vim-patch:9.2.0331: spellfile: stack buffer overflows in spell file generation (#38948)

Problem:  spell_read_aff() uses sprintf() into a fixed-size stack buffer
          without bounds checking. store_aff_word() uses STRCAT() to
          append attacker-controlled strings into newword[MAXWLEN] without
          checking remaining space. Both are reachable via :mkspell with
          crafted .aff/.dic files (xinyi234)
Solution: Replace sprintf() with vim_snprintf() in spell_read_aff().
          Replace STRCAT() with STRNCAT() with explicit remaining-space
          calculation in store_aff_word().

closes: vim/vim#19944

https://github.com/vim/vim/commit/07faa961a05bc5ea007ab70ff483ea1b32c3371d

Co-authored-by: Christian Brabandt <cb@256bit.org>

0 files changed, 0 insertions, 0 deletions