From ada93e2db0f2ce4a9fbfd57219dc46a9137db308 Mon Sep 17 00:00:00 2001
From: Samuel Thibault <samuel.thibault@ens-lyon.org>
Date: Thu, 21 Jul 2022 00:03:57 +0200
Subject: [PATCH] Fix number_buf buffer overflow

---
 src/libespeak-ng/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libespeak-ng/translate.c b/src/libespeak-ng/translate.c
index 19f95051..64531632 100644
--- a/src/libespeak-ng/translate.c
+++ b/src/libespeak-ng/translate.c
@@ -2634,7 +2634,7 @@ void TranslateClause(Translator *tr, int *tone_out, char **voice_change)
 			for (pw = &number_buf[3]; pw < pn;) {
 				// keep wflags for each part, for FLAG_HYPHEN_AFTER
 				dict_flags = TranslateWord2(tr, pw, &num_wtab[nw++], words[ix].pre_pause);
-				while (*pw++ != ' ')
+				while (*pw && *pw++ != ' ')
 					;
 				words[ix].pre_pause = 0;
 			}