Patch 7.1.251
Problem: Using freed memory when spell checking enabled.
Solution: Obtain the current line again after calling spell_move_to().
(Dominique Pelle)
Files: src/screen.c
*** ../vim-7.1.250/src/screen.c Sat Jan 19 15:55:51 2008
--- src/screen.c Wed Feb 13 21:45:38 2008
***************
*** 2644,2650 ****
#if defined(FEAT_SIGNS) || (defined(FEAT_QUICKFIX) && defined(FEAT_WINDOWS)) \
|| defined(FEAT_SYN_HL) || defined(FEAT_DIFF)
# define LINE_ATTR
! int line_attr = 0; /* atrribute for the whole line
*/
#endif
#ifdef FEAT_SEARCH_EXTRA
matchitem_T *cur; /* points to the match list */
--- 2644,2650 ----
#if defined(FEAT_SIGNS) || (defined(FEAT_QUICKFIX) && defined(FEAT_WINDOWS)) \
|| defined(FEAT_SYN_HL) || defined(FEAT_DIFF)
# define LINE_ATTR
! int line_attr = 0; /* attribute for the whole line
*/
#endif
#ifdef FEAT_SEARCH_EXTRA
matchitem_T *cur; /* points to the match list */
***************
*** 3040,3057 ****
if (has_spell)
{
int len;
hlf_T spell_hlf = HLF_COUNT;
pos = wp->w_cursor;
wp->w_cursor.lnum = lnum;
! wp->w_cursor.col = (colnr_T)(ptr - line);
len = spell_move_to(wp, FORWARD, TRUE, TRUE, &spell_hlf);
if (len == 0 || (int)wp->w_cursor.col > ptr - line)
{
/* no bad word found at line start, don't check until end of a
* word */
spell_hlf = HLF_COUNT;
! word_end = (int)(spell_to_word_end(ptr, wp->w_buffer) - line +
1);
}
else
{
--- 3040,3064 ----
if (has_spell)
{
int len;
+ colnr_T linecol = (colnr_T)(ptr - line);
hlf_T spell_hlf = HLF_COUNT;
pos = wp->w_cursor;
wp->w_cursor.lnum = lnum;
! wp->w_cursor.col = linecol;
len = spell_move_to(wp, FORWARD, TRUE, TRUE, &spell_hlf);
+
+ /* spell_move_to() may call ml_get() and make "line" invalid */
+ line = ml_get_buf(wp->w_buffer, lnum, FALSE);
+ ptr = line + linecol;
+
if (len == 0 || (int)wp->w_cursor.col > ptr - line)
{
/* no bad word found at line start, don't check until end of a
* word */
spell_hlf = HLF_COUNT;
! word_end = (int)(spell_to_word_end(ptr, wp->w_buffer)
! - line + 1);
}
else
{
*** ../vim-7.1.250/src/version.c Wed Feb 13 18:35:23 2008
--- src/version.c Wed Feb 13 21:48:08 2008
***************
*** 668,669 ****
--- 668,671 ----
{ /* Add new patch number below this line */
+ /**/
+ 251,
/**/
--
How To Keep A Healthy Level Of Insanity:
6. In the memo field of all your checks, write "for sexual favors".
/// Bram Moolenaar -- [EMAIL PROTECTED] -- http://www.Moolenaar.net \\\
/// sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\ download, build and distribute -- http://www.A-A-P.org ///
\\\ help me help AIDS victims -- http://ICCF-Holland.org ///
--~--~---------~--~----~------------~-------~--~----~
You received this message from the "vim_dev" maillist.
For more information, visit http://www.vim.org/maillist.php
-~----------~----~----~----~------~----~------~--~---
