Speculative fix for Hunspell crash in bug 14721.

google/bdict_reader.cc

Index: google/bdict_reader.cc
===================================================================
--- google/bdict_reader.cc	(revision 26238)
+++ google/bdict_reader.cc	(working copy)
@@ -338,8 +338,10 @@
   }
 
   // Range check the offset;
-  if (child_offset > bdict_length_)
+  if (child_offset >= bdict_length_) {
+    DCHECK(false) << "Offset should be less than length.";
     return FIND_DONE;
+  }
 
   // Now recurse into that child node. We don't advance to the next character
   // here since the 0th element will be a leaf (see ReaderForLookupAt).
@@ -373,8 +375,10 @@
   }
 
   // Range check the offset;
-  if (child_offset > bdict_length_)
+  if (child_offset >= bdict_length_) {
+    DCHECK(false) << "Offset should be less than length.";
     return FIND_DONE;  // Error.
+  }
 
   // This is a bit tricky. When we've just reached the end of a word, the word
   // itself will be stored in a leaf "node" off of this node. That node, of
@@ -447,8 +451,10 @@
     offset = children_begin + list_item_begin[1];
   }
 
-  if (offset == 0 || node_offset_ > bdict_length_)
+  if (offset == 0 || node_offset_ >= bdict_length_) {
+    DCHECK(false) << "Offset should be less than length.";
     return FIND_DONE;  // Error, should not happen except for corruption.
+  }
 
   int char_advance = *found_char == 0 ? 0 : 1;  // See ReaderForLookupAt.
   *result = NodeReader(bdict_data_, bdict_length_,