Fix buffer overflow in _canonicalize.

source/common/uloc.c

 /*
 **********************************************************************
 *   Copyright (C) 1997-2010, International Business Machines
 *   Corporation and others.  All Rights Reserved.
 **********************************************************************
 *
 * File ULOC.CPP
 *
 * Modification History:
 *
@@ skipping 1779 matching lines @@
         }
 
         /* Handle generic variants first */
         if (variant) {
             for (j=0; j<(int32_t)(sizeof(VARIANT_MAP)/sizeof(VARIANT_MAP[0])); j++) {
                 const char* variantToCompare = VARIANT_MAP[j].variant;
                 int32_t n = (int32_t)uprv_strlen(variantToCompare);
                 int32_t variantLen = _deleteVariant(variant, uprv_min(variantSize, (nameCapacity-len)), variantToCompare, n);
                 len -= variantLen;
                 if (variantLen > 0) {
-                    if (name[len-1] == '_') { /* delete trailing '_' */
+                    if (len > 0 && name[len-1] == '_') { /* delete trailing '_' */
                         --len;
                     }
                     addKeyword = VARIANT_MAP[j].keyword;
                     addValue = VARIANT_MAP[j].value;
                     break;
                 }
             }
-            if (name[len-1] == '_') { /* delete trailing '_' */
+            if (len > 0 && len <= nameCapacity && name[len-1] == '_') { /* delete trailing '_' */

[falken, 2011/12/06 08:13:29]

In the testcase attached on the bug, len > nameCapacity here causing the out of
bounds access.  In other accesses in this function there is a check for that.

I'm not sure if the len > 0 is needed, but it seems possible  that len can be 0
here and above.

                 --len;
             }
         }
 
         /* Look up the ID in the canonicalization map */
         for (j=0; j<(int32_t)(sizeof(CANONICALIZE_MAP)/sizeof(CANONICALIZE_MAP[0])); j++) {
             const char* id = CANONICALIZE_MAP[j].id;
             int32_t n = (int32_t)uprv_strlen(id);
             if (len == n && uprv_strncmp(name, id, n) == 0) {
                 if (n == 0 && tmpLocaleID != NULL) {
@@ skipping 673 matching lines @@
         }
     }
     for(i=0;i<acceptListCount;i++) {
         uprv_free(fallbackList[i]);
     }
     uprv_free(fallbackList);
     return -1;
 }
 
 /*eof*/