Fix array-out-of-bounds error in hunspell

google.patch

 Index: src/hunspell/affixmgr.cxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/affixmgr.cxx,v
 retrieving revision 1.41
 diff -u -r1.41 affixmgr.cxx
 --- src/hunspell/affixmgr.cxx   16 Dec 2011 09:15:34 -0000      1.41
-+++ src/hunspell/affixmgr.cxx   20 Dec 2012 23:40:03 -0000
++++ src/hunspell/affixmgr.cxx   21 Dec 2012 02:19:35 -0000
 @@ -14,8 +14,14 @@
  
  #include "csutil.hxx"
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +AffixMgr::AffixMgr(hunspell::BDictReader* reader, HashMgr** ptr, int * md)
 +{
 +  bdict_reader = reader;
 +#else
  AffixMgr::AffixMgr(const char * affpath, HashMgr** ptr, int * md, const char * key) 
@@ skipping 170 matching lines @@
 +#endif
                      break; 
                      }
               // piece 3 - is cross product indicator 
 Index: src/hunspell/affixmgr.hxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/affixmgr.hxx,v
 retrieving revision 1.15
 diff -u -r1.15 affixmgr.hxx
 --- src/hunspell/affixmgr.hxx   13 Oct 2011 13:41:54 -0000      1.15
-+++ src/hunspell/affixmgr.hxx   20 Dec 2012 23:40:03 -0000
++++ src/hunspell/affixmgr.hxx   21 Dec 2012 02:19:35 -0000
 @@ -18,6 +18,40 @@
  class PfxEntry;
  class SfxEntry;
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +
 +#include <vector>
 +
 +// This class provides an implementation of the contclasses array in AffixMgr
 +// that is normally a large static array. We should almost never need more than
@@ skipping 64 matching lines @@
  };
  
  #endif
 -
 Index: src/hunspell/filemgr.cxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/filemgr.cxx,v
 retrieving revision 1.5
 diff -u -r1.5 filemgr.cxx
 --- src/hunspell/filemgr.cxx    23 Jun 2011 09:21:50 -0000      1.5
-+++ src/hunspell/filemgr.cxx    20 Dec 2012 23:40:03 -0000
++++ src/hunspell/filemgr.cxx    21 Dec 2012 02:19:35 -0000
 @@ -7,6 +7,32 @@
  
  #include "filemgr.hxx"
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +#include "third_party/hunspell/google/bdict_reader.h"
 +
 +FileMgr::FileMgr(hunspell::LineIterator* iterator) : iterator_(iterator) {
 +}
 +
@@ skipping 24 matching lines @@
  int FileMgr::getlinenum() {
      return linenum;
  }
 +#endif
 Index: src/hunspell/filemgr.hxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/filemgr.hxx,v
 retrieving revision 1.3
 diff -u -r1.3 filemgr.hxx
 --- src/hunspell/filemgr.hxx    15 Apr 2010 11:22:08 -0000      1.3
-+++ src/hunspell/filemgr.hxx    20 Dec 2012 23:40:03 -0000
++++ src/hunspell/filemgr.hxx    21 Dec 2012 02:19:35 -0000
 @@ -7,6 +7,30 @@
  #include "hunzip.hxx"
  #include <stdio.h>
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +namespace hunspell {
 +class LineIterator;
 +}  // namespace hunspell
 +
 +// A class which encapsulates operations of reading a BDICT file.
@@ skipping 22 matching lines @@
      int getlinenum();
  };
  #endif
 +#endif
 Index: src/hunspell/hashmgr.cxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/hashmgr.cxx,v
 retrieving revision 1.12
 diff -u -r1.12 hashmgr.cxx
 --- src/hunspell/hashmgr.cxx    23 Jun 2011 09:21:50 -0000      1.12
-+++ src/hunspell/hashmgr.cxx    20 Dec 2012 23:40:03 -0000
++++ src/hunspell/hashmgr.cxx    21 Dec 2012 02:19:35 -0000
 @@ -12,8 +12,14 @@
  
