ICU-22466 Fix incorrect memory read while the locale is bogus

ICU-22466 Fix illegal read ICU-22466 Fix memory issue
unicode-org · Aug 22, 2023 · 5d6d197 · 5d6d197
1 parent 667ee72
commit 5d6d197
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 1 deletion.
diff --git a/icu4c/source/common/loclikely.cpp b/icu4c/source/common/loclikely.cpp
@@ -483,7 +483,16 @@ _uloc_addLikelySubtags(const char* localeID,
  if(U_FAILURE(*err)) {
  goto error;
  }
- icu::LSR lsr = likelySubtags->makeMaximizedLsrFrom(icu::Locale::createFromName(localeID), true, *err);
+ // We need to keep l on the stack because lsr may point into internal
+ // memory of l.
+ icu::Locale l = icu::Locale::createFromName(localeID);
+ if (l.isBogus()) {
+ goto error;
+ }
+ icu::LSR lsr = likelySubtags->makeMaximizedLsrFrom(l, true, *err);
+ if(U_FAILURE(*err)) {
+ goto error;
+ }
  const char* language = lsr.language;
  if (uprv_strcmp(language, "und") == 0) {
  language = "";

diff --git a/icu4c/source/common/loclikelysubtags.cpp b/icu4c/source/common/loclikelysubtags.cpp
@@ -456,6 +456,10 @@ XLikelySubtags::~XLikelySubtags() {
 LSR XLikelySubtags::makeMaximizedLsrFrom(const Locale &locale,
  bool returnInputIfUnmatch,
  UErrorCode &errorCode) const {
+ if (locale.isBogus()) {
+ errorCode = U_ILLEGAL_ARGUMENT_ERROR;
+ return LSR("", "", "", LSR::EXPLICIT_LSR);
+ }
  const char *name = locale.getName();
  if (uprv_isAtSign(name[0]) && name[1] == 'x' && name[2] == '=') { // name.startsWith("@x=")
  // Private use language tag x-subtag-subtag... which CLDR changes to

diff --git a/icu4c/source/test/cintltst/cloctst.c b/icu4c/source/test/cintltst/cloctst.c
@@ -6886,6 +6886,10 @@ static void TestIsRightToLeft() {
  if(uloc_isRightToLeft("root") || !uloc_isRightToLeft("EN-HEBR")) {
  log_err("uloc_isRightToLeft() failed");
  }
+ // ICU-22466 Make sure no crash when locale is bogus
+ uloc_isRightToLeft(
+ "uF-Vd_u-VaapoPos-u1-Pos-u1-Pos-u1-Pos-u1-oPos-u1-Pufu1-PuosPos-u1-Pos-u1-Pos-u1-Pzghu1-Pos-u1-PoP-u1@osus-u1");
+ uloc_isRightToLeft("-Xa");
 }
 
 typedef struct {