Blame SOURCES/0001-patch-8.2.4247-stack-corruption-when-looking-for-spe.patch

13ea7f
diff --git a/src/spellsuggest.c b/src/spellsuggest.c
13ea7f
index 3de9ff2..5462583 100644
13ea7f
--- a/src/spellsuggest.c
13ea7f
+++ b/src/spellsuggest.c
13ea7f
@@ -1200,7 +1200,7 @@ suggest_try_change(suginfo_T *su)
13ea7f
 
13ea7f
 // Check the maximum score, if we go over it we won't try this change.
13ea7f
 #define TRY_DEEPER(su, stack, depth, add) \
13ea7f
-		(stack[depth].ts_score + (add) < su->su_maxscore)
13ea7f
+       (depth < MAXWLEN - 1 && stack[depth].ts_score + (add) < su->su_maxscore)
13ea7f
 
13ea7f
 /*
13ea7f
  * Try finding suggestions by adding/removing/swapping letters.
13ea7f
@@ -1272,6 +1272,9 @@ suggest_trie_walk(
13ea7f
     char_u	changename[MAXWLEN][80];
13ea7f
 #endif
13ea7f
     int		breakcheckcount = 1000;
13ea7f
+#ifdef FEAT_RELTIME
13ea7f
+    proftime_T	time_limit;
13ea7f
+#endif
13ea7f
     int		compound_ok;
13ea7f
 
13ea7f
     // Go through the whole case-fold tree, try changes at each node.
13ea7f
@@ -1316,6 +1319,11 @@ suggest_trie_walk(
13ea7f
 	    sp->ts_state = STATE_START;
13ea7f
 	}
13ea7f
     }
13ea7f
+#ifdef FEAT_RELTIME
13ea7f
+    // The loop may take an indefinite amount of time. Break out after five
13ea7f
+    // sectonds. TODO: add an option for the time limit.
13ea7f
+    profile_setlimit(5000, &time_limit);
13ea7f
+#endif
13ea7f
 
13ea7f
     // Loop to find all suggestions.  At each round we either:
13ea7f
     // - For the current state try one operation, advance "ts_curi",
13ea7f
@@ -1350,7 +1358,8 @@ suggest_trie_walk(
13ea7f
 
13ea7f
 		// At end of a prefix or at start of prefixtree: check for
13ea7f
 		// following word.
13ea7f
-		if (byts[arridx] == 0 || n == (int)STATE_NOPREFIX)
13ea7f
+		if (depth < MAXWLEN - 1
13ea7f
+			    && (byts[arridx] == 0 || n == (int)STATE_NOPREFIX))
13ea7f
 		{
13ea7f
 		    // Set su->su_badflags to the caps type at this position.
13ea7f
 		    // Use the caps type until here for the prefix itself.
13ea7f
@@ -2644,6 +2653,10 @@ suggest_trie_walk(
13ea7f
 	    {
13ea7f
 		ui_breakcheck();
13ea7f
 		breakcheckcount = 1000;
13ea7f
+#ifdef FEAT_RELTIME
13ea7f
+		if (profile_passed_limit(&time_limit))
13ea7f
+		    got_int = TRUE;
13ea7f
+#endif
13ea7f
 	    }
13ea7f
 	}
13ea7f
     }
13ea7f
diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
13ea7f
index a3a9621..35035a2 100644
13ea7f
--- a/src/testdir/test_spell.vim
13ea7f
+++ b/src/testdir/test_spell.vim
13ea7f
@@ -768,6 +768,14 @@ func Test_spell_long_word()
13ea7f
   set nospell
13ea7f
 endfunc
13ea7f
 
13ea7f
+func Test_spellsuggest_too_deep()
13ea7f
+  " This was incrementing "depth" over MAXWLEN.
13ea7f
+  new
13ea7f
+  norm ?s000G00ý000000000000
13ea7f
+  sil norm ..vzG................vvzG0     v z=
13ea7f
+  bwipe!
13ea7f
+endfunc
13ea7f
+
13ea7f
 func LoadAffAndDic(aff_contents, dic_contents)
13ea7f
   set enc=latin1
13ea7f
   set spellfile=