fix heap overflow in SfxEntry::add when strip exceeds word length

[arshsmith1]

SfxEntry::add checks the suffix conditions against orig_word but computes the copy length from word, which can be shorter once a cross-product prefix has already stripped it. When word is shorter than the suffix strip, word.size - stripl wraps and the following buf.alloc/memcpy run with a negative length, so an affix file with a cross-product prefix that shortens the word plus a suffix whose strip is longer overflows the heap during expand (for example the line aaaaac/AB with PFX A stripping aaaaa and SFX B stripping aaac). Bail out with an empty result when word can't hold the strip, matching the guard PfxEntry::add and SfxEntry::applicable already use.

[kevina]

Please open an issue with a simple test case that demonstrates the problem.

[arshsmith1]

Done, opened #688 with a minimal test case. It's a two-file affix dir plus iso-8859-1.cset, and echo 'aaaaac/AB' | aspell ... expand triggers the overflow (ASan reports negative-size-param in the memcpy at affix.cpp:1203). The prefix shortens aaaaac to bc while the suffix strip is longer than what's left, so alen wraps negative.