From feec253b5971a60b84f69f1db603e7d0e53847d8 Mon Sep 17 00:00:00 2001
From: ksqsf <i@ksqsf.moe>
Date: Mon, 22 Apr 2024 00:07:32 +0800
Subject: [PATCH] fix(script_translator): correction can cause segfault (#863)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(script_translator): correction can cause segfault

When finding the candidates for the last page,
ScriptTranslation::PrepareCandidate can return nullptr, leading
to segfault.

    ++correction_count_ > max_corrections_

it is the correct logic to discard more correction candidates after the top N;
if inverted, all correction candidates except the top N are displayed.

correctly update member variables for the no more candidates to display case.

---------

Co-authored-by: 居戎氏 <chen.sst@gmail.com>
---
 src/rime/gear/script_translator.cc | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/src/rime/gear/script_translator.cc b/src/rime/gear/script_translator.cc
index 853b8fc33c..028b659e58 100644
--- a/src/rime/gear/script_translator.cc
+++ b/src/rime/gear/script_translator.cc
@@ -392,9 +392,7 @@ bool ScriptTranslation::Evaluate(Dictionary* dict, UserDictionary* user_dict) {
 }
 
 bool ScriptTranslation::Next() {
-  bool is_correction;
   do {
-    is_correction = false;
     if (exhausted())
       return false;
     if (candidate_source_ == kUninitialized) {
@@ -432,8 +430,11 @@ bool ScriptTranslation::Next() {
            syllabifier_->IsCandidateCorrection(*candidate_) &&
            // limit the number of correction candidates
            ++correction_count_ > max_corrections_);
-  ++candidate_index_;
-  return !CheckEmpty();
+  if (!CheckEmpty()) {
+    ++candidate_index_;
+    return true;
+  }
+  return false;
 }
 
 bool ScriptTranslation::IsNormalSpelling() const {
@@ -515,6 +516,7 @@ bool ScriptTranslation::PrepareCandidate() {
     candidate_->set_quality(std::exp(entry->weight) +
                             translator_->initial_quality() +
                             (IsNormalSpelling() ? 0.5 : -0.5));
+    return true;
   } else if (phrase_code_length > 0) {
     DictEntryIterator& iter = phrase_iter_->second;
     const auto& entry = iter.Peek();
@@ -528,8 +530,12 @@ bool ScriptTranslation::PrepareCandidate() {
     candidate_->set_quality(std::exp(entry->weight) +
                             translator_->initial_quality() +
                             (IsNormalSpelling() ? 0 : -1));
+    return true;
+  } else {
+    candidate_source_ = kUninitialized;
+    candidate_ = nullptr;
+    return false;
   }
-  return true;
 }
 
 bool ScriptTranslation::CheckEmpty() {