Resolves: rhbz#1771027 CVE-2019-16707

0001-invalid-read-memory-access-624.patch

@@ -0,0 +1,25 @@
+From ac938e2ecb48ab4dd21298126c7921689d60571b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Tue, 12 Nov 2019 20:03:15 +0000
+Subject: [PATCH] invalid read memory access #624
+
+---
+ src/hunspell/suggestmgr.cxx | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/hunspell/suggestmgr.cxx b/src/hunspell/suggestmgr.cxx
+index dba084e..c23f165 100644
+--- a/src/hunspell/suggestmgr.cxx
++++ b/src/hunspell/suggestmgr.cxx
+@@ -2040,7 +2040,7 @@ int SuggestMgr::leftcommonsubstring(
+   int l2 = su2.size();
+   // decapitalize dictionary word
+   if (complexprefixes) {
+-    if (su1[l1 - 1] == su2[l2 - 1])
++    if (l1 && l2 && su1[l1 - 1] == su2[l2 - 1])
+       return 1;
+   } else {
+     unsigned short idx = su2.empty() ? 0 : (su2[0].h << 8) + su2[0].l;
+-- 
+2.23.0
+

hunspell.spec

@@ -3,7 +3,7 @@
 Name:      hunspell
 Summary:   A spell checker and morphological analyzer library
 Version:   1.7.0
-Release:   3%{?dist}
+Release:   4%{?dist}
 Source:    https://github.com/hunspell/hunspell/archive/v%{version}.tar.gz
 URL:       https://github.com/hunspell/hunspell
 License:   LGPLv2+ or GPLv2+ or MPLv1.1
@@ -18,6 +18,8 @@ BuildRequires: words
 %endif
 Requires:  hunspell-en-US
 
+Patch0: 0001-invalid-read-memory-access-624.patch
+
 %description
 Hunspell is a spell checker and morphological analyzer library and program 
 designed for languages with rich morphology and complex word compounding or 
@@ -33,6 +35,7 @@ Includes and definitions for developing with hunspell
 
 %prep
 %setup -q
+%patch0 -p1 -b .CVE-2019-16707
 
 %build
 autoreconf -vfi
@@ -114,6 +117,9 @@ mkdir $RPM_BUILD_ROOT/%{_datadir}/myspell
 %{_mandir}/man5/hunspell.5.gz
 
 %changelog
+* Tue Nov 12 2019 Caolán McNamara <caolanm@redhat.com> - 1.7.0-4
+- Resolves: rhbz#1771027 CVE-2019-16707
+
 * Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.7.0-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild