diff options
| author | Jarkko Koivikko <[email protected]> | 2025-05-20 13:47:56 +0300 |
|---|---|---|
| committer | Volker Hilsheimer <[email protected]> | 2025-05-28 11:05:04 +0000 |
| commit | 8ead156d0a8c0df723658b4cfaf246f4e4b2de00 (patch) | |
| tree | d80bc86899c2f32b56cc0e29ce133ec403492b48 | |
| parent | 0057eb22486640a15034081d784a1f4a6e953fa1 (diff) | |
When a SPEI_WORD_BOUNDARY event is received after speech is stopped,
the event may reference text from a previous session, leading to
out-of-bounds access in currentText.sliced().
Pick-to: 6.9 6.8
Change-Id: Id764528fdc6e638d86a8dcccd77985fdf9c0fa3a
Reviewed-by: Volker Hilsheimer <[email protected]>
| -rw-r--r-- | src/plugins/tts/sapi/qtexttospeech_sapi.cpp | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/src/plugins/tts/sapi/qtexttospeech_sapi.cpp b/src/plugins/tts/sapi/qtexttospeech_sapi.cpp index 67d81ea..8def2f8 100644 --- a/src/plugins/tts/sapi/qtexttospeech_sapi.cpp +++ b/src/plugins/tts/sapi/qtexttospeech_sapi.cpp @@ -563,8 +563,10 @@ HRESULT QTextToSpeechEngineSapi::NotifyCallback(WPARAM /*wParam*/, LPARAM /*lPar m_state = QTextToSpeech::Ready; break; case SPEI_WORD_BOUNDARY: - emit sayingWord(currentText.sliced(event.lParam, event.wParam), - event.lParam - textOffset, event.wParam); + if (qsizetype(event.lParam + event.wParam) <= currentText.size()) { + emit sayingWord(currentText.sliced(event.lParam, event.wParam), + event.lParam - textOffset, event.wParam); + } break; // these are the other TTS events which might be interesting for us at some point case SPEI_SENTENCE_BOUNDARY: |