On Thu, Feb 06, 2020 at 12:59:53PM +0100, Pavel Sanda wrote:
> I looked at the code and the buffer length seems properly handled in the
> reported
> line (247) by the previous if clause.
> What is not clear to me are two following lines, which add m+1 chars while the
> check seem to properly handle only m chars and leaving no place for the
> final' \0'.
> Anyone else can confirm?
I think this should fix the boundary, trying to contact myspell devs.
Pavel
diff --git a/3rdparty/mythes/1.2.5/mythes.cxx b/3rdparty/mythes/1.2.5/mythes.cxx
index b03799f6ea..6e6a782e1c 100644
--- a/3rdparty/mythes/1.2.5/mythes.cxx
+++ b/3rdparty/mythes/1.2.5/mythes.cxx
@@ -243,7 +243,7 @@ int MyThes::Lookup(const char * pText, int len, mentry**
pme)
{
int k = strlen(pos);
int m = strlen(pm->psyns[0]);
- if ((k+m) < (MAX_WD_LEN - 1)) {
+ if ((k+m) < (MAX_WD_LEN - 2)) {
strncpy(dfn,pos,k);
*(dfn+k) = ' ';
strncpy((dfn+k+1),(pm->psyns[0]),m+1);
--
lyx-devel mailing list
lyx-devel@lists.lyx.org
http://lists.lyx.org/mailman/listinfo/lyx-devel
