Fix buffer overflow in _canonicalize.

source/common/uloc.c

Index: source/common/uloc.c
===================================================================
--- source/common/uloc.c	(revision 113138)
+++ source/common/uloc.c	(working copy)
@@ -1797,7 +1797,7 @@
                 int32_t variantLen = _deleteVariant(variant, uprv_min(variantSize, (nameCapacity-len)), variantToCompare, n);
                 len -= variantLen;
                 if (variantLen > 0) {
-                    if (name[len-1] == '_') { /* delete trailing '_' */
+                    if (len > 0 && name[len-1] == '_') { /* delete trailing '_' */
                         --len;
                     }
                     addKeyword = VARIANT_MAP[j].keyword;
@@ -1805,7 +1805,7 @@
                     break;
                 }
             }
-            if (name[len-1] == '_') { /* delete trailing '_' */
+            if (len > 0 && len <= nameCapacity && name[len-1] == '_') { /* delete trailing '_' */

[falken, 2011/12/06 08:13:29]

In the testcase attached on the bug, len > nameCapacity here causing the out of
bounds access.  In other accesses in this function there is a check for that.

I'm not sure if the len > 0 is needed, but it seems possible  that len can be 0
here and above.

                 --len;
             }
         }