# HG changeset patch
# User Bram Moolenaar <Bram@vim.org>
# Date 1594404909 -7200
# Node ID 32f85b7d65044b004b3a7114652be727a6dfed8b
# Parent  68b1451b39d5c2ea997ac87429497753714e8437
patch 8.2.1169: write NUL past allocated space using corrupted spell file

Commit: https://github.com/vim/vim/commit/97d2f34c8763ab3a46c9f43284cc17bad3cf9568
Author: Bram Moolenaar <Bram@vim.org>
Date:   Fri Jul 10 20:03:03 2020 +0200

    patch 8.2.1169: write NUL past allocated space using corrupted spell file

    Problem:    Write NUL past allocated space using corrupted spell file.
                (Markus Vervier)
    Solution:   Init "c" every time.

diff --git a/src/spellfile.c b/src/spellfile.c
--- a/src/spellfile.c
+++ b/src/spellfile.c
@@ -993,7 +993,6 @@ read_sal_section(FILE *fd, slang_T *slan
     salitem_T	*smp;
     int		ccnt;
     char_u	*p;
-    int		c = NUL;
 
     slang->sl_sofo = FALSE;
 
@@ -1017,6 +1016,8 @@ read_sal_section(FILE *fd, slang_T *slan
     // <sal> : <salfromlen> <salfrom> <saltolen> <salto>
     for (; gap->ga_len < cnt; ++gap->ga_len)
     {
+	int	c = NUL;
+
 	smp = &((salitem_T *)gap->ga_data)[gap->ga_len];
 	ccnt = getc(fd);			// <salfromlen>
 	if (ccnt < 0)
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -755,6 +755,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    1169,
+/**/
     1168,
 /**/
     1167,