Bug#805703: libthai0: th_wbrk goes into an infinite loop

[Theppitak Karoonboonyanan]

Control: tags -1 +patch

On Sat, Nov 21, 2015 at 9:33 AM, Zack Weinberg <za...@panix.com> wrote:

> /* expected output:           เพื่อ ให้ เหมาะสม กับ วิถีทาง ประเพณี ทาง ศาสนา 
> พุทธ */
> static const thwchar_t *x = L"เพื่อให้เหมาะสมกับวิถีทางประเพณีทางศาสนาพุทธ";

The minimal test case for this bug appears to be:
  L"ทางประเพณีทาง"
which causes double-free error.

And the next two words would trigger infinite loop:
  L"ทางประเพณีทางศาสนาพุทธ"

I've investigated this and found that it's caused by the optimization
in brk_recovery_try() in the recent release.

The attached patch should fix it.

I'm addressing it upstream and making a new release soon.
Thanks for catching it.

Regards,
-- 
Theppitak Karoonboonyanan
http://linux.thai.net/~thep/

Index: src/thbrk/brk-maximal.c
===================================================================
--- src/thbrk/brk-maximal.c	(revision 584)
+++ src/thbrk/brk-maximal.c	(working copy)
@@ -349,7 +349,7 @@
                 /* find matched nodes and delete them */
                 while (NULL != (match = brk_pool_match (pool_tail, node))) {
                     BrkPool *next = match->next;
-                    brk_pool_delete_node (pool_tail, match, env);
+                    pool = brk_pool_delete_node (pool, match, env);
                     pool_tail = next;
                 }
             }