From f14e28349daa694a6d60dfd9465979b9fecb66ce Mon Sep 17 00:00:00 2001
From: Karsten Hopp <karsten@fedoraproject.org>
Date: Feb 25 2008 15:36:48 +0000
Subject: - patchlevel 251


---

diff --git a/7.1.251 b/7.1.251
new file mode 100644
index 0000000..671807e
--- /dev/null
+++ b/7.1.251
@@ -0,0 +1,99 @@
+To: vim-dev@vim.org
+Subject: Patch 7.1.251
+Fcc: outbox
+From: Bram Moolenaar <Bram@moolenaar.net>
+Mime-Version: 1.0
+Content-Type: text/plain; charset=ISO-8859-1
+Content-Transfer-Encoding: 8bit
+------------
+
+Patch 7.1.251
+Problem:    Using freed memory when spell checking enabled.
+Solution:   Obtain the current line again after calling spell_move_to().
+	    (Dominique Pelle)
+Files:	    src/screen.c
+
+
+*** ../vim-7.1.250/src/screen.c	Sat Jan 19 15:55:51 2008
+--- src/screen.c	Wed Feb 13 21:45:38 2008
+***************
+*** 2644,2650 ****
+  #if defined(FEAT_SIGNS) || (defined(FEAT_QUICKFIX) && defined(FEAT_WINDOWS)) \
+  	|| defined(FEAT_SYN_HL) || defined(FEAT_DIFF)
+  # define LINE_ATTR
+!     int		line_attr = 0;		/* atrribute for the whole line */
+  #endif
+  #ifdef FEAT_SEARCH_EXTRA
+      matchitem_T *cur;			/* points to the match list */
+--- 2644,2650 ----
+  #if defined(FEAT_SIGNS) || (defined(FEAT_QUICKFIX) && defined(FEAT_WINDOWS)) \
+  	|| defined(FEAT_SYN_HL) || defined(FEAT_DIFF)
+  # define LINE_ATTR
+!     int		line_attr = 0;		/* attribute for the whole line */
+  #endif
+  #ifdef FEAT_SEARCH_EXTRA
+      matchitem_T *cur;			/* points to the match list */
+***************
+*** 3040,3057 ****
+  	if (has_spell)
+  	{
+  	    int		len;
+  	    hlf_T	spell_hlf = HLF_COUNT;
+  
+  	    pos = wp->w_cursor;
+  	    wp->w_cursor.lnum = lnum;
+! 	    wp->w_cursor.col = (colnr_T)(ptr - line);
+  	    len = spell_move_to(wp, FORWARD, TRUE, TRUE, &spell_hlf);
+  	    if (len == 0 || (int)wp->w_cursor.col > ptr - line)
+  	    {
+  		/* no bad word found at line start, don't check until end of a
+  		 * word */
+  		spell_hlf = HLF_COUNT;
+! 		word_end = (int)(spell_to_word_end(ptr, wp->w_buffer) - line + 1);
+  	    }
+  	    else
+  	    {
+--- 3040,3064 ----
+  	if (has_spell)
+  	{
+  	    int		len;
++ 	    colnr_T	linecol = (colnr_T)(ptr - line);
+  	    hlf_T	spell_hlf = HLF_COUNT;
+  
+  	    pos = wp->w_cursor;
+  	    wp->w_cursor.lnum = lnum;
+! 	    wp->w_cursor.col = linecol;
+  	    len = spell_move_to(wp, FORWARD, TRUE, TRUE, &spell_hlf);
++ 
++ 	    /* spell_move_to() may call ml_get() and make "line" invalid */
++ 	    line = ml_get_buf(wp->w_buffer, lnum, FALSE);
++ 	    ptr = line + linecol;
++ 
+  	    if (len == 0 || (int)wp->w_cursor.col > ptr - line)
+  	    {
+  		/* no bad word found at line start, don't check until end of a
+  		 * word */
+  		spell_hlf = HLF_COUNT;
+! 		word_end = (int)(spell_to_word_end(ptr, wp->w_buffer)
+! 								  - line + 1);
+  	    }
+  	    else
+  	    {
+*** ../vim-7.1.250/src/version.c	Wed Feb 13 18:35:23 2008
+--- src/version.c	Wed Feb 13 21:48:08 2008
+***************
+*** 668,669 ****
+--- 668,671 ----
+  {   /* Add new patch number below this line */
++ /**/
++     251,
+  /**/
+
+-- 
+How To Keep A Healthy Level Of Insanity:
+6. In the memo field of all your checks, write "for sexual favors".
+
+ /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
+///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
+\\\        download, build and distribute -- http://www.A-A-P.org        ///
+ \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///