Fix array-out-of-bounds error in hunspell

google.patch

 Index: src/hunspell/affixmgr.cxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/affixmgr.cxx,v
 retrieving revision 1.41
 diff -u -r1.41 affixmgr.cxx
 --- src/hunspell/affixmgr.cxx   16 Dec 2011 09:15:34 -0000      1.41
-+++ src/hunspell/affixmgr.cxx   23 Mar 2012 05:56:23 -0000
++++ src/hunspell/affixmgr.cxx   20 Dec 2012 17:39:19 -0000
 @@ -14,8 +14,14 @@
  
  #include "csutil.hxx"
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +AffixMgr::AffixMgr(hunspell::BDictReader* reader, HashMgr** ptr, int * md)
 +{
 +  bdict_reader = reader;
 +#else
  AffixMgr::AffixMgr(const char * affpath, HashMgr** ptr, int * md, const char * key) 
@@ skipping 170 matching lines @@
 +#endif
                      break; 
                      }
               // piece 3 - is cross product indicator 
 Index: src/hunspell/affixmgr.hxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/affixmgr.hxx,v
 retrieving revision 1.15
 diff -u -r1.15 affixmgr.hxx
 --- src/hunspell/affixmgr.hxx   13 Oct 2011 13:41:54 -0000      1.15
-+++ src/hunspell/affixmgr.hxx   23 Mar 2012 05:56:23 -0000
++++ src/hunspell/affixmgr.hxx   20 Dec 2012 17:39:19 -0000
 @@ -18,6 +18,40 @@
  class PfxEntry;
  class SfxEntry;
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +
 +#include <vector>
 +
 +// This class provides an implementation of the contclasses array in AffixMgr
 +// that is normally a large static array. We should almost never need more than
@@ skipping 64 matching lines @@
  };
  
  #endif
 -
 Index: src/hunspell/filemgr.cxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/filemgr.cxx,v
 retrieving revision 1.5
 diff -u -r1.5 filemgr.cxx
 --- src/hunspell/filemgr.cxx    23 Jun 2011 09:21:50 -0000      1.5
-+++ src/hunspell/filemgr.cxx    23 Mar 2012 05:56:23 -0000
++++ src/hunspell/filemgr.cxx    20 Dec 2012 17:39:19 -0000
 @@ -7,6 +7,32 @@
  
  #include "filemgr.hxx"
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +#include "third_party/hunspell/google/bdict_reader.h"
 +
 +FileMgr::FileMgr(hunspell::LineIterator* iterator) : iterator_(iterator) {
 +}
 +
@@ skipping 24 matching lines @@
  int FileMgr::getlinenum() {
      return linenum;
  }
 +#endif
 Index: src/hunspell/filemgr.hxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/filemgr.hxx,v
 retrieving revision 1.3
 diff -u -r1.3 filemgr.hxx
 --- src/hunspell/filemgr.hxx    15 Apr 2010 11:22:08 -0000      1.3
-+++ src/hunspell/filemgr.hxx    23 Mar 2012 05:56:23 -0000
++++ src/hunspell/filemgr.hxx    20 Dec 2012 17:39:19 -0000
 @@ -7,6 +7,30 @@
  #include "hunzip.hxx"
  #include <stdio.h>
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +namespace hunspell {
 +class LineIterator;
 +}  // namespace hunspell
 +
 +// A class which encapsulates operations of reading a BDICT file.
@@ skipping 22 matching lines @@
      int getlinenum();
  };
  #endif
 +#endif
 Index: src/hunspell/hashmgr.cxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/hashmgr.cxx,v
 retrieving revision 1.12
 diff -u -r1.12 hashmgr.cxx
 --- src/hunspell/hashmgr.cxx    23 Jun 2011 09:21:50 -0000      1.12
-+++ src/hunspell/hashmgr.cxx    23 Mar 2012 05:56:23 -0000
++++ src/hunspell/hashmgr.cxx    20 Dec 2012 17:39:19 -0000
 @@ -12,8 +12,14 @@
  
