From 0624a81a95d99a062bc9f9c314c8a6399bc31250 Mon Sep 17 00:00:00 2001
From: arshiya tabasum <arshi@bugqore.com>
Date: Mon, 6 Jul 2026 12:44:16 +0530
Subject: [PATCH] fix heap overflow in SfxEntry::add when strip exceeds word
 length

---
 modules/speller/default/affix.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/speller/default/affix.cpp b/modules/speller/default/affix.cpp
index f8ef2877..5e9d6f54 100644
--- a/modules/speller/default/affix.cpp
+++ b/modules/speller/default/affix.cpp
@@ -1196,6 +1196,10 @@ SimpleString SfxEntry::add(SimpleString word, ObjStack & buf,
         break;
     }
     if (cond < 0) {
+      // conditions are checked against orig_word, but the suffix is
+      // stripped from word, which may be shorter (e.g. after a
+      // cross-product prefix).  Bail if it can't hold the strip.
+      if (word.size <= stripl) return SimpleString();
       int alen = word.size - stripl;
       if (alen >= limit) return EMPTY;
       /* we have a match so add suffix */