# HG changeset patch
# User Bram Moolenaar <Bram@vim.org>
# Date 1659177902 -7200
# Node ID 6d93f09815c11b2e42500233fb26e18bc638bb85
# Parent  0dea4955e34ba8aa5e66424a4164bccd332de841
patch 9.0.0109: writing over the end of a buffer on stack

Commit: https://github.com/vim/vim/commit/1eead4cf1daf87ee41aeb4de3b3e38708417f9d5
Author: Bram Moolenaar <Bram@vim.org>
Date:   Sat Jul 30 11:39:57 2022 +0100

    patch 9.0.0109: writing over the end of a buffer on stack

    Problem:    Writing over the end of a buffer on stack when making list of
                spell suggestions.
    Solution:   Make sure suggested word is not too long. (closes #10812)

diff --git a/src/spellsuggest.c b/src/spellsuggest.c
--- a/src/spellsuggest.c
+++ b/src/spellsuggest.c
@@ -592,15 +592,17 @@ spell_suggest(int count)
 	msg_scroll = TRUE;
 	for (i = 0; i < sug.su_ga.ga_len; ++i)
 	{
+	    int el;
+
 	    stp = &SUG(sug.su_ga, i);
 
 	    // The suggested word may replace only part of the bad word, add
-	    // the not replaced part.
+	    // the not replaced part.  But only when it's not getting too long.
 	    vim_strncpy(wcopy, stp->st_word, MAXWLEN);
-	    if (sug.su_badlen > stp->st_orglen)
+	    el = sug.su_badlen - stp->st_orglen;
+	    if (el > 0 && stp->st_wordlen + el <= MAXWLEN)
 		vim_strncpy(wcopy + stp->st_wordlen,
-					       sug.su_badptr + stp->st_orglen,
-					      sug.su_badlen - stp->st_orglen);
+					   sug.su_badptr + stp->st_orglen, el);
 	    vim_snprintf((char *)IObuff, IOSIZE, "%2d", i + 1);
 #ifdef FEAT_RIGHTLEFT
 	    if (cmdmsg_rl)
diff --git a/src/testdir/test_spell_utf8.vim b/src/testdir/test_spell_utf8.vim
--- a/src/testdir/test_spell_utf8.vim
+++ b/src/testdir/test_spell_utf8.vim
@@ -819,5 +819,13 @@ func Test_check_empty_line()
   bwipe!
 endfunc
 
+func Test_spell_suggest_too_long()
+  " this was creating a word longer than MAXWLEN
+  new
+  call setline(1, 'a' .. repeat("\u0333", 150))
+  norm! z=
+  bwipe!
+endfunc
+
 
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -736,6 +736,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    109,
+/**/
     108,
 /**/
     107,