patch 8.2.1169: write NUL past allocated space using corrupted spell file

Problem:    Write NUL past allocated space using corrupted spell file.
            (Markus Vervier)
Solution:   Init "c" every time.

diff --git a/src/spellfile.c b/src/spellfile.c
index fc365e2a03a78d5043f6a9f7fec6efde1bcffad3..8a029dc719409f7aa372a148ce4e3a2c423e9577 100644 (file)
--- a/src/spellfile.c
+++ b/src/spellfile.c
@@ -993,7 +993,6 @@ read_sal_section(FILE *fd, slang_T *slang)
     salitem_T  *smp;
     int                ccnt;
     char_u     *p;
-    int                c = NUL;
 
     slang->sl_sofo = FALSE;
 
@@ -1017,6 +1016,8 @@ read_sal_section(FILE *fd, slang_T *slang)
     // <sal> : <salfromlen> <salfrom> <saltolen> <salto>
     for (; gap->ga_len < cnt; ++gap->ga_len)
     {
+       int     c = NUL;
+
        smp = &((salitem_T *)gap->ga_data)[gap->ga_len];
        ccnt = getc(fd);                        // <salfromlen>
        if (ccnt < 0)

diff --git a/src/version.c b/src/version.c
index 0b31e54b0ab0433eed5889fd51736f8aab3e6248..88bd908c65fbd9747f7d174d168410ea42a2e7eb 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -754,6 +754,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1169,
 /**/
     1168,
 /**/