diff -rup vim74/src/spell.c vim74-new/src/spell.c
--- vim74/src/spell.c	2013-07-17 08:28:28.000000000 -0700
+++ vim74-new/src/spell.c	2017-02-23 12:18:03.096797651 -0800
@@ -4043,6 +4043,9 @@ spell_read_tree(fd, bytsp, idxsp, prefix
     len = get4c(fd);
     if (len < 0)
 	return SP_TRUNCERROR;
+    if (len >= 0x3fffffff)
+        /* Invalid length, multiply with sizeof(int) would overflow. */
+        return SP_FORMERROR;    
     if (len > 0)
     {
 	/* Allocate the byte array. */