From 97e079a23d459aeb6e64435350d7710c90dbca85 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
Date: Fri, 11 Sep 2015 13:28:52 +0100
Subject: [PATCH] Resolves: rhbz#1261421 crash on mashing hangul korean
 keyboard

---
 src/hunspell/hunspell.cxx | 69 +++++++++++++++++++++++++++++++++++------------
 src/hunspell/hunspell.hxx |  4 ++-
 src/hunspell/replist.cxx  | 18 ++++++++++---
 src/hunspell/replist.hxx  |  2 ++
 src/tools/hunspell.cxx    |  2 +-
 6 files changed, 78 insertions(+), 24 deletions(-)

diff --git a/src/hunspell/hunspell.cxx b/src/hunspell/hunspell.cxx
index 7fae54b..d8ef357 100644
--- a/src/hunspell/hunspell.cxx
+++ b/src/hunspell/hunspell.cxx
@@ -12,6 +12,7 @@
 #endif
 #include "csutil.hxx"
 
+#include <limits>
 #include <string>
 
 Hunspell::Hunspell(const char * affpath, const char * dpath, const char * key)
@@ -349,8 +350,13 @@ int Hunspell::spell(const char * word, int * info, char ** root)
 
   // input conversion
   RepList * rl = (pAMgr) ? pAMgr->get_iconvtable() : NULL;
-  if (rl && rl->conv(word, wspace)) wl = cleanword2(cw, wspace, unicw, &nc, &captype, &abbv);
-  else wl = cleanword2(cw, word, unicw, &nc, &captype, &abbv);
+  int convstatus = rl ? rl->conv(word, wspace, MAXWORDUTF8LEN) : 0;
+  if (convstatus < 0)
+    return 0;
+  else if (convstatus > 0)
+    wl = cleanword2(cw, wspace, unicw, &nc, &captype, &abbv);
+  else
+    wl = cleanword2(cw, word, unicw, &nc, &captype, &abbv);
 
   if (wl == 0 || maxdic == 0) return 1;
   if (root) *root = NULL;
@@ -702,8 +708,13 @@ int Hunspell::suggest(char*** slst, const char * word)
 
   // input conversion
   RepList * rl = (pAMgr) ? pAMgr->get_iconvtable() : NULL;
-  if (rl && rl->conv(word, wspace)) wl = cleanword2(cw, wspace, unicw, &nc, &captype, &abbv);
-  else wl = cleanword2(cw, word, unicw, &nc, &captype, &abbv);
+  int convstatus = rl ? rl->conv(word, wspace, MAXWORDUTF8LEN) : 0;
+  if (convstatus < 0)
+    return 0;
+  else if (convstatus > 0)
+    wl = cleanword2(cw, wspace, unicw, &nc, &captype, &abbv);
+  else
+    wl = cleanword2(cw, word, unicw, &nc, &captype, &abbv);
 
   if (wl == 0) return 0;
   int ns = 0;
@@ -1020,7 +1031,7 @@ int Hunspell::suggest(char*** slst, const char * word)
   // output conversion
   rl = (pAMgr) ? pAMgr->get_oconvtable() : NULL;
   for (int j = 0; rl && j < ns; j++) {
-    if (rl->conv((*slst)[j], wspace)) {
+    if (rl->conv((*slst)[j], wspace, MAXWORDUTF8LEN) > 0) {
       free((*slst)[j]);
       (*slst)[j] = mystrdup(wspace);
     }
@@ -1395,8 +1406,13 @@ int Hunspell::analyze(char*** slst, const char * word)
 
   // input conversion
   RepList * rl = (pAMgr) ? pAMgr->get_iconvtable() : NULL;
-  if (rl && rl->conv(word, wspace)) wl = cleanword2(cw, wspace, unicw, &nc, &captype, &abbv);
-  else wl = cleanword2(cw, word, unicw, &nc, &captype, &abbv);
+  int convstatus = rl ? rl->conv(word, wspace, MAXWORDUTF8LEN) : 0;
+  if (convstatus < 0)
+    return 0;
+  else if (convstatus > 0)
+    wl = cleanword2(cw, wspace, unicw, &nc, &captype, &abbv);
+  else
+    wl = cleanword2(cw, word, unicw, &nc, &captype, &abbv);
 
   if (wl == 0) {
       if (abbv) {
@@ -1684,12 +1700,16 @@ int Hunspell::get_langnum() const
    return langnum;
 }
 
