# HG changeset patch
# User Bram Moolenaar <bram@vim.org>
# Date 1337357281 -7200
# Node ID b14842cf382bd3f99ca090c985609c6dead5f9e0
# Parent  290fb0dbe1814f5c3ec570a57b512394ce83d1e8
updated for version 7.3.521
Problem:    Using "z=" on a multi-byte character may cause a crash.
Solution:   Don't use strlen() on an int pointer.

diff --git a/src/spell.c b/src/spell.c
--- a/src/spell.c
+++ b/src/spell.c
@@ -14494,13 +14494,15 @@ spell_soundfold_wsal(slang, inword, res)
     int		p0 = -333;
     int		c0;
     int		did_white = FALSE;
+    int		wordlen;
+
 
     /*
      * Convert the multi-byte string to a wide-character string.
      * Remove accents, if wanted.  We actually remove all non-word characters.
      * But keep white space.
      */
-    n = 0;
+    wordlen = 0;
     for (s = inword; *s != NUL; )
     {
 	t = s;
@@ -14521,12 +14523,12 @@ spell_soundfold_wsal(slang, inword, res)
 		    continue;
 	    }
 	}
-	word[n++] = c;
-    }
-    word[n] = NUL;
+	word[wordlen++] = c;
+    }
+    word[wordlen] = NUL;
 
     /*
-     * This comes from Aspell phonet.cpp.
+     * This algorithm comes from Aspell phonet.cpp.
      * Converted from C++ to C.  Added support for multi-byte chars.
      * Changed to keep spaces.
      */
@@ -14711,7 +14713,7 @@ spell_soundfold_wsal(slang, inword, res)
 			    }
 			if (k > k0)
 			    mch_memmove(word + i + k0, word + i + k,
-				    sizeof(int) * (STRLEN(word + i + k) + 1));
+				    sizeof(int) * (wordlen - (i + k) + 1));
 
 			/* new "actual letter" */
 			c = word[i];
@@ -14739,7 +14741,7 @@ spell_soundfold_wsal(slang, inword, res)
 			    if (c != NUL)
 				wres[reslen++] = c;
 			    mch_memmove(word, word + i + 1,
-				    sizeof(int) * (STRLEN(word + i + 1) + 1));
+				       sizeof(int) * (wordlen - (i + 1) + 1));
 			    i = 0;
 			    z0 = 1;
 			}
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -715,6 +715,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    521,
+/**/
     520,
 /**/
     519,