commit 97d2f34c8763ab3a46c9f43284cc17bad3cf9568
author Bram Moolenaar <Bram@vim.org> Fri Jul 10 20:03:03 2020 +0200
committer Bram Moolenaar <Bram@vim.org> Fri Jul 10 20:03:03 2020 +0200
tree 1cb1f977901b0198046c501eb4b6b88b7ccb3d47
parent 92053ce59ecf93838f4d6e3019eef1bc47be4184

patch 8.2.1169: write NUL past allocated space using corrupted spell file

Problem:    Write NUL past allocated space using corrupted spell file.
            (Markus Vervier)
Solution:   Init "c" every time.

src/spellfile.c

diff --git a/src/spellfile.c b/src/spellfile.c
index fc365e2..8a029dc 100644
--- a/src/spellfile.c
+++ b/src/spellfile.c
@@ -993,7 +993,6 @@
     salitem_T	*smp;
     int		ccnt;
     char_u	*p;
-    int		c = NUL;
 
     slang->sl_sofo = FALSE;
 
@@ -1017,6 +1016,8 @@
     // <sal> : <salfromlen> <salfrom> <saltolen> <salto>
     for (; gap->ga_len < cnt; ++gap->ga_len)
     {
+	int	c = NUL;
+
 	smp = &((salitem_T *)gap->ga_data)[gap->ga_len];
 	ccnt = getc(fd);			// <salfromlen>
 	if (ccnt < 0)