  // build a hash table from a munched word list
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +HashMgr::HashMgr(hunspell::BDictReader* reader)
 +{
 +  bdict_reader = reader;
 +#else
  HashMgr::HashMgr(const char * tpath, const char * apath, const char * key)
@@ skipping 102 matching lines @@
 +      std::string* new_string_word = new std::string(word);
 +      pointer_to_strings_.push_back(new_string_word);
 +      base::StringPiece sp(*(new_string_word));
 +      custom_word_to_affix_id_map_[sp] = 0; // no affixes for custom words
 +      return 1;
 +    }
 +#endif
      return 0;
  }     
  
-@@ -339,6 +407,44 @@
+@@ -256,6 +324,12 @@
+ // remove word (personal dictionary function for standalone applications)
+ int HashMgr::remove(const char * word)
+ {
++#ifdef HUNSPELL_CHROME_CLIENT
++    std::map<base::StringPiece, int>::iterator iter =
++        custom_word_to_affix_id_map_.find(word);
++    if (iter != custom_word_to_affix_id_map_.end())
++        custom_word_to_affix_id_map_.erase(iter);
++#else
+     struct hentry * dp = lookup(word);
+     while (dp) {
+         if (dp->alen == 0 || !TESTAFF(dp->astr, forbiddenword, dp->alen)) {
+@@ -270,6 +344,7 @@
+         }
+         dp = dp->next_homonym;
+     }
++#endif
+     return 0;
+ }
+ 
+@@ -339,6 +414,44 @@
  // initialize: col=-1; hp = NULL; hp = walk_hashtable(&col, hp);
  struct hentry * HashMgr::walk_hashtable(int &col, struct hentry * hp) const
  {  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +  // Return NULL if dictionary is not valid.
 +  if (!bdict_reader->IsValid())
 +    return NULL;
 +
 +  // This function is only ever called by one place and not nested. We can
 +  // therefore keep static state between calls and use |col| as a "reset" flag
@@ skipping 24 matching lines @@
 +    hentry entry;
 +    char word[kMaxWordLen];
 +  } hash_entry;
 +
 +  return InitHashEntry(&hash_entry.entry, sizeof(hash_entry),
 +                       &word[0], word_len, affix_ids[0]);
 +#else
    if (hp && hp->next != NULL) return hp->next;
    for (col++; col < tablesize; col++) {
      if (tableptr[col]) return tableptr[col];
-@@ -346,11 +452,13 @@
+@@ -346,11 +459,13 @@
    // null at end and reset to start
    col = -1;
    return NULL;
 +#endif
  }
  
  // load a munched word list and build a hash table on the fly
  int HashMgr::load_tables(const char * tpath, const char * key)
  {
 +#ifndef HUNSPELL_CHROME_CLIENT
    int al;
    char * ap;
    char * dp;
-@@ -471,6 +579,7 @@
+@@ -471,6 +586,7 @@
    }
  
    delete dict;
 +#endif
    return 0;
  }
  
-@@ -479,6 +588,9 @@
+@@ -479,6 +595,9 @@
  
  int HashMgr::hash(const char * word) const
  {
 +#ifdef HUNSPELL_CHROME_CLIENT
 +    return 0;
 +#else
      long  hv = 0;
      for (int i=0; i < 4  &&  *word != 0; i++)
          hv = (hv << 8) | (*word++);
-@@ -487,6 +599,7 @@
+@@ -487,6 +606,7 @@
        hv ^= (*word++);
      }
      return (unsigned long) hv % tablesize;
 +#endif
  }
  
  int HashMgr::decode_flags(unsigned short ** result, char * flags, FileMgr * af) {
-@@ -607,7 +720,12 @@
+@@ -607,7 +727,12 @@
    int firstline = 1;
   
