From eaff5417beb715c1e760c17d228e82eec3eb5a14 Mon Sep 17 00:00:00 2001
From: zeertzjq <zeertzjq@outlook.com>
Date: Fri, 21 Aug 2026 08:51:56 +0800
Subject: [PATCH] vim-patch:9.2.0987: heap-buffer-overflow in spell_suggest()
 (#41406)

Problem:  Heap-buffer-overflow in spell_suggest() when the cursor is
          beyond the end of the line, because a SpellFileMissing
          autocommand changed the buffer (dvaave2025).
Solution: parse_spelllang() may run autocommands, so validate the cursor
          position and re-take the saved position afterwards.

fixes:  vim/vim#21097
closes: vim/vim#21100

Supported by AI.

https://github.com/vim/vim/commit/6073903cda7b5838f3432b19a0e8293f494b4cd5

Co-authored-by: Christian Brabandt <cb@256bit.org>
---
 src/nvim/spellsuggest.c         |  4 +++-
 test/old/testdir/test_spell.vim | 19 +++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/src/nvim/spellsuggest.c b/src/nvim/spellsuggest.c
index b938b3d2dc..b894f0fea8 100644
--- a/src/nvim/spellsuggest.c
+++ b/src/nvim/spellsuggest.c
@@ -502,7 +502,6 @@ static void select_spell_suggestion(suginfo_T *sug)
 /// When "count" is non-zero use that suggestion.
 void spell_suggest(int count)
 {
-  pos_T prev_cursor = curwin->w_cursor;
   int badlen = 0;
   int msg_scroll_save = msg_scroll;
   const int wo_spell_save = curwin->w_p_spell;
@@ -511,6 +510,9 @@ void spell_suggest(int count)
     parse_spelllang(curwin);
     curwin->w_p_spell = true;
   }
+  // Autocommands may have changed the buffer and made the cursor invalid
+  check_cursor(curwin);
+  pos_T prev_cursor = curwin->w_cursor;
 
   if (*curwin->w_s->b_p_spl == NUL) {
     emsg(_(e_no_spell));
diff --git a/test/old/testdir/test_spell.vim b/test/old/testdir/test_spell.vim
index e4c7c73114..f7a4489022 100644
--- a/test/old/testdir/test_spell.vim
+++ b/test/old/testdir/test_spell.vim
@@ -1621,4 +1621,23 @@ func Test_spelldump_prefixtree_overflow()
   bwipe!
 endfunc
 
+" This was using the cursor position from before a SpellFileMissing
+" autocommand made the line shorter.
+func Test_spell_file_missing_z_equal()
+  new
+  call setline(1, repeat('a', 40))
+  call cursor(1, 30)
+  set spelllang=xy
+  au SpellFileMissing * call setline(1, 'ab')
+
+  " The language cannot be loaded, so z= reports E756; the invalid cursor
+  " position was used before that error reached the script level.
+  silent! norm! z=
+  call assert_equal('ab', getline(1))
+
+  au! SpellFileMissing
+  set nospell spelllang=en
+  bwipe!
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab