Change 613323525 by sungyc@sungyc:fig-export-icing-153-change-473:7348:citc on 2024/03/06 13:30:53

	[hunspell][vulnerability fix] Use calloc to initialize all allocated bytes to 0
	
	## Test plan
	```
	sso_client -location 'https://clusterfuzz.corp.google.com/testcase-detail/download-testcase?id=5038681210028032' > /tmp/testcase-5038681210028032 && \
	blaze --blazerc=/dev/null test -c opt --config=fuzztest --copt=-DNDEBUG \
	  --test_strategy=local \
	  --test_sharding_strategy=disabled \
	  --test_env=FUZZTEST_REPLAY=/tmp/testcase-5038681210028032 \
	  --test_filter=LLVMFuzzer.TestOneInput \
	  //third_party/hunspell/fuzzers:dict_fuzzer
	```
	
	## Description
	- The element in `defcpdtable` contains a pointer to another `malloc` buffer.
	- `defcpdtable` is not initialized (or partially initialized) after `malloc`. The pointer may still contain an invalid non-null value, so `free_defcpdtable` calls `free` with an invalid address and causes error.
	
	By switching to `calloc`, all bytes are initialized to 0, so the pointer is initialized as `NULL`. Then later `free_defcpdtable` will skip NULL pointer freeing correctly.
	
	PRESUBMIT=passed
	BUG=325538748
	R=mghiware
	APPROVED=mghiware
	REQUIRED_REVIEW=1
	DELTA=1 (0 added, 0 deleted, 1 changed)
	DELTA_BY_EXTENSION=cxx=1
	OCL=612537516
	DIFFBASE=612513824
	FIG_CHANGESET=0f4c956db8114c22bca3683d2087fd101d3ddc8f
	FIG_WORKSPACE=sungyc/153:icing
	MARKDOWN=true

Affected files ...

... //depot//src/hunspell/affixmgr.cxx#17 edit

==== //depot//src/hunspell/affixmgr.cxx#16 - /google/src/files/613323525/depot//src/hunspell/affixmgr.cxx ====
--- /google/src/files/613323179/depot//src/hunspell/affixmgr.cxx	2024-03-06 16:29:53.000000000 -0500
+++ /google/src/files/613323525/depot//src/hunspell/affixmgr.cxx	2024-03-06 16:30:53.000000000 -0500
@@ -3965,7 +3965,7 @@
                           HUNSPELL_WARNING(stderr, "error: line %d: bad entry number\n", af->getlinenum());
                           return 1;
                        }
-                       defcpdtable = (flagentry *) malloc(numdefcpd * sizeof(flagentry));
+                       defcpdtable = (flagentry *) calloc(numdefcpd, sizeof(flagentry));
                        if (!defcpdtable) {
                          free_defcpdtable();
                          return 1;