From ef665816d07daa9aea74b4f8c34939b6801bbbcd Mon Sep 17 00:00:00 2001 From: Keisuke Kuroyanagi Date: Mon, 24 Mar 2014 14:32:03 +0900 Subject: [PATCH] Add boundary check for SparseTable. Bug: 13592288 Change-Id: I8bc4ff778c6073d22f86b6050a880b6fb69de31e --- .../suggest/policyimpl/dictionary/utils/sparse_table.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/native/jni/src/suggest/policyimpl/dictionary/utils/sparse_table.cpp b/native/jni/src/suggest/policyimpl/dictionary/utils/sparse_table.cpp index 810827dd0..d336306b9 100644 --- a/native/jni/src/suggest/policyimpl/dictionary/utils/sparse_table.cpp +++ b/native/jni/src/suggest/policyimpl/dictionary/utils/sparse_table.cpp @@ -34,6 +34,12 @@ uint32_t SparseTable::get(const int id) const { const int indexTableReadingPos = getPosInIndexTable(id); const int index = mIndexTableBuffer->readUint(INDEX_SIZE, indexTableReadingPos); const int contentTableReadingPos = getPosInContentTable(id, index); + if (contentTableReadingPos < 0 + || contentTableReadingPos >= mContentTableBuffer->getTailPosition()) { + AKLOGE("contentTableReadingPos(%d) is invalid. id: %d, index: %d", + contentTableReadingPos, id, index); + return NOT_A_DICT_POS; + } const int contentValue = mContentTableBuffer->readUint(mDataSize, contentTableReadingPos); return contentValue == NOT_EXIST ? NOT_A_DICT_POS : contentValue; }