To: vim-dev@vim.org Subject: Patch 7.1.251 Fcc: outbox From: Bram Moolenaar Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit ------------ Patch 7.1.251 Problem: Using freed memory when spell checking enabled. Solution: Obtain the current line again after calling spell_move_to(). (Dominique Pelle) Files: src/screen.c *** ../vim-7.1.250/src/screen.c Sat Jan 19 15:55:51 2008 --- src/screen.c Wed Feb 13 21:45:38 2008 *************** *** 2644,2650 **** #if defined(FEAT_SIGNS) || (defined(FEAT_QUICKFIX) && defined(FEAT_WINDOWS)) \ || defined(FEAT_SYN_HL) || defined(FEAT_DIFF) # define LINE_ATTR ! int line_attr = 0; /* atrribute for the whole line */ #endif #ifdef FEAT_SEARCH_EXTRA matchitem_T *cur; /* points to the match list */ --- 2644,2650 ---- #if defined(FEAT_SIGNS) || (defined(FEAT_QUICKFIX) && defined(FEAT_WINDOWS)) \ || defined(FEAT_SYN_HL) || defined(FEAT_DIFF) # define LINE_ATTR ! int line_attr = 0; /* attribute for the whole line */ #endif #ifdef FEAT_SEARCH_EXTRA matchitem_T *cur; /* points to the match list */ *************** *** 3040,3057 **** if (has_spell) { int len; hlf_T spell_hlf = HLF_COUNT; pos = wp->w_cursor; wp->w_cursor.lnum = lnum; ! wp->w_cursor.col = (colnr_T)(ptr - line); len = spell_move_to(wp, FORWARD, TRUE, TRUE, &spell_hlf); if (len == 0 || (int)wp->w_cursor.col > ptr - line) { /* no bad word found at line start, don't check until end of a * word */ spell_hlf = HLF_COUNT; ! word_end = (int)(spell_to_word_end(ptr, wp->w_buffer) - line + 1); } else { --- 3040,3064 ---- if (has_spell) { int len; + colnr_T linecol = (colnr_T)(ptr - line); hlf_T spell_hlf = HLF_COUNT; pos = wp->w_cursor; wp->w_cursor.lnum = lnum; ! wp->w_cursor.col = linecol; len = spell_move_to(wp, FORWARD, TRUE, TRUE, &spell_hlf); + + /* spell_move_to() may call ml_get() and make "line" invalid */ + line = ml_get_buf(wp->w_buffer, lnum, FALSE); + ptr = line + linecol; + if (len == 0 || (int)wp->w_cursor.col > ptr - line) { /* no bad word found at line start, don't check until end of a * word */ spell_hlf = HLF_COUNT; ! word_end = (int)(spell_to_word_end(ptr, wp->w_buffer) ! - line + 1); } else { *** ../vim-7.1.250/src/version.c Wed Feb 13 18:35:23 2008 --- src/version.c Wed Feb 13 21:48:08 2008 *************** *** 668,669 **** --- 668,671 ---- { /* Add new patch number below this line */ + /**/ + 251, /**/ -- How To Keep A Healthy Level Of Insanity: 6. In the memo field of all your checks, write "for sexual favors". /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net \\\ /// sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\ \\\ download, build and distribute -- http://www.A-A-P.org /// \\\ help me help AIDS victims -- http://ICCF-Holland.org ///