \ [
         \   ["bad", ["bar", "end", "lead"]],
-        \   ["mee", ["meea1", "meea\u00E9", "bar"]],
+        \   ["mee", ["meea1", "bar", "end"]],
         \   ["meea2", ["meea1", "meea\u00E9", "lead"]],
         \   ["prabar", ["prebar", "bar", "leadbar"]],
         \   ["probarbirk", ["prebarbork"]],
@@ -664,7 +664,7 @@ func Test_spell_affix()
         \ ["bar", "barmeat", "lead", "meea1", "meea\u00E9", "meezero", "prebar", "prebarmeat", "tail"],
         \ [
         \   ["bad", ["bar", "lead", "tail"]],
-        \   ["mee", ["meea1", "meea\u00E9", "bar"]],
+        \   ["mee", ["meea1", "bar", "lead"]],
         \   ["meea2", ["meea1", "meea\u00E9", "lead"]],
         \   ["prabar", ["prebar", "bar", "leadbar"]],
         \   ["probarmaat", ["prebarmeat"]],
@@ -758,11 +758,15 @@ func Test_spell_sal_and_addition()
   set spl=Xtest_ca.utf-8.spl
   call assert_equal("elequint", FirstSpellWord())
   call assert_equal("elekwint", SecondSpellWord())
+
+  set spellfile=
+  set spl&
 endfunc
 
 func Test_spellfile_value()
   set spellfile=Xdir/Xtest.utf-8.add
   set spellfile=Xdir/Xtest.utf-8.add,Xtest_other.add
+  set spellfile=
 endfunc
 
 func Test_no_crash_with_weird_text()
@@ -785,5 +789,18 @@ func Test_check_for_valid_word()
   call assert_fails("spellgood! 0\xac", 'E1280:')
 endfunc
 
+" This was going over the end of the word
+func Test_word_index()
+  new
+  norm R0
+  spellgood! fl0
+  sil norm z=
+
+  bwipe!
+  " clear the word list
+  set enc=utf-8
+  call delete('Xtmpfile')
+endfunc
+
 
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -735,6 +735,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    5007,
+/**/
     5006,
 /**/
     5005,