From 6c4b9c9ee19cc88a71a21da56acb3f5b883439e3 Mon Sep 17 00:00:00 2001
From: arshiya tabasum <arshi@bugqore.com>
Date: Thu, 23 Jul 2026 18:52:25 +0530
Subject: [PATCH] fix out-of-bounds read in normalize_cond_str on unterminated
 class

---
 modules/speller/default/affix.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/speller/default/affix.cpp b/modules/speller/default/affix.cpp
index f8ef2877..1a7ea9eb 100644
--- a/modules/speller/default/affix.cpp
+++ b/modules/speller/default/affix.cpp
@@ -222,6 +222,7 @@ static int normalize_cond_str(char * str)
         if (*s == '\0' || *s == '[') return -1;
         char * min = s;
         for (char * i = s + 1; *i != ']'; ++i) {
+          if (*i == '\0') return -1;
           if ((byte)*i < (byte)*min) min = i;}
         char c = *s;
         *d++ = *min;