From 8c568050d7ba69060b61812151c56c4da6e0d0cc Mon Sep 17 00:00:00 2001 From: rdevshp Date: Fri, 26 Jun 2026 12:48:52 +0000 Subject: [PATCH] Fix OOB access in constructNgramContext when parameter prevWordCount of the JNI function latinime_BinaryDictionary_getSuggestions is > MAX_PREV_WORD_COUNT_FOR_N_GRAM --- native/jni/src/utils/jni_data_utils.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/native/jni/src/utils/jni_data_utils.h b/native/jni/src/utils/jni_data_utils.h index 8024e34c42..f305806ed1 100644 --- a/native/jni/src/utils/jni_data_utils.h +++ b/native/jni/src/utils/jni_data_utils.h @@ -104,7 +104,11 @@ class JniDataUtils { int prevWordCodePoints[MAX_PREV_WORD_COUNT_FOR_N_GRAM][MAX_WORD_LENGTH]; int prevWordCodePointCount[MAX_PREV_WORD_COUNT_FOR_N_GRAM]; bool isBeginningOfSentence[MAX_PREV_WORD_COUNT_FOR_N_GRAM]; - for (size_t i = 0; i < prevWordCount; ++i) { + + const size_t safePrevWordCount = std::min( + static_cast(MAX_PREV_WORD_COUNT_FOR_N_GRAM), prevWordCount); + + for (size_t i = 0; i < safePrevWordCount; ++i) { prevWordCodePointCount[i] = 0; isBeginningOfSentence[i] = false; jintArray prevWord = (jintArray)env->GetObjectArrayElement(prevWordCodePointArrays, i); @@ -124,7 +128,7 @@ class JniDataUtils { isBeginningOfSentence[i] = isBeginningOfSentenceBoolean == JNI_TRUE; } return NgramContext(prevWordCodePoints, prevWordCodePointCount, isBeginningOfSentence, - prevWordCount); + safePrevWordCount); } static void putBooleanToArray(JNIEnv *env, jbooleanArray array, const int index,