From 97e079a23d459aeb6e64435350d7710c90dbca85 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>

Date: Fri, 11 Sep 2015 13:28:52 +0100

Subject: [PATCH] Resolves: rhbz#1261421 crash on mashing hangul korean

 keyboard

---

 src/hunspell/hunspell.cxx | 69 +++++++++++++++++++++++++++++++++++------------

 src/hunspell/hunspell.hxx |  4 ++-

 src/hunspell/replist.cxx  | 18 ++++++++++---

 src/hunspell/replist.hxx  |  2 ++

 src/tools/hunspell.cxx    |  2 +-

 6 files changed, 78 insertions(+), 24 deletions(-)

diff --git a/src/hunspell/hunspell.cxx b/src/hunspell/hunspell.cxx

index 7fae54b..d8ef357 100644

--- a/src/hunspell/hunspell.cxx

+++ b/src/hunspell/hunspell.cxx

@@ -12,6 +12,7 @@

 #endif

 #include "csutil.hxx"

+#include <limits>

 #include <string>

 Hunspell::Hunspell(const char * affpath, const char * dpath, const char * key)

@@ -345,8 +346,13 @@

   // input conversion

   RepList * rl = (pAMgr) ? pAMgr->get_iconvtable() : NULL;

-  if (rl && rl->conv(word, wspace)) wl = cleanword2(cw, wspace, unicw, &nc, &captype, &abbv);

-  else wl = cleanword2(cw, word, unicw, &nc, &captype, &abbv);

+  int convstatus = rl ? rl->conv(word, wspace, MAXWORDUTF8LEN) : 0;

+  if (convstatus < 0)

+    return 0;

+  else if (convstatus > 0)

+    wl = cleanword2(cw, wspace, unicw, &nc, &captype, &abbv);

+  else

+    wl = cleanword2(cw, word, unicw, &nc, &captype, &abbv);

   int info2 = 0;

   if (wl == 0 || maxdic == 0) return 1;

@@ -699,8 +705,13 @@

   // input conversion

   RepList * rl = (pAMgr) ? pAMgr->get_iconvtable() : NULL;

-  if (rl && rl->conv(word, wspace)) wl = cleanword2(cw, wspace, unicw, &nc, &captype, &abbv);

-  else wl = cleanword2(cw, word, unicw, &nc, &captype, &abbv);

+  int convstatus = rl ? rl->conv(word, wspace, MAXWORDUTF8LEN) : 0;

+  if (convstatus < 0)

+    return 0;

+  else if (convstatus > 0)

+    wl = cleanword2(cw, wspace, unicw, &nc, &captype, &abbv);

+  else

+    wl = cleanword2(cw, word, unicw, &nc, &captype, &abbv);

   if (wl == 0) return 0;

   int ns = 0;

@@ -1008,7 +1019,7 @@

   // output conversion

   rl = (pAMgr) ? pAMgr->get_oconvtable() : NULL;

   for (int j = 0; rl && j < ns; j++) {

-    if (rl->conv((*slst)[j], wspace)) {

+    if (rl->conv((*slst)[j], wspace, MAXWORDUTF8LEN) > 0) {

       free((*slst)[j]);

       (*slst)[j] = mystrdup(wspace);

     }

@@ -1383,8 +1394,13 @@

   // input conversion

   RepList * rl = (pAMgr) ? pAMgr->get_iconvtable() : NULL;

-  if (rl && rl->conv(word, wspace)) wl = cleanword2(cw, wspace, unicw, &nc, &captype, &abbv);

-  else wl = cleanword2(cw, word, unicw, &nc, &captype, &abbv);

+  int convstatus = rl ? rl->conv(word, wspace, MAXWORDUTF8LEN) : 0;

+  if (convstatus < 0)

+    return 0;

+  else if (convstatus > 0)

+    wl = cleanword2(cw, wspace, unicw, &nc, &captype, &abbv);

+  else

+    wl = cleanword2(cw, word, unicw, &nc, &captype, &abbv);

   if (wl == 0) {

       if (abbv) {

diff --git a/src/hunspell/replist.cxx b/src/hunspell/replist.cxx

index b9b1255..bac3e06 100644

--- a/src/hunspell/replist.cxx

+++ b/src/hunspell/replist.cxx

@@ -74,6 +74,7 @@

 #include <stdlib.h>

 #include <string.h>

 #include <stdio.h>

+#include <limits>

 #include "replist.hxx"

 #include "csutil.hxx"

@@ -139,19 +140,30 @@ int RepList::add(char * pat1, char * pat2) {

     return 0;

 }

-int RepList::conv(const char * word, char * dest) {

+int RepList::conv(const char * word, char * dest, size_t destsize) {

     int stl = 0;

     int change = 0;

     for (size_t i = 0; i < strlen(word); i++) {

         int n = near(word + i);

         int l = match(word + i, n);

         if (l) {

+          size_t replen = strlen(dat[n]->pattern2);

+          if (stl+replen >= destsize)

+            return -1;

           strcpy(dest + stl, dat[n]->pattern2);

-          stl += strlen(dat[n]->pattern2);

+          stl += replen;

           i += l - 1;

           change = 1;

-        } else dest[stl++] = word[i];

+        } else {

+          if (stl+1 >= destsize)

+            return -1;

+          dest[stl++] = word[i];

+        }

     }

     dest[stl] = '\0';

     return change;

 }

+

+int RepList::conv(const char * word, char * dest) {

+    return conv(word, dest, std::numeric_limits<std::size_t>::max());

+}

diff --git a/src/hunspell/replist.hxx b/src/hunspell/replist.hxx

index 1e3d6e4..e418298 100644

--- a/src/hunspell/replist.hxx

+++ b/src/hunspell/replist.hxx

@@ -99,5 +99,7 @@ public:

     int near(const char * word);

     int match(const char * word, int n);

     int conv(const char * word, char * dest);

+    // ^^-deprecated, use this-vv"

+    int conv(const char * word, char * dest, size_t destsize);

 };

 #endif