    // open the affix file
 +#ifdef HUNSPELL_CHROME_CLIENT
 +  hunspell::LineIterator iterator = bdict_reader->GetOtherLineIterator();
 +  FileMgr * afflst = new FileMgr(&iterator);
 +#else
    FileMgr * afflst = new FileMgr(affpath, key);
 +#endif
    if (!afflst) {
      HUNSPELL_WARNING(stderr, "Error - could not open affix description file %s\n",affpath);
      return 1;
-@@ -802,6 +920,121 @@
+@@ -802,6 +927,121 @@
     return 0;
  }
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +int HashMgr::LoadAFLines()
 +{
 +  utf8 = 1;  // We always use UTF-8.
 +
 +  // Read in all the AF lines which tell us the rules for each affix group ID.
 +  hunspell::LineIterator iterator = bdict_reader->GetAfLineIterator();
@@ skipping 107 matching lines @@
 +
  int HashMgr::is_aliasf() {
      return (aliasf != NULL);
  }
 Index: src/hunspell/hashmgr.hxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/hashmgr.hxx,v
 retrieving revision 1.3
 diff -u -r1.3 hashmgr.hxx
 --- src/hunspell/hashmgr.hxx    15 Apr 2010 11:22:08 -0000      1.3
-+++ src/hunspell/hashmgr.hxx    23 Mar 2012 05:56:23 -0000
++++ src/hunspell/hashmgr.hxx    20 Dec 2012 17:39:19 -0000
 @@ -8,10 +8,25 @@
  #include "htypes.hxx"
  #include "filemgr.hxx"
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +#include <string>
 +#include <map>
 +
 +#include "base/stl_util.h"
 +#include "base/string_piece.h"
@@ skipping 77 matching lines @@
 +
    int add_hidden_capitalized_word(char * word, int wbl, int wcl,
      unsigned short * flags, int al, char * dp, int captype);
    int parse_aliasm(char * line, FileMgr * af);
 Index: src/hunspell/htypes.hxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/htypes.hxx,v
 retrieving revision 1.3
 diff -u -r1.3 htypes.hxx
 --- src/hunspell/htypes.hxx     6 Sep 2010 07:58:53 -0000       1.3
-+++ src/hunspell/htypes.hxx     23 Mar 2012 05:56:23 -0000
++++ src/hunspell/htypes.hxx     20 Dec 2012 17:39:19 -0000
 @@ -1,6 +1,16 @@
  #ifndef _HTYPES_HXX_
  #define _HTYPES_HXX_
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +// This is a workaround for preventing errors in parsing Turkish BDICs, which
 +// contain very long AF lines (~ 12,000 chars).
 +// TODO(hbono) change the HashMgr::parse_aliasf() function to be able to parse
 +// longer lines than MAXDELEN.
 +#define MAXDELEN    (8192 * 2)
 +#else
 +#define MAXDELEN    8192
 +#endif  // HUNSPELL_CHROME_CLIENT
 +
  #define ROTATE_LEN   5
  
