Commit: patch 9.2.0987: heap-buffer-overflow in spell_suggest()

patch 9.2.0987: heap-buffer-overflow in spell_suggest()

Commit: https://github.com/vim/vim/commit/6073903cda7b5838f3432b19a0e8293f494b4cd5
Author: Christian Brabandt <[email protected]>
Date:   Thu Aug 20 20:10:56 2026 +0000

    patch 9.2.0987: heap-buffer-overflow in spell_suggest()
    
    Problem:  Heap-buffer-overflow in spell_suggest() when the cursor is
              beyond the end of the line, because a SpellFileMissing
              autocommand changed the buffer (dvaave2025).
    Solution: parse_spelllang() may run autocommands, so validate the cursor
              position and re-take the saved position afterwards.
    
    fixes:  #21097
    closes: #21100
    
    Supported by AI.
    
    Signed-off-by: Christian Brabandt <[email protected]>

diff --git a/src/spellsuggest.c b/src/spellsuggest.c
index 866eedf31..ec3f1efc6 100644
--- a/src/spellsuggest.c
+++ b/src/spellsuggest.c
@@ -484,6 +484,9 @@ spell_suggest(int count)
 	parse_spelllang(curwin);
 	curwin->w_p_spell = TRUE;
     }
+    // Autocommands may have changed the buffer and made the cursor invalid
+    check_cursor();
+    prev_cursor = curwin->w_cursor;
 
     if (*curwin->w_s->b_p_spl == NUL)
     {
diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
index bd8185a09..c849df1dc 100644
--- a/src/testdir/test_spell.vim
+++ b/src/testdir/test_spell.vim
@@ -1613,4 +1613,23 @@ func Test_spelldump_prefixtree_overflow()
   bwipe!
 endfunc
 
+" This was using the cursor position from before a SpellFileMissing
+" autocommand made the line shorter.
+func Test_spell_file_missing_z_equal()
+  new
+  call setline(1, repeat('a', 40))
+  call cursor(1, 30)
+  set spelllang=xy
+  au SpellFileMissing * call setline(1, 'ab')
+
+  " The language cannot be loaded, so z= reports E756; the invalid cursor
+  " position was used before that error reached the script level.
+  silent! norm! z=
+  call assert_equal('ab', getline(1))
+
+  au! SpellFileMissing
+  set nospell spelllang=en
+  bwipe!
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index dab9b2df2..2242f7125 100644
--- a/src/version.c
+++ b/src/version.c
@@ -763,6 +763,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    987,
 /**/
     986,
 /**/

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups "vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/d/msgid/vim_dev/E1wx9Ol-00E30h-Ov%40256bit.org.