diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2026-08-18 09:03:37 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-08-18 09:03:37 +0800 |
| commit | bce3bf06a30afa309722b7d212b2e100a75b4425 (patch) | |
| tree | 867f00a3a2f75b8b47e7e402b70cf941f297d3ba /runtime/lua/vim | |
| parent | cc25b2f13cff2b743cefbc09c7330e28d10bc289 (diff) | |
| download | rneovim-bce3bf06a30afa309722b7d212b2e100a75b4425.tar.gz rneovim-bce3bf06a30afa309722b7d212b2e100a75b4425.tar.bz2 rneovim-bce3bf06a30afa309722b7d212b2e100a75b4425.zip | |
vim-patch:9.2.0963: crash when sound-folding a crafted spell file (#41358)
Problem: A SAL rule longer than MAXWLEN is silently truncated to an
empty lead. set_sal_first() then reorders the sl_sal entries
by their index byte and can move the terminating sentinel out
of the last slot, so spell_soundfold_wsal() reads past the end
of the array, e.g. when soundfold() or spellsuggest() is used
(Erick Alex).
Solution: Bound the sound-folding loops against sl_sal.ga_len.
closes: vim/vim#21076
https://github.com/vim/vim/commit/6ac008db969677304ba888854e5d44a32ce79853
Co-authored-by: Christian Brabandt <cb@256bit.org>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Diffstat (limited to 'runtime/lua/vim')
0 files changed, 0 insertions, 0 deletions