src/pwl.c: fix buffer overflow in trie matching

Add an extra byte to the ‘word’ buffer, as the check for transposed
characters can look two characters (here, NULs, so one character per byte)
past the end of the buffer.

1 files changed, 1 insertions, 1 deletions

diff --git a/src/pwl.c b/src/pwl.c
index f0c9d13..ecd7eed 100644
--- a/src/pwl.c
+++ b/src/pwl.c
@@ -964,7 +964,7 @@ static EnchantTrieMatcher* enchant_trie_matcher_init(const char* const word,
 	EnchantTrieMatcher* matcher = g_new(EnchantTrieMatcher,1);
 	matcher->num_errors = 0;
 	matcher->max_errors = maxerrs;
-	matcher->word = g_new0(char,len+maxerrs+1); // Ensure matcher does not overrun buffer
+	matcher->word = g_new0(char,len+maxerrs+2); // Ensure matcher does not overrun buffer: +2 for transpose check
 	strcpy(matcher->word, pattern);
 	g_free(pattern);
 	matcher->word_pos = 0;