[vim/vim] patch 9.2.XXXX: crash when sound-folding a crafted spell file (PR #21076)

Problem:  A SAL rule longer than MAXWLEN is silently truncated to an
          empty lead.  set_sal_first() then reorders the sl_sal entries
          by their index byte and can move the terminating sentinel out
          of the last slot, so spell_soundfold_wsal() reads past the end
          of the array, e.g. when soundfold() or spellsuggest() is used
          (Erick Alex).
Solution: Bound the sound-folding loops against sl_sal.ga_len.

closes: #PR
You can view, comment on, or merge this pull request online at:

  https://github.com/vim/vim/pull/21076

-- Commit Summary --

  * patch 9.2.XXXX: crash when sound-folding a crafted spell file

-- File Changes --

    M src/spell.c (5)
    M src/testdir/test_spell_utf8.vim (13)

-- Patch Links --

https://github.com/vim/vim/pull/21076.patch
https://github.com/vim/vim/pull/21076.diff

-- 
Reply to this email directly or view it on GitHub:
https://github.com/vim/vim/pull/21076
You are receiving this because you are subscribed to this thread.

Message ID: <vim/vim/pull/[email protected]>

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups "vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/d/msgid/vim_dev/vim/vim/pull/21076%40github.com.