mjohnson/espeak-ng
1
0
Fork 0
mirror of https://github.com/rhasspy/espeak-ng.git synced 2026-10-31 05:35:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix number processing buffer overflow fix

Browse Source 
This first reverts "Fix number_buf buffer overflow"
(commit ada93e2db0)

This for loop is apparently actually expected to to skip over NUL
characters.

Fixes #1302

Instead, this limits number processing to 32 digits, as break_numbers does
not support more and would provide bogus result with further digits.

Also fix the signedness of break_numbers so that the 32th bit
actually effectively works.
This commit is contained in:
Samuel Thibault
2022-08-26 22:22:01 +02:00
parent 29dfc18a2f
commit 4412de57fd
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libespeak-ng/translate.c
+3 -3
View File
@@ -2588,7 +2588,7 @@ void TranslateClause(Translator *tr, int *tone_out, char **voice_change)
for (n_digits = 0; iswdigit(word[n_digits]); n_digits++) // count consecutive digits
;
if (n_digits > 4) {
if (n_digits > 4 && n_digits <= 32) {
// word is entirely digits, insert commas and break into 3 digit "words"
number_buf[0] = ' ';
number_buf[1] = ' ';
@@ -2606,7 +2606,7 @@ void TranslateClause(Translator *tr, int *tone_out, char **voice_change)
*pn++ = c;
nx--;
if ((nx > 0) && (tr->langopts.break_numbers & (1 << nx))) {
if ((nx > 0) && (tr->langopts.break_numbers & (1U << nx))) {
memcpy(&num_wtab[nw++], &words[ix], sizeof(WORD_TAB)); // copy the 'words' entry for each word of numbers
if (tr->langopts.thousands_sep != ' ')
@@ -2640,7 +2640,7 @@ void TranslateClause(Translator *tr, int *tone_out, char **voice_change)
for (pw = &number_buf[3]; pw < pn;) {
// keep wflags for each part, for FLAG_HYPHEN_AFTER
dict_flags = TranslateWord2(tr, pw, &num_wtab[nw++], words[ix].pre_pause);
while (*pw && *pw++ != ' ')
while (*pw++ != ' ')
;
words[ix].pre_pause = 0;
}
src/libespeak-ng/translate.h
+1 -1
View File
@@ -514,7 +514,7 @@ typedef struct {
#define BREAK_LAKH_UR 0x000052a8 // b b b b b b b // 100,00,000,00,00,00,000
#define BREAK_INDIVIDUAL 0x00000018 // b bb // 100,0,000
int break_numbers; // which digits to break the number into thousands, millions, etc (Hindi has 100,000 not 1,000,000)
unsigned break_numbers; // which digits to break the number into thousands, millions, etc (Hindi has 100,000 not 1,000,000)
int max_roman;
int min_roman;
int thousands_sep;