  #define ROTATE(v,q) \
 Index: src/hunspell/hunspell.cxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/hunspell.cxx,v
 retrieving revision 1.29
 diff -u -r1.29 hunspell.cxx
 --- src/hunspell/hunspell.cxx   23 Jun 2011 09:21:50 -0000      1.29
-+++ src/hunspell/hunspell.cxx   23 Mar 2012 05:56:24 -0000
-@@ -12,15 +12,30 @@
++++ src/hunspell/hunspell.cxx   20 Dec 2012 17:39:19 -0000
+@@ -7,20 +7,37 @@
+ 
+ #include "hunspell.hxx"
+ #include "hunspell.h"
++#ifndef HUNSPELL_CHROME_CLIENT
+ #ifndef MOZILLA_CLIENT
+ #    include "config.h"
  #endif
++#endif
  #include "csutil.hxx"
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +Hunspell::Hunspell(const unsigned char* bdict_data, size_t bdict_length)
 +#else
  Hunspell::Hunspell(const char * affpath, const char * dpath, const char * key)
 +#endif
  {
      encoding = NULL;
      csconv = NULL;
      utf8 = 0;
      complexprefixes = 0;
 +#ifndef HUNSPELL_CHROME_CLIENT
      affixpath = mystrdup(affpath);
 +#endif
      maxdic = 0;
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +    bdict_reader = new hunspell::BDictReader;
 +    bdict_reader->Init(bdict_data, bdict_length);
 +
 +    pHMgr[0] = new HashMgr(bdict_reader);
 +    if (pHMgr[0]) maxdic = 1;
 +
 +    pAMgr = new AffixMgr(bdict_reader, pHMgr, &maxdic);
 +#else
      /* first set up the hash manager */
      pHMgr[0] = new HashMgr(dpath, affpath, key);
      if (pHMgr[0]) maxdic = 1;
-@@ -28,6 +43,7 @@
+@@ -28,6 +45,7 @@
      /* next set up the affix manager */
      /* it needs access to the hash manager lookup methods */
      pAMgr = new AffixMgr(affpath, pHMgr, &maxdic, key);
 +#endif
  
      /* get the preferred try string and the dictionary */
      /* encoding from the Affix Manager for that dictionary */
-@@ -59,10 +75,16 @@
+@@ -41,7 +59,11 @@
+     wordbreak = pAMgr->get_breaktable();

[groby-ooo-7-16, 2012/12/20 22:56:28]

This one and the free statement a bit later are odd additions. Can you verify
that they're from previous CLs that forgot to update the .patch, just to make
sure?

[please use gerrit instead, 2012/12/21 02:24:39]

"wordbreak = pAMgr->get_breaktable()" itself is not an addition. A diff of a
diff is confusing :-)

The actual change is below, surrounding pSMgr instantiation with an #ifdef
HUNSPELL_CHROME_CLIENT.

+ 
+     /* and finally set up the suggestion manager */
++#ifdef HUNSPELL_CHROME_CLIENT
++    pSMgr = new SuggestMgr(bdict_reader, try_string, MAXSUGGESTION, pAMgr);
++#else
+     pSMgr = new SuggestMgr(try_string, MAXSUGGESTION, pAMgr);
++#endif
+     if (try_string) free(try_string);
+ }
+ 
+@@ -59,10 +81,16 @@
      csconv= NULL;
      if (encoding) free(encoding);
      encoding = NULL;
 +#ifdef HUNSPELL_CHROME_CLIENT
 +    if (bdict_reader) delete bdict_reader;
 +    bdict_reader = NULL;
 +#else
      if (affixpath) free(affixpath);
      affixpath = NULL;
 +#endif
  }
  
 +#ifndef HUNSPELL_CHROME_CLIENT
  // load extra dictionaries
  int Hunspell::add_dic(const char * dpath, const char * key) {
      if (maxdic == MAXDIC || !affixpath) return 1;
-@@ -70,6 +92,7 @@
+@@ -70,6 +98,7 @@
      if (pHMgr[maxdic]) maxdic++; else return 1;
      return 0;
  }
 +#endif
  
  // make a copy of src at destination while removing all leading
  // blanks and removing any trailing periods after recording
-@@ -322,6 +345,9 @@
+@@ -108,7 +137,9 @@
+    if (utf8) {
+       *nc = u8_u16(dest_utf, MAXWORDLEN, dest);
+       // don't check too long words
+-      if (*nc >= MAXWORDLEN) return 0;
++      // TODO(rouslan): Remove the interim change below when this patch lands:
++      // http://sf.net/tracker/?func=detail&aid=3595024&group_id=143754&atid=756395.
++      if (*nc >= MAXWORDLEN - 1) return 0;
+       if (*nc == -1) { // big Unicode character (non BMP area)
+          *pcaptype = NOCAP;
+          return nl;
+@@ -322,6 +353,9 @@
  
