mirror of
https://github.com/neovim/neovim.git
synced 2026-05-25 22:38:29 +00:00
4f7b6083e5
Problem: spell_read_aff() uses sprintf() into a fixed-size stack buffer
without bounds checking. store_aff_word() uses STRCAT() to
append attacker-controlled strings into newword[MAXWLEN] without
checking remaining space. Both are reachable via :mkspell with
crafted .aff/.dic files (xinyi234)
Solution: Replace sprintf() with vim_snprintf() in spell_read_aff().
Replace STRCAT() with STRNCAT() with explicit remaining-space
calculation in store_aff_word().
closes: vim/vim#19944
07faa961a0
Co-authored-by: Christian Brabandt <cb@256bit.org>