-int Hunspell::input_conv(const char * word, char * dest)
+int Hunspell::input_conv(const char * word, char * dest, size_t destsize)
 {
   RepList * rl = (pAMgr) ? pAMgr->get_iconvtable() : NULL;
-  return (rl && rl->conv(word, dest));
+  return (rl && rl->conv(word, dest, destsize) > 0);
 }
 
+int Hunspell::input_conv(const char * word, char * dest)
+{
+  return input_conv(word, dest, std::numeric_limits<std::size_t>::max());
+}
 
 // return the beginning of the element (attr == NULL) or the attribute
 const char * Hunspell::get_xml_pos(const char * s, const char * attr)
diff --git a/src/hunspell/hunspell.hxx b/src/hunspell/hunspell.hxx
index e62f0dd..0b5ad2e 100644
--- a/src/hunspell/hunspell.hxx
+++ b/src/hunspell/hunspell.hxx
@@ -226,7 +226,9 @@ public:
 
   /* need for putdic */
   int input_conv(const char * word, char * dest);
-  
+  // ^^-deprecated, use this-vv"
+  int input_conv(const char * word, char * dest, size_t destsize);
+ 
   /* experimental and deprecated functions */
 
 #ifdef HUNSPELL_EXPERIMENTAL
diff --git a/src/hunspell/replist.cxx b/src/hunspell/replist.cxx
index b9b1255..bac3e06 100644
--- a/src/hunspell/replist.cxx
+++ b/src/hunspell/replist.cxx
@@ -74,6 +74,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <stdio.h>
+#include <limits>
 
 #include "replist.hxx"
 #include "csutil.hxx"
@@ -139,19 +140,30 @@ int RepList::add(char * pat1, char * pat2) {
     return 0;
 }
 
-int RepList::conv(const char * word, char * dest) {
+int RepList::conv(const char * word, char * dest, size_t destsize) {
     int stl = 0;
     int change = 0;
     for (size_t i = 0; i < strlen(word); i++) {
         int n = near(word + i);
         int l = match(word + i, n);
         if (l) {
+          size_t replen = strlen(dat[n]->pattern2);
+          if (stl+replen >= destsize)
+            return -1;
           strcpy(dest + stl, dat[n]->pattern2);
-          stl += strlen(dat[n]->pattern2);
+          stl += replen;
           i += l - 1;
           change = 1;
-        } else dest[stl++] = word[i];
+        } else {
+          if (stl+1 >= destsize)
+            return -1;
+          dest[stl++] = word[i];
+        }
     }
     dest[stl] = '\0';
     return change;
 }
+
+int RepList::conv(const char * word, char * dest) {
+    return conv(word, dest, std::numeric_limits<std::size_t>::max());
+}
diff --git a/src/hunspell/replist.hxx b/src/hunspell/replist.hxx
index 1e3d6e4..e418298 100644
--- a/src/hunspell/replist.hxx
+++ b/src/hunspell/replist.hxx
@@ -99,5 +99,7 @@ public:
     int near(const char * word);
     int match(const char * word, int n);
     int conv(const char * word, char * dest);
+    // ^^-deprecated, use this-vv"
+    int conv(const char * word, char * dest, size_t destsize);
 };
 #endif
diff --git a/src/tools/hunspell.cxx b/src/tools/hunspell.cxx
index 6124ac4..1b50fe1 100644
--- a/src/tools/hunspell.cxx
+++ b/src/tools/hunspell.cxx
@@ -524,7 +524,7 @@ int putdic(char * word, Hunspell * pMS)
     
     word = chenc(word, ui_enc, dic_enc[0]);
 
-    if(pMS->input_conv(word, buf)) word = buf;
+    if(pMS->input_conv(word, buf, MAXLNLEN)) word = buf;
     
     int ret;
     
-- 
2.4.0