  int Hunspell::spell(const char * word, int * info, char ** root)
  {
 +#ifdef HUNSPELL_CHROME_CLIENT
 +  if (pHMgr) pHMgr[0]->EmptyHentryCache();
 +#endif
    struct hentry * rv=NULL;
    // need larger vector. For example, Turkish capital letter I converted a
    // 2-byte UTF-8 character (dotless i) by mkallsmall.
-@@ -586,6 +612,13 @@
+@@ -586,6 +620,13 @@
    if (!len)
        return NULL;
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +  // We need to check if the word length is valid to make coverity (Event
 +  // fixed_size_dest: Possible overrun of N byte fixed size buffer) happy.
 +  if ((utf8 && strlen(word) >= MAXWORDUTF8LEN) || (!utf8 && strlen(word) >= MAXWORDLEN))
 +    return NULL;
 +#endif
 +
    // word reversing wrapper for complex prefixes
    if (complexprefixes) {
      if (word != w2) {
-@@ -675,6 +708,9 @@
+@@ -675,6 +716,9 @@
  
  int Hunspell::suggest(char*** slst, const char * word)
  {
 +#ifdef HUNSPELL_CHROME_CLIENT
 +  if (pHMgr) pHMgr[0]->EmptyHentryCache();
 +#endif
    int onlycmpdsug = 0;
    char cw[MAXWORDUTF8LEN];
    char wspace[MAXWORDUTF8LEN];
-@@ -1921,13 +1957,21 @@
+@@ -1921,13 +1965,21 @@
  
  Hunhandle *Hunspell_create(const char * affpath, const char * dpath)
  {
 +#ifdef HUNSPELL_CHROME_CLIENT
 +        return NULL;
 +#else
          return (Hunhandle*)(new Hunspell(affpath, dpath));
 +#endif
  }
  
  Hunhandle *Hunspell_create_key(const char * affpath, const char * dpath,
      const char * key)
  {
 +#ifdef HUNSPELL_CHROME_CLIENT
 +        return NULL;
 +#else
          return (Hunhandle*)(new Hunspell(affpath, dpath, key));
 +#endif
  }
  
  void Hunspell_destroy(Hunhandle *pHunspell)
 Index: src/hunspell/hunspell.hxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/hunspell.hxx,v
 retrieving revision 1.6
 diff -u -r1.6 hunspell.hxx
 --- src/hunspell/hunspell.hxx   21 Jan 2011 17:30:41 -0000      1.6
-+++ src/hunspell/hunspell.hxx   23 Mar 2012 05:56:24 -0000
++++ src/hunspell/hunspell.hxx   20 Dec 2012 17:39:19 -0000
 @@ -5,6 +5,10 @@
  #include "suggestmgr.hxx"
  #include "langnum.hxx"
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +#include "third_party/hunspell/google/bdict_reader.h"
 +#endif
 +
  #define  SPELL_XML "<?xml?>"
  
@@ skipping 30 matching lines @@
 +#endif
    ~Hunspell();
  
 +#ifndef HUNSPELL_CHROME_CLIENT
    /* load extra dictionaries (only dic files) */
    int add_dic(const char * dpath, const char * key = NULL);
 +#endif
  
