Fix for bug 81753, do not read past the end of unicode strings

source/i18n/rematch.cpp

 /*
 **************************************************************************
 *   Copyright (C) 2002-2010 International Business Machines Corporation  *
 *   and others. All rights reserved.                                     *
 **************************************************************************
 */
 //
 //  file:  rematch.cpp
 //
 //         Contains the implementation of class RegexMatcher,
@@ skipping 5580 matching lines @@
                     opValue = URX_VAL(op);
                     U_ASSERT(opType == URX_STRING_LEN);
                     stringLen = opValue;
                     
                     const UChar *patternChars = litText+stringStartIdx;
                     const UChar *patternEnd = patternChars+stringLen;
                     
                     const UChar *foldChars = NULL;
                     int32_t foldOffset, foldLength;
                     UChar32 c;
+                    UBool c_is_valid = FALSE;
                     
                     #ifdef REGEX_SMART_BACKTRACKING
                     int32_t originalInputIdx = fp->fInputIdx;
                     #endif
                     UBool success = TRUE;
                     
                     foldOffset = foldLength = 0;
 
                     while (patternChars < patternEnd && success) {
-                        if(foldOffset < foldLength) {
+                        if (fp->fInputIdx >= fActiveLimit) {
+                          // don't read past end of string
+                        } else if(foldOffset < foldLength) {
                             U16_NEXT_UNSAFE(foldChars, foldOffset, c);
+                            c_is_valid = TRUE;
                         } else {

[jungshik at Google, 2011/09/14 18:35:29]

How about rewritting the above if - elseif - else as following?

if (fp->fInputIdx < fActiveLimit)
    if (foldOffset < foldLength) 
          .....
     else 
          .....
}

[Brad Chen, 2011/09/14 19:10:06]

Done. Note this makes the patch quite a bit longer due to
indentation changes.

On 2011/09/14 18:35:29, Jungshik Shin wrote:

+                            // test pre-condition of U16_NEXT: i < length
+                            U_ASSERT(fp->fInputIdx < fActiveLimit);
                             U16_NEXT(inputBuf, fp->fInputIdx, fActiveLimit, c);
+                            c_is_valid = TRUE;
                             foldLength = ucase_toFullFolding(csp, c, &foldChars, U_FOLD_CASE_DEFAULT);
                             if(foldLength >= 0) {
                                 if(foldLength <= UCASE_MAX_STRING_LENGTH) {   // !!!: Does not correctly handle chars that fold to 0-length strings
                                     foldOffset = 0;
                                     U16_NEXT_UNSAFE(foldChars, foldOffset, c);
                                 } else {
                                     c = foldLength;
                                     foldLength = foldOffset; // to avoid reading chars from the folding buffer
                                 }
                             }
                         }
                         
-                        if (fp->fInputIdx <= fActiveLimit) {
+                        if (fp->fInputIdx <= fActiveLimit && c_is_valid) {
                             if (U_IS_BMP(c)) {
                                 success = (*patternChars == c);
                                 patternChars += 1;
                             } else if (patternChars+1 < patternEnd) {
                                 success = (*patternChars == U16_LEAD(c) && *(patternChars+1) == U16_TRAIL(c));
                                 patternChars += 2;
                             }
                         } else {
                             success = FALSE;
                             fHitEnd = TRUE;          //   TODO:  See ticket 6074
@@ skipping 426 matching lines @@
 
     return;
 }
 
 
 UOBJECT_DEFINE_RTTI_IMPLEMENTATION(RegexMatcher)
 
 U_NAMESPACE_END
 
 #endif  // !UCONFIG_NO_REGULAR_EXPRESSIONS
-