src/third_party/icu/patches/uloc.patch

   1 Index: source/common/uloc.c
   2 ===================================================================
   3 --- source/common/uloc.c        (revision 68397)
   4 +++ source/common/uloc.c        (working copy)
   5 @@ -693,6 +693,13 @@
   6                      keywordList[numKeywords].keyword[n++] = uprv_tolower(pos[i]);
   7                  }
   8              }
   9 +
  10 +            /* zero-length keyword is an error. */
  11 +            if (n == 0) {
  12 +                *status = U_INVALID_FORMAT_ERROR;
  13 +                return 0;
  14 +            }
  15 +
  16              keywordList[numKeywords].keyword[n] = 0;
  17              keywordList[numKeywords].keywordLen = n;
  18              /* now grab the value part. First we skip the '=' */
  19 @@ -701,8 +708,15 @@
  20              while(*equalSign == ' ') {
  21                  equalSign++;
  22              }
  23 +
  24 +            /* Premature end or zero-length value */
  25 +            if (!equalSign || equalSign == semicolon) {
  26 +                *status = U_INVALID_FORMAT_ERROR;
  27 +                return 0;
  28 +            }
  29 +
  30              keywordList[numKeywords].valueStart = equalSign;
  31 -
  32 +
  33              pos = semicolon;
  34              i = 0;
  35              if(pos) {
  36 @@ -713,7 +727,7 @@
  37                  pos++;
  38              } else {
  39                  i = (int32_t)uprv_strlen(equalSign);
  40 -                while(equalSign[i-1] == ' ') {
  41 +                while(i && equalSign[i-1] == ' ') {
  42                      i--;
  43                  }
  44                  keywordList[numKeywords].valueLen = i;
  45 @@ -1797,7 +1811,7 @@
  46                  int32_t variantLen = _deleteVariant(variant, uprv_min(variantSize, (nameCapacity-len)), variantToCompare, n);
  47                  len -= variantLen;
  48                  if (variantLen > 0) {
  49 -                    if (name[len-1] == '_') { /* delete trailing '_' */
  50 +                    if (len > 0 && name[len-1] == '_') { /* delete trailing '_' */
  51                          --len;
  52                      }
  53                      addKeyword = VARIANT_MAP[j].keyword;
  54 @@ -1805,7 +1819,7 @@
  55                      break;
  56                  }
  57              }
  58 -            if (name[len-1] == '_') { /* delete trailing '_' */
  59 +            if (len > 0 && len <= nameCapacity && name[len-1] == '_') { /* delete trailing '_' */
  60                  --len;
  61              }
  62          }
  63 Index: source/common/uresbund.c
  64 ===================================================================
  65 --- source/common/uresbund.c    (revision 122103)
  66 +++ source/common/uresbund.c    (working copy)
  67 @@ -319,7 +319,7 @@
  68      UResourceDataEntry *r = NULL;
  69      UResourceDataEntry find;
  70      /*int32_t hashValue;*/
  71 -    char name[96];
  72 +    char name[100];
  73      char aliasName[100] = { 0 };
  74      int32_t aliasLen = 0;
  75      /*UBool isAlias = FALSE;*/
  76 @@ -528,8 +528,8 @@
  77      UBool hasChopped = TRUE;
  78      UBool usingUSRData = U_USE_USRDATA && ( path == NULL || uprv_strncmp(path,U_ICUDATA_NAME,8) == 0);
  79
  80 -    char name[96];
  81 -    char usrDataPath[96];
  82 +    char name[100];
  83 +    char usrDataPath[100];
  84
  85      initCache(status);
  86