    /* spell(word) - spellcheck word
     * output: 0 = bad word, not 0 = good word
+Index: src/hunspell/license.hunspell
+===================================================================
+RCS file: /cvsroot/hunspell/hunspell/src/hunspell/license.hunspell,v
+retrieving revision 1.1.1.1
+diff -u -r1.1.1.1 license.hunspell
+--- src/hunspell/license.hunspell       23 Feb 2010 09:08:56 -0000      1.1.1.1
++++ src/hunspell/license.hunspell       20 Dec 2012 17:39:19 -0000
+@@ -56,4 +56,6 @@
+  *
+  * ***** END LICENSE BLOCK ***** */
+ 
++#ifndef HUNSPELL_CHROME_CLIENT
+ #include "config.h"
++#endif
 Index: src/hunspell/replist.hxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/replist.hxx,v
 retrieving revision 1.2
 diff -u -r1.2 replist.hxx
 --- src/hunspell/replist.hxx    15 Apr 2010 11:22:09 -0000      1.2
-+++ src/hunspell/replist.hxx    23 Mar 2012 05:56:24 -0000
++++ src/hunspell/replist.hxx    20 Dec 2012 17:39:19 -0000
 @@ -2,6 +2,12 @@
  #ifndef _REPLIST_HXX_
  #define _REPLIST_HXX_
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +// Compilation issues in spellchecker.cc think near is a macro, therefore
 +// removing it here solves that problem.
 +#undef near
 +#endif
 +
  #include "hunvisapi.h"
  
  #include "w_char.hxx"
 Index: src/hunspell/suggestmgr.cxx
 ===================================================================
 RCS file: /cvsroot/hunspell/hunspell/src/hunspell/suggestmgr.cxx,v
 retrieving revision 1.24
 diff -u -r1.24 suggestmgr.cxx
 --- src/hunspell/suggestmgr.cxx 14 Feb 2011 21:47:24 -0000      1.24
-+++ src/hunspell/suggestmgr.cxx 23 Mar 2012 05:56:24 -0000
-@@ -12,6 +12,98 @@
++++ src/hunspell/suggestmgr.cxx 20 Dec 2012 17:39:19 -0000
+@@ -12,9 +12,110 @@
  
  const w_char W_VLINE = { '\0', '|' };
  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +namespace {
 +// A simple class which creates temporary hentry objects which are available
 +// only in a scope. To conceal memory operations from SuggestMgr functions,
 +// this object automatically deletes all hentry objects created through
 +// CreateScopedHashEntry() calls in its destructor. So, the following snippet
 +// raises a memory error.
@@ skipping 75 matching lines @@
 +  if (source->astr) {
 +    hash_item->astr = *source->astr;
 +    hash_item->entry.astr = &hash_item->astr;
 +  }
 +  return &hash_item->entry;
 +}
 +
 +}  // namespace
 +#endif
 +
++
++#ifdef HUNSPELL_CHROME_CLIENT
++SuggestMgr::SuggestMgr(hunspell::BDictReader* reader,
++                       const char * tryme, int maxn, 
++                       AffixMgr * aptr)
++{
++  bdict_reader = reader;

[groby-ooo-7-16, 2012/12/20 22:56:28]

This shouldn't be part of the patch either. The purist in me says that you
should first land a CL without your changes, that just brings the .patch file up
to date...

[please use gerrit instead, 2012/12/20 22:58:00]

SGTM, let me do that first.

[please use gerrit instead, 2012/12/20 23:48:02]

CL to bring google.patch file up to date:
https://codereview.chromium.org/11639053/

