To: vim-dev@vim.org
Subject: Patch 7.1.251
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
------------

Patch 7.1.251
Problem:    Using freed memory when spell checking enabled.
Solution:   Obtain the current line again after calling spell_move_to().
	    (Dominique Pelle)
Files:	    src/screen.c


*** ../vim-7.1.250/src/screen.c	Sat Jan 19 15:55:51 2008
--- src/screen.c	Wed Feb 13 21:45:38 2008
***************
*** 2644,2650 ****
  #if defined(FEAT_SIGNS) || (defined(FEAT_QUICKFIX) && defined(FEAT_WINDOWS)) \
  	|| defined(FEAT_SYN_HL) || defined(FEAT_DIFF)
  # define LINE_ATTR
!     int		line_attr = 0;		/* atrribute for the whole line */
  #endif
  #ifdef FEAT_SEARCH_EXTRA
      matchitem_T *cur;			/* points to the match list */
--- 2644,2650 ----
  #if defined(FEAT_SIGNS) || (defined(FEAT_QUICKFIX) && defined(FEAT_WINDOWS)) \
  	|| defined(FEAT_SYN_HL) || defined(FEAT_DIFF)
  # define LINE_ATTR
!     int		line_attr = 0;		/* attribute for the whole line */
  #endif
  #ifdef FEAT_SEARCH_EXTRA
      matchitem_T *cur;			/* points to the match list */
***************
*** 3040,3057 ****
  	if (has_spell)
  	{
  	    int		len;
  	    hlf_T	spell_hlf = HLF_COUNT;
  
  	    pos = wp->w_cursor;
  	    wp->w_cursor.lnum = lnum;
! 	    wp->w_cursor.col = (colnr_T)(ptr - line);
  	    len = spell_move_to(wp, FORWARD, TRUE, TRUE, &spell_hlf);
  	    if (len == 0 || (int)wp->w_cursor.col > ptr - line)
  	    {
  		/* no bad word found at line start, don't check until end of a
  		 * word */
  		spell_hlf = HLF_COUNT;
! 		word_end = (int)(spell_to_word_end(ptr, wp->w_buffer) - line + 1);
  	    }
  	    else
  	    {
--- 3040,3064 ----
  	if (has_spell)
  	{
  	    int		len;
+ 	    colnr_T	linecol = (colnr_T)(ptr - line);
  	    hlf_T	spell_hlf = HLF_COUNT;
  
  	    pos = wp->w_cursor;
  	    wp->w_cursor.lnum = lnum;
! 	    wp->w_cursor.col = linecol;
  	    len = spell_move_to(wp, FORWARD, TRUE, TRUE, &spell_hlf);
+ 
+ 	    /* spell_move_to() may call ml_get() and make "line" invalid */
+ 	    line = ml_get_buf(wp->w_buffer, lnum, FALSE);
+ 	    ptr = line + linecol;
+ 
  	    if (len == 0 || (int)wp->w_cursor.col > ptr - line)
  	    {
  		/* no bad word found at line start, don't check until end of a
  		 * word */
  		spell_hlf = HLF_COUNT;
! 		word_end = (int)(spell_to_word_end(ptr, wp->w_buffer)
! 								  - line + 1);
  	    }
  	    else
  	    {
*** ../vim-7.1.250/src/version.c	Wed Feb 13 18:35:23 2008
--- src/version.c	Wed Feb 13 21:48:08 2008
***************
*** 668,669 ****
--- 668,671 ----
  {   /* Add new patch number below this line */
+ /**/
+     251,
  /**/

-- 
How To Keep A Healthy Level Of Insanity:
6. In the memo field of all your checks, write "for sexual favors".

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\        download, build and distribute -- http://www.A-A-P.org        ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///