CVE-2022-2304: Stack-based Buffer Overflow (CWE-121)
value: Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.
CWE description: A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CVSS v3 base score: 7.8
Published: 2022-07-05T13:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/spell.c, src/testdir/test_spell.vim, src/version.c
Commit date: 2022-07-04 13:37:07 +0100
Commit message: patch 9.0.0035: spell dump may go beyond end of an array

Problem:    Spell dump may go beyond end of an array.
Solution:   Limit the word length.

Diff: diff --git a/src/spell.c b/src/spell.c
index d866a2df7265..24abce4625dd 100644
--- a/src/spell.c
+++ b/src/spell.c
@@ -3994,13 +3994,14 @@ spell_dump_compl(
 		{
 		    // Do one more byte at this node.
 		    n = arridx[depth] + curi[depth];
 		    ++curi[depth];
 		    c = byts[n];
-		    if (c == 0)
+		    if (c == 0 || depth >= MAXWLEN - 1)
 		    {
-			// End of word, deal with the word.
+			// End of word or reached maximum length, deal with the
+			// word.
 			// Don't use keep-case words in the fold-case tree,
 			// they will appear in the keep-case tree.
 			// Only use the word when the region matches.
 			flags = (int)idxs[n];
 			if ((round == 2 || (flags & WF_KEEPCAP) == 0)
diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
index d3f56d8d1498..a291eb5c7a4d 100644
--- a/src/testdir/test_spell.vim
+++ b/src/testdir/test_spell.vim
@@ -283,10 +283,22 @@ func Test_spellreall()
   call assert_fails('spellrepall', 'E753:')
   set spell&
   bwipe!
 endfunc
 
+func Test_spell_dump_word_length()
+  " this was running over MAXWLEN
+  new
+  noremap 0 0a0zW0000000
+  sil! norm 0z=0
+  sil norm 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  sil! norm 0z=0
+
+  bwipe!
+  nunmap 0
+endfunc
+
 " Test spellsuggest({word} [, {max} [, {capital}]])
 func Test_spellsuggest()
   " Verify suggestions are given even when spell checking is not enabled.
   set nospell
   call assert_equal(['march', 'March'], spellsuggest('marrch', 2))
diff --git a/src/version.c b/src/version.c
index 180a4cf8c977..e22fb5673cec 100644
--- a/src/version.c
+++ b/src/version.c
@@ -733,10 +733,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    35,
 /**/
     34,
 /**/
     33,
 /**/

Vulnerable code: 		    if (c == 0)
			// End of word, deal with the word.
Fixed code: 		    if (c == 0 || depth >= MAXWLEN - 1)
			// End of word or reached maximum length, deal with the
			// word.
func Test_spell_dump_word_length()
  " this was running over MAXWLEN
  new
  noremap 0 0a0zW0000000
  sil! norm 0z=0
  sil norm 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  sil! norm 0z=0

  bwipe!
  nunmap 0
endfunc

/**/
    35,