[vim/vim] patch 9.2.XXXX: crash when sound-folding a crafted spell file (PR #21076)

3 views

Skip to first unread message

Christian Brabandt

unread,

Aug 17, 2026, 3:25:25 PM (19 hours ago) Aug 17

to vim/vim, Subscribed

Problem: A SAL rule longer than MAXWLEN is silently truncated to an
empty lead. set_sal_first() then reorders the sl_sal entries
by their index byte and can move the terminating sentinel out
of the last slot, so spell_soundfold_wsal() reads past the end
of the array, e.g. when soundfold() or spellsuggest() is used
(Erick Alex).
Solution: Bound the sound-folding loops against sl_sal.ga_len.

closes: #PR

You can view, comment on, or merge this pull request online at:

https://github.com/vim/vim/pull/21076

Commit Summary

57b2ef8 patch 9.2.XXXX: crash when sound-folding a crafted spell file

File Changes

(2 files)

M src/spell.c (5)
M src/testdir/test_spell_utf8.vim (13)

Patch Links:

—
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today!
You are receiving this because you are subscribed to this thread.

Reply all

Reply to author

Forward

0 new messages