From 96386934799b7978f1f4842a10260b80a422d42b Mon Sep 17 00:00:00 2001 From: Keisuke Kuroyanagi Date: Tue, 14 Jan 2014 14:09:21 -0800 Subject: [PATCH] Fix native crash in BigramDictionary::addWordBigram() Bug: 12479653 Change-Id: I7d263f744f711202000524a47769dc2d3d0e0de6 --- .../suggest/core/dictionary/bigram_dictionary.cpp | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/native/jni/src/suggest/core/dictionary/bigram_dictionary.cpp b/native/jni/src/suggest/core/dictionary/bigram_dictionary.cpp index 2a62b555b..d0b96b0fe 100644 --- a/native/jni/src/suggest/core/dictionary/bigram_dictionary.cpp +++ b/native/jni/src/suggest/core/dictionary/bigram_dictionary.cpp @@ -41,6 +41,9 @@ BigramDictionary::~BigramDictionary() { void BigramDictionary::addWordBigram(int *word, int length, int probability, int *bigramProbability, int *bigramCodePoints, int *outputTypes) const { + if (length >= MAX_WORD_LENGTH) { + length = MAX_WORD_LENGTH - 1; + } word[length] = 0; if (DEBUG_DICT_FULL) { #ifdef FLAG_DBG @@ -66,14 +69,17 @@ void BigramDictionary::addWordBigram(int *word, int length, int probability, int if (insertAt >= MAX_RESULTS) { return; } - memmove(bigramProbability + (insertAt + 1), - bigramProbability + insertAt, + // Shift result buffers to insert the new entry. + memmove(bigramProbability + (insertAt + 1), bigramProbability + insertAt, (MAX_RESULTS - insertAt - 1) * sizeof(bigramProbability[0])); - bigramProbability[insertAt] = probability; - outputTypes[insertAt] = Dictionary::KIND_PREDICTION; + memmove(outputTypes + (insertAt + 1), outputTypes + insertAt, + (MAX_RESULTS - insertAt - 1) * sizeof(outputTypes[0])); memmove(bigramCodePoints + (insertAt + 1) * MAX_WORD_LENGTH, bigramCodePoints + insertAt * MAX_WORD_LENGTH, (MAX_RESULTS - insertAt - 1) * sizeof(bigramCodePoints[0]) * MAX_WORD_LENGTH); + // Put the result. + bigramProbability[insertAt] = probability; + outputTypes[insertAt] = Dictionary::KIND_PREDICTION; int *dest = bigramCodePoints + insertAt * MAX_WORD_LENGTH; while (length--) { *dest++ = *word++;