# HG changeset patch
# User Bram Moolenaar <Bram@vim.org>
# Date 1661634002 -7200
# Node ID ab2d83e147ca5f32fada66dcf5a3b69bfd033abf
# Parent  5387c6c0d6c8bde340142cbdfc16871ec924c746
patch 9.0.0289: invalid memory write

Commit: https://github.com/vim/vim/commit/beedd0a266cfe524fe2a851caec8316f2e37885c
Author: Bram Moolenaar <Bram@vim.org>
Date:   Sat Aug 27 21:52:52 2022 +0100

    patch 9.0.0289: invalid memory write

    Problem:    Invalid memory write.
    Solution:   Do not put NUL in a static string.

diff --git a/src/message.c b/src/message.c
--- a/src/message.c
+++ b/src/message.c
@@ -2237,20 +2237,41 @@ msg_puts_attr_len(char *str, int maxlen,
     static void
 put_msg_win(win_T *wp, int where, char_u *t_s, char_u *end, linenr_T lnum)
 {
-    int	    c = *end;
-
-    *end = NUL;
+    char_u  *p;
+
     if (where == PUT_BELOW)
-	ml_append_buf(wp->w_buffer, lnum, t_s, (colnr_T)0, FALSE);
+    {
+	if (*end != NUL)
+	{
+	    p = vim_strnsave(t_s, end - t_s);
+	    if (p == NULL)
+		return;
+	}
+	else
+	    p = t_s;
+	ml_append_buf(wp->w_buffer, lnum, p, (colnr_T)0, FALSE);
+	if (p != t_s)
+	    vim_free(p);
+    }
     else
     {
 	char_u *newp;
 
 	curbuf = wp->w_buffer;
 	if (where == PUT_APPEND)
+	{
 	    newp = concat_str(ml_get(lnum), t_s);
+	    if (newp == NULL)
+		return;
+	    if (*end != NUL)
+		newp[STRLEN(ml_get(lnum)) + (end - t_s)] = NUL;
+	}
 	else
+	{
 	    newp = vim_strnsave(t_s, end - t_s);
+	    if (newp == NULL)
+		return;
+	}
 	ml_replace(lnum, newp, FALSE);
 	curbuf = curwin->w_buffer;
     }
@@ -2258,8 +2279,6 @@ put_msg_win(win_T *wp, int where, char_u
 
     // set msg_col so that a newline is written if needed
     msg_col = STRLEN(t_s);
-
-    *end = c;
 }
 #endif
 
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -708,6 +708,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    289,
+/**/
     288,
 /**/
     287,