patch 8.2.5072: using uninitialized value and freed memory in spell command
Problem: Using uninitialized value and freed memory in spell command.
Solution: Initialize "attr". Check for empty line early.
diff --git a/src/spell.c b/src/spell.c
index 48a2203..d866a2d 100644
--- a/src/spell.c
+++ b/src/spell.c
@@ -1275,7 +1275,7 @@
char_u *line;
char_u *p;
char_u *endp;
- hlf_T attr;
+ hlf_T attr = 0;
int len;
#ifdef FEAT_SYN_HL
int has_syntax = syntax_present(wp);
@@ -1308,6 +1308,8 @@
while (!got_int)
{
+ int empty_line;
+
line = ml_get_buf(wp->w_buffer, lnum, FALSE);
len = (int)STRLEN(line);
@@ -1340,7 +1342,9 @@
}
// Copy the line into "buf" and append the start of the next line if
- // possible.
+ // possible. Note: this ml_get_buf() may make "line" invalid, check
+ // for empty line first.
+ empty_line = *skipwhite(line) == NUL;
STRCPY(buf, line);
if (lnum < wp->w_buffer->b_ml.ml_line_count)
spell_cat_line(buf + STRLEN(buf),
@@ -1487,7 +1491,7 @@
--capcol;
// But after empty line check first word in next line
- if (*skipwhite(line) == NUL)
+ if (empty_line)
capcol = 0;
}