I bet there's multiple issues in the text input / autocorrect buffer bounds checking. It's possibly an exploitable security issue too, or at least a nice area for research.