From ad4e0108a920f04d0ed81689b26c7afc1893fb57 Mon Sep 17 00:00:00 2001
From: Keisuke Kuroyanagi <ksk@google.com>
Date: Fri, 23 Aug 2013 19:55:55 +0900
Subject: [PATCH] Fix: reading uninitialized area.

Bug: 10402083
Change-Id: I083beea29fe563b1e7739653d756b77820753e3f
---
 .../dictionary/dynamic_patricia_trie_policy.cpp        | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/native/jni/src/suggest/policyimpl/dictionary/dynamic_patricia_trie_policy.cpp b/native/jni/src/suggest/policyimpl/dictionary/dynamic_patricia_trie_policy.cpp
index 3000860a3..11da03951 100644
--- a/native/jni/src/suggest/policyimpl/dictionary/dynamic_patricia_trie_policy.cpp
+++ b/native/jni/src/suggest/policyimpl/dictionary/dynamic_patricia_trie_policy.cpp
@@ -126,7 +126,7 @@ int DynamicPatriciaTriePolicy::getTerminalNodePositionOfWord(const int *const in
     int pos = getRootPosition();
     DynamicPatriciaTrieNodeReader nodeReader(mDictRoot, getBigramsStructurePolicy(),
             getShortcutsStructurePolicy());
-    while (currentLength <= length) {
+    while (currentLength < length) {
         // When foundMatchedNode becomes true, currentLength is increased at least once.
         bool foundMatchedNode = false;
         int totalChildCount = 0;
@@ -144,13 +144,15 @@ int DynamicPatriciaTriePolicy::getTerminalNodePositionOfWord(const int *const in
             for (int i = 0; i < childCount; i++) {
                 nodeReader.fetchNodeInfoFromBufferAndGetNodeCodePoints(pos, MAX_WORD_LENGTH,
                         mergedNodeCodePoints);
-                if (nodeReader.isDeleted() || nodeReader.getCodePointCount() <= 0) {
+                const int nodeCodePointCount = nodeReader.getCodePointCount();
+                if (nodeReader.isDeleted() || nodeCodePointCount <= 0
+                        || currentLength + nodeCodePointCount > length) {
                     // Skip deleted or empty node.
                     pos = nodeReader.getSiblingNodePos();
                     continue;
                 }
                 bool matched = true;
-                for (int j = 0; j < nodeReader.getCodePointCount(); ++j) {
+                for (int j = 0; j < nodeCodePointCount; ++j) {
                     if (mergedNodeCodePoints[j] != searchCodePoints[currentLength + j]) {
                         // Different code point is found.
                         matched = false;
@@ -158,7 +160,7 @@ int DynamicPatriciaTriePolicy::getTerminalNodePositionOfWord(const int *const in
                     }
                 }
                 if (matched) {
-                    currentLength += nodeReader.getCodePointCount();
+                    currentLength += nodeCodePointCount;
                     if (length == currentLength) {
                         // Terminal position is found.
                         return nodeReader.getNodePos();