  // build a hash table from a munched word list
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +HashMgr::HashMgr(hunspell::BDictReader* reader)
 +{
 +  bdict_reader = reader;
 +#else
  HashMgr::HashMgr(const char * tpath, const char * apath, const char * key)
@@ skipping 349 matching lines @@
 +
  int HashMgr::is_aliasf() {
      return (aliasf != NULL);
  }
 Index: src/hunspell/hashmgr.hxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/hashmgr.hxx,v
 retrieving revision 1.3
 diff -u -r1.3 hashmgr.hxx
 --- src/hunspell/hashmgr.hxx    15 Apr 2010 11:22:08 -0000      1.3
-+++ src/hunspell/hashmgr.hxx    20 Dec 2012 23:40:03 -0000
++++ src/hunspell/hashmgr.hxx    21 Dec 2012 02:19:35 -0000
 @@ -8,10 +8,25 @@
  #include "htypes.hxx"
  #include "filemgr.hxx"
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +#include <string>
 +#include <map>
 +
 +#include "base/stl_util.h"
 +#include "base/string_piece.h"
@@ skipping 77 matching lines @@
 +
    int add_hidden_capitalized_word(char * word, int wbl, int wcl,
      unsigned short * flags, int al, char * dp, int captype);
    int parse_aliasm(char * line, FileMgr * af);
 Index: src/hunspell/htypes.hxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/htypes.hxx,v
 retrieving revision 1.3
 diff -u -r1.3 htypes.hxx
 --- src/hunspell/htypes.hxx     6 Sep 2010 07:58:53 -0000       1.3
-+++ src/hunspell/htypes.hxx     20 Dec 2012 23:40:03 -0000
++++ src/hunspell/htypes.hxx     21 Dec 2012 02:19:35 -0000
 @@ -1,6 +1,16 @@
  #ifndef _HTYPES_HXX_
  #define _HTYPES_HXX_
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +// This is a workaround for preventing errors in parsing Turkish BDICs, which
 +// contain very long AF lines (~ 12,000 chars).
 +// TODO(hbono) change the HashMgr::parse_aliasf() function to be able to parse
 +// longer lines than MAXDELEN.
 +#define MAXDELEN    (8192 * 2)
 +#else
 +#define MAXDELEN    8192
 +#endif  // HUNSPELL_CHROME_CLIENT
 +
  #define ROTATE_LEN   5
  
  #define ROTATE(v,q) \
 Index: src/hunspell/hunspell.cxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/hunspell.cxx,v
 retrieving revision 1.29
 diff -u -r1.29 hunspell.cxx
 --- src/hunspell/hunspell.cxx   23 Jun 2011 09:21:50 -0000      1.29
-+++ src/hunspell/hunspell.cxx   20 Dec 2012 23:40:03 -0000
++++ src/hunspell/hunspell.cxx   21 Dec 2012 02:19:35 -0000
 @@ -7,20 +7,37 @@
  
  #include "hunspell.hxx"
  #include "hunspell.h"
 +#ifndef HUNSPELL_CHROME_CLIENT
  #ifndef MOZILLA_CLIENT
  #    include "config.h"
  #endif
 +#endif
  #include "csutil.hxx"
@@ skipping 63 matching lines @@
  int Hunspell::add_dic(const char * dpath, const char * key) {
      if (maxdic == MAXDIC || !affixpath) return 1;
 @@ -70,6 +98,7 @@
      if (pHMgr[maxdic]) maxdic++; else return 1;
      return 0;
  }
 +#endif
  
  // make a copy of src at destination while removing all leading
  // blanks and removing any trailing periods after recording
-@@ -322,6 +351,9 @@
+@@ -108,7 +137,9 @@
+    if (utf8) {
+       *nc = u8_u16(dest_utf, MAXWORDLEN, dest);
+       // don't check too long words
+-      if (*nc >= MAXWORDLEN) return 0;
++      // TODO(rouslan): Remove the interim change below when this patch lands:
++      // http://sf.net/tracker/?func=detail&aid=3595024&group_id=143754&atid=756395.
++      if (*nc >= MAXWORDLEN - 1) return 0;
+       if (*nc == -1) { // big Unicode character (non BMP area)
+          *pcaptype = NOCAP;
+          return nl;
+@@ -322,6 +353,9 @@
  
  int Hunspell::spell(const char * word, int * info, char ** root)
  {
 +#ifdef HUNSPELL_CHROME_CLIENT
 +  if (pHMgr) pHMgr[0]->EmptyHentryCache();
 +#endif
    struct hentry * rv=NULL;
    // need larger vector. For example, Turkish capital letter I converted a
    // 2-byte UTF-8 character (dotless i) by mkallsmall.
-@@ -586,6 +618,13 @@
+@@ -586,6 +620,13 @@
    if (!len)
        return NULL;
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +  // We need to check if the word length is valid to make coverity (Event
 +  // fixed_size_dest: Possible overrun of N byte fixed size buffer) happy.
 +  if ((utf8 && strlen(word) >= MAXWORDUTF8LEN) || (!utf8 && strlen(word) >= MAXWORDLEN))
 +    return NULL;
 +#endif
 +
    // word reversing wrapper for complex prefixes
    if (complexprefixes) {
      if (word != w2) {
-@@ -675,6 +714,9 @@
+@@ -675,6 +716,9 @@
  
  int Hunspell::suggest(char*** slst, const char * word)
  {
 +#ifdef HUNSPELL_CHROME_CLIENT
 +  if (pHMgr) pHMgr[0]->EmptyHentryCache();
 +#endif
    int onlycmpdsug = 0;
    char cw[MAXWORDUTF8LEN];
    char wspace[MAXWORDUTF8LEN];
-@@ -1921,13 +1963,21 @@
+@@ -1921,13 +1965,21 @@
  
