| Change 160419349 by lbaudoin@lbaudoin:hunspell-fix:6013:citc on 2017/06/28 09:50:38 |
| |
| Fix two crashes in hunspell. |
| The null check is borrowed from hunspell 1.3.4, checking for a negative index protects from the second type of crashes. The existing code had checks here and there (but missed spots) but it seems safer to check at the point of use. |
| |
| PRESUBMIT=passed |
| BUG=28718593,62755495 |
| FIXED=28718593,62755495 |
| R=bgoodman,shine |
| CC=gmail-security+reviews |
| APPROVED=shine |
| REQUIRED_REVIEW=1 |
| DELTA=10 (2 added, 6 deleted, 2 changed) |
| DELTA_BY_EXTENSION=cxx=3 |
| OCL=160341892 |
| |
| Affected files ... |
| |
| ... //depot//BUILD#17 edit |
| ... //depot//src/hunspell/hunspell.cxx#6 edit |
| |
| ==== //depot//src/hunspell/hunspell.cxx#5 - /google/src/files/160419349/depot//src/hunspell/hunspell.cxx ==== |
| --- /google/src/files/160151083/depot//src/hunspell/hunspell.cxx 2017-06-26 12:01:35.000000000 -0400 |
| +++ /google/src/files/160419349/depot//src/hunspell/hunspell.cxx 2017-06-28 12:50:38.000000000 -0400 |
| @@ -312,7 +312,9 @@ |
| |
| /* insert a word to the beginning of the suggestion array and return ns */ |
| int Hunspell::insert_sug(char ***slst, char * word, int ns) { |
| - char * dup = mystrdup(word); |
| + if (!slst || !*slst || ns < 0) |
| + return ns; |
| + char * dup = mystrdup(word); |
| if (!dup) return ns; |
| if (ns == MAXSUGGESTION) { |
| ns--; |
