To: vim-dev@vim.org

Subject: Patch 7.1.251

Fcc: outbox

From: Bram Moolenaar <Bram@moolenaar.net>

Mime-Version: 1.0

Content-Type: text/plain; charset=ISO-8859-1

Content-Transfer-Encoding: 8bit

------------

Patch 7.1.251

Problem:    Using freed memory when spell checking enabled.

Solution:   Obtain the current line again after calling spell_move_to().

	    (Dominique Pelle)

Files:	    src/screen.c

*** ../vim-7.1.250/src/screen.c	Sat Jan 19 15:55:51 2008

--- src/screen.c	Wed Feb 13 21:45:38 2008

***************

*** 2644,2650 ****

  #if defined(FEAT_SIGNS) || (defined(FEAT_QUICKFIX) && defined(FEAT_WINDOWS)) \

  	|| defined(FEAT_SYN_HL) || defined(FEAT_DIFF)

  # define LINE_ATTR

!     int		line_attr = 0;		/* atrribute for the whole line */

  #endif

  #ifdef FEAT_SEARCH_EXTRA

      matchitem_T *cur;			/* points to the match list */

--- 2644,2650 ----

  #if defined(FEAT_SIGNS) || (defined(FEAT_QUICKFIX) && defined(FEAT_WINDOWS)) \

  	|| defined(FEAT_SYN_HL) || defined(FEAT_DIFF)

  # define LINE_ATTR

!     int		line_attr = 0;		/* attribute for the whole line */

  #endif

  #ifdef FEAT_SEARCH_EXTRA

      matchitem_T *cur;			/* points to the match list */

***************

*** 3040,3057 ****

  	if (has_spell)

  	{

  	    int		len;

  	    hlf_T	spell_hlf = HLF_COUNT;

  	    pos = wp->w_cursor;

  	    wp->w_cursor.lnum = lnum;

! 	    wp->w_cursor.col = (colnr_T)(ptr - line);

  	    len = spell_move_to(wp, FORWARD, TRUE, TRUE, &spell_hlf);

  	    if (len == 0 || (int)wp->w_cursor.col > ptr - line)

  	    {

  		/* no bad word found at line start, don't check until end of a

  		 * word */

  		spell_hlf = HLF_COUNT;

! 		word_end = (int)(spell_to_word_end(ptr, wp->w_buffer) - line + 1);

  	    }

  	    else

  	    {

--- 3040,3064 ----

  	if (has_spell)

  	{

  	    int		len;

+ 	    colnr_T	linecol = (colnr_T)(ptr - line);

  	    hlf_T	spell_hlf = HLF_COUNT;

  	    pos = wp->w_cursor;

  	    wp->w_cursor.lnum = lnum;

! 	    wp->w_cursor.col = linecol;

  	    len = spell_move_to(wp, FORWARD, TRUE, TRUE, &spell_hlf);

+ 

+ 	    /* spell_move_to() may call ml_get() and make "line" invalid */

+ 	    line = ml_get_buf(wp->w_buffer, lnum, FALSE);

+ 	    ptr = line + linecol;

+ 

  	    if (len == 0 || (int)wp->w_cursor.col > ptr - line)

  	    {

  		/* no bad word found at line start, don't check until end of a

  		 * word */

  		spell_hlf = HLF_COUNT;

! 		word_end = (int)(spell_to_word_end(ptr, wp->w_buffer)

! 								  - line + 1);

  	    }

  	    else

  	    {

*** ../vim-7.1.250/src/version.c	Wed Feb 13 18:35:23 2008

--- src/version.c	Wed Feb 13 21:48:08 2008

***************

*** 668,669 ****

--- 668,671 ----

  {   /* Add new patch number below this line */

+ /**/

+     251,

  /**/

-- 

How To Keep A Healthy Level Of Insanity:

6. In the memo field of all your checks, write "for sexual favors".

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\

///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\

\\\        download, build and distribute -- http://www.A-A-P.org        ///

 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///