Fix for #2185627 : ArrayIndexOutOfBounds in BinaryDictionary.getWords()

Make sure the word count doesn't exceed the maximum suggested words.

And also, only get the count one time instead of every time a match
is found.

2 files changed, 6 insertions, 7 deletions

diff --git a/dictionary/src/dictionary.cpp b/dictionary/src/dictionary.cpp
index fe5b4dc53..306aff527 100644
--- a/dictionary/src/dictionary.cpp
+++ b/dictionary/src/dictionary.cpp
@@ -51,6 +51,7 @@ Dictionary::~Dictionary()
 int Dictionary::getSuggestions(int *codes, int codesSize, unsigned short *outWords, int *frequencies,
         int maxWordLength, int maxWords, int maxAlternatives, int skipPos)
 {
+    int suggWords;
     mFrequencies = frequencies;
     mOutputChars = outWords;
     mInputCodes = codes;
@@ -58,14 +59,16 @@ int Dictionary::getSuggestions(int *codes, int codesSize, unsigned short *outWor
     mMaxAlternatives = maxAlternatives;
     mMaxWordLength = maxWordLength;
     mMaxWords = maxWords;
-    mWords = 0;
     mSkipPos = skipPos;
     mMaxEditDistance = mInputLength < 5 ? 2 : mInputLength / 2;
 
     getWordsRec(0, 0, mInputLength * 3, false, 1, 0, 0);
 
-    if (DEBUG_DICT) LOGI("Returning %d words", mWords);
-    return mWords;
+    // Get the word count
+    suggWords = 0;
+    while (suggWords < mMaxWords && mFrequencies[suggWords] > 0) suggWords++;
+    if (DEBUG_DICT) LOGI("Returning %d words", suggWords);
+    return suggWords;
 }
 
 unsigned short
@@ -138,9 +141,6 @@ Dictionary::addWord(unsigned short *word, int length, int frequency)
             *dest++ = *word++;
         }
         *dest = 0; // NULL terminate
-        // Update the word count
-        mWords = 0;
-        while (mFrequencies[mWords] > 0) mWords++;
         if (DEBUG_DICT) LOGI("Added word at %d\n", insertAt);
         return true;
     }
diff --git a/dictionary/src/dictionary.h b/dictionary/src/dictionary.h
index 8f195ca9a..a12c035c8 100644
--- a/dictionary/src/dictionary.h
+++ b/dictionary/src/dictionary.h
@@ -60,7 +60,6 @@ private:
     int *mFrequencies;
     int mMaxWords;
     int mMaxWordLength;
-    int mWords;
     unsigned short *mOutputChars;
     int *mInputCodes;
     int mInputLength;