ICU-22497 Fix buffer-overflow READ for toLanguateTag

unicode-org · Sep 12, 2023 · 68a61da · 68a61da
1 parent 35645ab
commit 68a61da
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 2 deletions.
diff --git a/icu4c/source/common/uloc_tag.cpp b/icu4c/source/common/uloc_tag.cpp
@@ -1952,8 +1952,8 @@ _appendPrivateuseToLanguageTag(const char* localeID, icu::ByteSink& sink, UBool
  len = (int32_t)uprv_strlen(PRIVUSE_VARIANT_PREFIX);
  if (reslen < capacity) {
  uprv_memcpy(tmpAppend + reslen, PRIVUSE_VARIANT_PREFIX, uprv_min(len, capacity - reslen));
+ reslen += uprv_min(len, capacity - reslen);
  }
- reslen += len;
 
  if (reslen < capacity) {
  tmpAppend[reslen++] = SEP;
@@ -1965,8 +1965,8 @@ _appendPrivateuseToLanguageTag(const char* localeID, icu::ByteSink& sink, UBool
  len = (int32_t)uprv_strlen(pPriv);
  if (reslen < capacity) {
  uprv_memcpy(tmpAppend + reslen, pPriv, uprv_min(len, capacity - reslen));
+ reslen += uprv_min(len, capacity - reslen);
  }
- reslen += len;
  }
  }
  /* reset private use starting position */
@@ -1984,6 +1984,7 @@ _appendPrivateuseToLanguageTag(const char* localeID, icu::ByteSink& sink, UBool
 
  if (U_SUCCESS(*status)) {
  len = reslen;
+ U_ASSERT(reslen <= capacity);
  sink.Append(tmpAppend, len);
  }
 }

diff --git a/icu4c/source/test/intltest/loctest.cpp b/icu4c/source/test/intltest/loctest.cpp
@@ -5980,6 +5980,8 @@ void LocaleTest::TestToLanguageTag() {
  {"und-Latn-x-private", "und-Latn-x-private"},
  {"und-1994-biske-rozaj", "und-1994-biske-rozaj"},
  {"und-1994-biske-rozaj-x-private", "und-1994-biske-rozaj-x-private"},
+ // ICU-22497
+ {"-ins0-ins17Rz-yqyq-UWLF-uRyq-UWLF-uRRyq-UWLF-uR-UWLF-uRns0-ins17Rz-yq-UWLF-uRyq-UWLF-uRRyq-LF-uRyq-UWLF-uRRyq-UWLF-uRq-UWLF-uRyq-UWLF-uRRyq-UWLF-uR", ""},
  };
  int32_t i;
  for (i=0; i < UPRV_LENGTHOF(testCases); i++) {
@@ -5993,6 +5995,12 @@ void LocaleTest::TestToLanguageTag() {
  tag.c_str(),
  u_errorName(status));
  }
+ // Test ICU-22497
+ status = U_ZERO_ERROR;
+ icu::Locale locale(otag.c_str());
+ char buf[245];
+ icu::CheckedArrayByteSink sink(buf, sizeof(buf));
+ locale.toLanguageTag(sink, status);
  }
 }