++#else
  SuggestMgr::SuggestMgr(const char * tryme, int maxn, 
                         AffixMgr * aptr)
  {
-@@ -1057,6 +1149,9 @@
++#endif
+ 
+   // register affix manager and check in string of chars to 
+   // try when building candidate suggestions
+@@ -407,6 +508,49 @@
+   int lenr, lenp;
+   int wl = strlen(word);
+   if (wl < 2 || ! pAMgr) return ns;
++  
++#ifdef HUNSPELL_CHROME_CLIENT
++  const char *pattern, *pattern2;
++  hunspell::ReplacementIterator iterator = bdict_reader->GetReplacementIterator();
++  while (iterator.GetNext(&pattern, &pattern2)) {
++      r = word;
++      lenr = strlen(pattern2);
++      lenp = strlen(pattern);
++      
++      // search every occurence of the pattern in the word
++      while ((r=strstr(r, pattern)) != NULL) {
++          strcpy(candidate, word);
++          if (r-word + lenr + strlen(r+lenp) >= MAXLNLEN) break;
++          strcpy(candidate+(r-word), pattern2);
++          strcpy(candidate+(r-word)+lenr, r+lenp);
++          ns = testsug(wlst, candidate, wl-lenp+lenr, ns, cpdsuggest, NULL, NULL);
++          if (ns == -1) return -1;
++          // check REP suggestions with space
++          char * sp = strchr(candidate, ' ');
++          if (sp) {
++            char * prev = candidate;
++            while (sp) {
++              *sp = '\0';
++              if (checkword(prev, strlen(prev), 0, NULL, NULL)) {
++                int oldns = ns;
++                *sp = ' ';
++                ns = testsug(wlst, sp + 1, strlen(sp + 1), ns, cpdsuggest, NULL, NULL);
++                if (ns == -1) return -1;
++                if (oldns < ns) {
++                  free(wlst[ns - 1]);
++                  wlst[ns - 1] = mystrdup(candidate);
++                  if (!wlst[ns - 1]) return -1;
++                }
++              }
++              *sp = ' ';
++              prev = sp + 1;
++              sp = strchr(prev, ' ');
++            }
++          }
++          r++; // search for the next letter
++    }
++  }
++#else
+   int numrep = pAMgr->get_numrep();
+   struct replentry* reptable = pAMgr->get_reptable();
+   if (reptable==NULL) return ns;
+@@ -448,6 +592,7 @@
+           r++; // search for the next letter
+       }
+    }
++#endif
+    return ns;
+ }
+ 
+@@ -1057,6 +1202,9 @@
  
    struct hentry* hp = NULL;
    int col = -1;
 +#ifdef HUNSPELL_CHROME_CLIENT
 +  ScopedHashEntryFactory hash_entry_factory;
 +#endif
    phonetable * ph = (pAMgr) ? pAMgr->get_phonetable() : NULL;
    char target[MAXSWUTF8L];
    char candidate[MAXSWUTF8L];
-@@ -1115,7 +1210,11 @@
+@@ -1115,7 +1263,11 @@
  
      if (sc > scores[lp]) {
        scores[lp] = sc;  
 +#ifdef HUNSPELL_CHROME_CLIENT
 +      roots[lp] = hash_entry_factory.CreateScopedHashEntry(lp, hp);
 +#else
        roots[lp] = hp;
 +#endif
        lval = sc;
        for (j=0; j < MAX_ROOTS; j++)
          if (scores[j] < lval) {
+Index: src/hunspell/suggestmgr.hxx
+===================================================================
+RCS file: /cvsroot/hunspell/hunspell/src/hunspell/suggestmgr.hxx,v
+retrieving revision 1.5
+diff -u -r1.5 suggestmgr.hxx
+--- src/hunspell/suggestmgr.hxx 21 Jan 2011 22:10:24 -0000      1.5
++++ src/hunspell/suggestmgr.hxx 20 Dec 2012 17:39:19 -0000
+@@ -52,7 +52,11 @@
+ 
+ 
+ public:
++#ifdef HUNSPELL_CHROME_CLIENT
++  SuggestMgr(hunspell::BDictReader* reader, const char * tryme, int maxn, AffixMgr *aptr);
++#else
+   SuggestMgr(const char * tryme, int maxn, AffixMgr *aptr);
++#endif
+   ~SuggestMgr();
+ 
+   int suggest(char*** slst, const char * word, int nsug, int * onlycmpdsug);
+@@ -66,6 +70,10 @@
+   char * suggest_morph_for_spelling_error(const char * word);
+ 
+ private:
++#ifdef HUNSPELL_CHROME_CLIENT
++   // Not owned by us, owned by the Hunspell object.
++   hunspell::BDictReader* bdict_reader;
++#endif
+    int testsug(char** wlst, const char * candidate, int wl, int ns, int cpdsuggest,
+      int * timer, clock_t * timelimit);
+    int checkword(const char *, int, int, int *, clock_t *);