From e87691ad3b0d7e5fe3be5fe794413b7b86da2993 Mon Sep 17 00:00:00 2001 From: Samuel Thibault Date: Sun, 20 Mar 2022 02:23:29 +0100 Subject: [PATCH] Prevent LookupDict2 from overflowing wtab LookupDict2 looks forward in the wtab array, it should still stop at its end. Otherwise the memory sanitizer reports this: testing en A. B C, D. E: F. ==65960==WARNING: MemorySanitizer: use-of-uninitialized-value #0 0x7ff9d7ef0de8 in LookupDict2 /home/samy/brl/speech/espeak-ng-git/src/libespeak-ng/dictionary.c:2676:11 #1 0x7ff9d7eec2ec in LookupDictList /home/samy/brl/speech/espeak-ng-git/src/libespeak-ng/dictionary.c:2899:10 #2 0x7ff9d802860a in TranslateWord3 /home/samy/brl/speech/espeak-ng-git/src/libespeak-ng/translate.c:588:12 #3 0x7ff9d80249d4 in TranslateWord /home/samy/brl/speech/espeak-ng-git/src/libespeak-ng/translate.c:1100:14 #4 0x7ff9d8051fe0 in TranslateWord2 /home/samy/brl/speech/espeak-ng-git/src/libespeak-ng/translate.c:1361:11 #5 0x7ff9d804885c in TranslateClause /home/samy/brl/speech/espeak-ng-git/src/libespeak-ng/translate.c:2623:17 #6 0x7ff9d800e4e9 in SpeakNextClause /home/samy/brl/speech/espeak-ng-git/src/libespeak-ng/synthesize.c:1569:2 #7 0x7ff9d7fa50e6 in Synthesize /home/samy/brl/speech/espeak-ng-git/src/libespeak-ng/speech.c:457:2 #8 0x7ff9d7fa41b3 in sync_espeak_Synth /home/samy/brl/speech/espeak-ng-git/src/libespeak-ng/speech.c:570:29 #9 0x7ff9d7fa872f in espeak_ng_Synthesize /home/samy/brl/speech/espeak-ng-git/src/libespeak-ng/speech.c:678:10 #10 0x7ff9d7f06584 in espeak_Synth /home/samy/brl/speech/espeak-ng-git/src/libespeak-ng/espeak_api.c:90:32 #11 0x4a8be3 in main /home/samy/brl/speech/espeak-ng-git/src/espeak-ng.c:691:3 #12 0x7ff9d78297fc in __libc_start_main csu/../csu/libc-start.c:332:16 #13 0x421449 in _start (/home/samy/ens/projet/1/speech/espeak-ng-git/src/.libs/espeak-ng+0x421449) Uninitialized value was created by an allocation of 'words' in the stack frame of function 'TranslateClause' #0 0x7ff9d8035380 in TranslateClause /home/samy/brl/speech/espeak-ng-git/src/libespeak-ng/translate.c:1941 --- src/libespeak-ng/dictionary.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libespeak-ng/dictionary.c b/src/libespeak-ng/dictionary.c index 3ff8e52e..18c847c8 100644 --- a/src/libespeak-ng/dictionary.c +++ b/src/libespeak-ng/dictionary.c @@ -2666,7 +2666,7 @@ static const char *LookupDict2(Translator *tr, const char *word, const char *wor // don't use the contraction if any of the words are emphasized // or has an embedded command, such as MARK if (wtab != NULL) { - for (ix = 0; ix <= skipwords; ix++) { + for (ix = 0; ix <= skipwords && wtab[ix].length; ix++) { if (wtab[ix].flags & FLAG_EMPHASIZED2) condition_failed = 1; }