From 0063497c6ef0a9596ddce4bdd58752c0e7ab2742 Mon Sep 17 00:00:00 2001
From: leaion <79207964+leaion@users.noreply.github.com>
Date: Mon, 3 Aug 2026 14:54:30 +0800
Subject: [PATCH] fix(linux): fcitx5 plugin crash on empty triggerKeyList with
 raw hotkey (#883)

When the raw hotkey path (SetHotkeyRaw) matches and triggerRawStates==0,
the code unconditionally indexes triggerKeyList_[0]. With an empty
KeyList (common in raw mode), this is undefined behavior and segfaults
fcitx5 on every hotkey press. Only access the list when the KeyList
path matched; use raw values for the raw path.

Co-authored-by: leaion <leaion@sohu.com>
---
 .../scripts/linux-fcitx5-plugin/openless.cpp   | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/openless-all/scripts/linux-fcitx5-plugin/openless.cpp b/openless-all/scripts/linux-fcitx5-plugin/openless.cpp
index 47db639c..5f7c585d 100644
--- a/openless-all/scripts/linux-fcitx5-plugin/openless.cpp
+++ b/openless-all/scripts/linux-fcitx5-plugin/openless.cpp
@@ -139,10 +139,20 @@ public:
                             }
                             return false;
                         }())) {
-                        auto dsym = triggerRawSym_ != 0 ? triggerRawSym_
-                            : static_cast<uint32_t>(triggerKeyList_[0].sym());
-                        auto dstates = triggerRawStates_ != 0 ? triggerRawStates_
-                            : static_cast<uint32_t>(triggerKeyList_[0].states());
+                        // 修复崩溃: raw 路径(SetHotkeyRaw)匹配时若 triggerRawStates_==0,
+                        // 原代码会无条件取 triggerKeyList_[0];而 raw 模式常伴随空 KeyList
+                        // (见 openless.conf: TriggerKey= 为空), 对空 vector 取下标 [0]
+                        // 是未定义行为, 直接导致 fcitx5 段错误 (Key::states 读野指针)。
+                        // 修正: 只有 KeyList 路径匹配时才访问列表, raw 路径直接用 raw 值。
+                        uint32_t dsym = triggerRawSym_;
+                        uint32_t dstates = triggerRawStates_;
+                        if (triggerRawSym_ == 0 && !triggerKeyList_.empty()) {
+                            dsym = static_cast<uint32_t>(triggerKeyList_[0].sym());
+                            dstates = static_cast<uint32_t>(triggerKeyList_[0].states());
+                        }
+                        if (dsym == 0) {
+                            return;
+                        }
                         if (!hasCustomDictationKey_ && isModifierKeySym(dsym)) {
                             dictationTriggerHeld_ = isPress;
                             if (isPress) {