  Hunhandle *Hunspell_create(const char * affpath, const char * dpath)
  {
 +#ifdef HUNSPELL_CHROME_CLIENT
 +        return NULL;
 +#else
          return (Hunhandle*)(new Hunspell(affpath, dpath));
 +#endif
  }
  
  Hunhandle *Hunspell_create_key(const char * affpath, const char * dpath,
      const char * key)
  {
 +#ifdef HUNSPELL_CHROME_CLIENT
 +        return NULL;
 +#else
          return (Hunhandle*)(new Hunspell(affpath, dpath, key));
 +#endif
  }
  
  void Hunspell_destroy(Hunhandle *pHunspell)
 Index: src/hunspell/hunspell.hxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/hunspell.hxx,v
 retrieving revision 1.6
 diff -u -r1.6 hunspell.hxx
 --- src/hunspell/hunspell.hxx   21 Jan 2011 17:30:41 -0000      1.6
-+++ src/hunspell/hunspell.hxx   20 Dec 2012 23:40:03 -0000
++++ src/hunspell/hunspell.hxx   21 Dec 2012 02:19:35 -0000
 @@ -5,6 +5,10 @@
  #include "suggestmgr.hxx"
  #include "langnum.hxx"
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +#include "third_party/hunspell/google/bdict_reader.h"
 +#endif
 +
  #define  SPELL_XML "<?xml?>"
  
@@ skipping 36 matching lines @@
 +#endif
  
    /* spell(word) - spellcheck word
     * output: 0 = bad word, not 0 = good word
 Index: src/hunspell/replist.hxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/replist.hxx,v
 retrieving revision 1.2
 diff -u -r1.2 replist.hxx
 --- src/hunspell/replist.hxx    15 Apr 2010 11:22:09 -0000      1.2
-+++ src/hunspell/replist.hxx    20 Dec 2012 23:40:03 -0000
++++ src/hunspell/replist.hxx    21 Dec 2012 02:19:35 -0000
 @@ -2,6 +2,12 @@
  #ifndef _REPLIST_HXX_
  #define _REPLIST_HXX_
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +// Compilation issues in spellchecker.cc think near is a macro, therefore
 +// removing it here solves that problem.
 +#undef near
 +#endif
 +
  #include "hunvisapi.h"
  
  #include "w_char.hxx"
 Index: src/hunspell/suggestmgr.cxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/suggestmgr.cxx,v
 retrieving revision 1.24
 diff -u -r1.24 suggestmgr.cxx
 --- src/hunspell/suggestmgr.cxx 14 Feb 2011 21:47:24 -0000      1.24
-+++ src/hunspell/suggestmgr.cxx 20 Dec 2012 23:40:03 -0000
++++ src/hunspell/suggestmgr.cxx 21 Dec 2012 02:19:35 -0000
 @@ -12,9 +12,110 @@
  
  const w_char W_VLINE = { '\0', '|' };
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +namespace {
 +// A simple class which creates temporary hentry objects which are available
 +// only in a scope. To conceal memory operations from SuggestMgr functions,
 +// this object automatically deletes all hentry objects created through
 +// CreateScopedHashEntry() calls in its destructor. So, the following snippet
@@ skipping 177 matching lines @@
 +#endif
        lval = sc;
        for (j=0; j < MAX_ROOTS; j++)
          if (scores[j] < lval) {
 Index: src/hunspell/suggestmgr.hxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/suggestmgr.hxx,v
 retrieving revision 1.5
 diff -u -r1.5 suggestmgr.hxx
 --- src/hunspell/suggestmgr.hxx 21 Jan 2011 22:10:24 -0000      1.5
-+++ src/hunspell/suggestmgr.hxx 20 Dec 2012 23:40:03 -0000
++++ src/hunspell/suggestmgr.hxx 21 Dec 2012 02:19:35 -0000
 @@ -52,7 +52,11 @@
  
  
  public:
 +#ifdef HUNSPELL_CHROME_CLIENT
 +  SuggestMgr(hunspell::BDictReader* reader, const char * tryme, int maxn, AffixMgr *aptr);
 +#else
    SuggestMgr(const char * tryme, int maxn, AffixMgr *aptr);
 +#endif
    ~SuggestMgr();
  
    int suggest(char*** slst, const char * word, int nsug, int * onlycmpdsug);
 @@ -66,6 +70,10 @@
    char * suggest_morph_for_spelling_error(const char * word);
  
  private:
 +#ifdef HUNSPELL_CHROME_CLIENT
 +   // Not owned by us, owned by the Hunspell object.
 +   hunspell::BDictReader* bdict_reader;
 +#endif
     int testsug(char** wlst, const char * candidate, int wl, int ns, int cpdsuggest,
       int * timer, clock_t * timelimit);
     int checkword(const char *, int, int, int *, clock_t *);