Add boundary check for SparseTable.

Bug: 13592288
Change-Id: I8bc4ff778c6073d22f86b6050a880b6fb69de31e

1 files changed, 6 insertions, 0 deletions

diff --git a/native/jni/src/suggest/policyimpl/dictionary/utils/sparse_table.cpp b/native/jni/src/suggest/policyimpl/dictionary/utils/sparse_table.cpp
index 810827dd0..d336306b9 100644
--- a/native/jni/src/suggest/policyimpl/dictionary/utils/sparse_table.cpp
+++ b/native/jni/src/suggest/policyimpl/dictionary/utils/sparse_table.cpp
@@ -34,6 +34,12 @@ uint32_t SparseTable::get(const int id) const {
     const int indexTableReadingPos = getPosInIndexTable(id);
     const int index = mIndexTableBuffer->readUint(INDEX_SIZE, indexTableReadingPos);
     const int contentTableReadingPos = getPosInContentTable(id, index);
+    if (contentTableReadingPos < 0
+            || contentTableReadingPos >= mContentTableBuffer->getTailPosition()) {
+        AKLOGE("contentTableReadingPos(%d) is invalid. id: %d, index: %d",
+                contentTableReadingPos, id, index);
+        return NOT_A_DICT_POS;
+    }
     const int contentValue = mContentTableBuffer->readUint(mDataSize, contentTableReadingPos);
     return contentValue == NOT_EXIST ? NOT_A_DICT_POS : contentValue;
 }