Fix unaligned memory accesses in enchant (bug #51289)

diff --git a/ext/enchant/enchant.c b/ext/enchant/enchant.c
index 78ad035de1e0959af1899d150cb8fe9c7d06f33b..a2ca8853b78a63a694d3906b01d0e58639ef1670 100755 (executable)
--- a/ext/enchant/enchant.c
+++ b/ext/enchant/enchant.c
@@ -728,6 +728,7 @@ PHP_FUNCTION(enchant_dict_quick_check)
 
        if (enchant_dict_check(pdict->pdict, word, wordlen) > 0) {
                int n_sugg;
+               size_t n_sugg_st;
                char **suggs;
 
                if (!sugg && ZEND_NUM_ARGS() == 2) {
@@ -736,7 +737,8 @@ PHP_FUNCTION(enchant_dict_quick_check)
 
                array_init(sugg);
 
-               suggs = enchant_dict_suggest(pdict->pdict, word, wordlen, (size_t *) &n_sugg);
+               suggs = enchant_dict_suggest(pdict->pdict, word, wordlen, n_sugg_st);
+               memcpy(&n_sugg, &n_sugg_st, sizeof(n_sugg));
                if (suggs && n_sugg) {
                        int i;
                        for (i = 0; i < n_sugg; i++) {
@@ -781,6 +783,7 @@ PHP_FUNCTION(enchant_dict_suggest)
        char **suggs;
        enchant_dict *pdict;
        int n_sugg;
+       size_t n_sugg_st;
 
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rs", &dict, &word, &wordlen) == FAILURE) {
                RETURN_FALSE;
@@ -788,7 +791,8 @@ PHP_FUNCTION(enchant_dict_suggest)
 
        PHP_ENCHANT_GET_DICT;
 
-       suggs = enchant_dict_suggest(pdict->pdict, word, wordlen, (size_t *)&n_sugg);
+       suggs = enchant_dict_suggest(pdict->pdict, word, wordlen, &n_sugg_st);
+       memcpy(&n_sugg, &n_sugg_st, sizeof(n_sugg));
        if (suggs && n_sugg) {
                int i;
 

diff --git a/ext/enchant/tests/dict_quick_check.phpt b/ext/enchant/tests/dict_quick_check.phpt
new file mode 100644 (file)
index 0000000..3412de1
--- /dev/null
+++ b/ext/enchant/tests/dict_quick_check.phpt
@@ -0,0 +1,26 @@
+--TEST--
+enchant_dict_quick_check() basic test
+--SKIPIF--
+<?php
+if(!extension_loaded('enchant')) die('skip, enchant not loader');
+
+$tag = 'en_US';
+$r = enchant_broker_init();
+if (!enchant_broker_dict_exists($r, $tag))
+    die('skip, no dictionary for ' . $tag . ' tag');
+?>
+--FILE--
+<?php
+
+$tag = 'en_US';
+$r = enchant_broker_init();
+
+$d = enchant_broker_request_dict($r, $tag);
+enchant_dict_quick_check($d, 'soong', $suggs);
+
+echo "Elements: " . count($suggs) . "\n";
+echo "Done\n";
+?>
+--EXPECTF--
+Elements: %d
+Done