| OLD | NEW |
| (Empty) |
| 1 From e2beb15e5092bd882ba261e403daf76ef1b26456 Mon Sep 17 00:00:00 2001 | |
| 2 From: Scott Hess <shess@chromium.org> | |
| 3 Date: Fri, 26 Feb 2016 10:49:33 -0800 | |
| 4 Subject: [PATCH 13/13] [icu] Fix buffer overflow when case mapping expands too | |
| 5 far. | |
| 6 | |
| 7 Previously the buffer was doubled in size to accomodate cases where the | |
| 8 case-mapped version was larger, but some cases expand by more than | |
| 9 double. Detect U_BUFFER_OVERFLOW_ERROR and expand to the provided size. | |
| 10 | |
| 11 Original Chromium checkin: | |
| 12 https://codereview.chromium.org/1704103002 | |
| 13 --- | |
| 14 third_party/sqlite/src/ext/icu/icu.c | 31 +++++++++++++++++++++++++------ | |
| 15 third_party/sqlite/src/test/icu.test | 7 +++++++ | |
| 16 2 files changed, 32 insertions(+), 6 deletions(-) | |
| 17 | |
| 18 diff --git a/third_party/sqlite/src/ext/icu/icu.c b/third_party/sqlite/src/ext/i
cu/icu.c | |
| 19 index 7e2b800..d384f71 100644 | |
| 20 --- a/third_party/sqlite/src/ext/icu/icu.c | |
| 21 +++ b/third_party/sqlite/src/ext/icu/icu.c | |
| 22 @@ -341,26 +341,45 @@ static void icuCaseFunc16(sqlite3_context *p, int nArg, sq
lite3_value **apArg){ | |
| 23 if( !zInput ){ | |
| 24 return; | |
| 25 } | |
| 26 - nInput = sqlite3_value_bytes16(apArg[0]); | |
| 27 + nOutput = nInput = sqlite3_value_bytes16(apArg[0]); | |
| 28 | |
| 29 - nOutput = nInput * 2 + 2; | |
| 30 zOutput = sqlite3_malloc(nOutput); | |
| 31 if( !zOutput ){ | |
| 32 return; | |
| 33 } | |
| 34 | |
| 35 if( sqlite3_user_data(p) ){ | |
| 36 - u_strToUpper(zOutput, nOutput/2, zInput, nInput/2, zLocale, &status); | |
| 37 + nOutput = u_strToUpper( | |
| 38 + zOutput, nOutput/2, zInput, nInput/2, zLocale, &status) * 2; | |
| 39 }else{ | |
| 40 - u_strToLower(zOutput, nOutput/2, zInput, nInput/2, zLocale, &status); | |
| 41 + nOutput = u_strToLower( | |
| 42 + zOutput, nOutput/2, zInput, nInput/2, zLocale, &status) * 2; | |
| 43 } | |
| 44 | |
| 45 - if( !U_SUCCESS(status) ){ | |
| 46 + if ( status == U_BUFFER_OVERFLOW_ERROR ) { | |
| 47 + UChar* newOutput = sqlite3_realloc(zOutput, nOutput); | |
| 48 + if( !newOutput ){ | |
| 49 + sqlite3_free(zOutput); | |
| 50 + return; | |
| 51 + } | |
| 52 + zOutput = newOutput; | |
| 53 + status = U_ZERO_ERROR; | |
| 54 + if( sqlite3_user_data(p) ){ | |
| 55 + nOutput = u_strToUpper( | |
| 56 + zOutput, nOutput/2, zInput, nInput/2, zLocale, &status) * 2; | |
| 57 + }else{ | |
| 58 + nOutput = u_strToLower( | |
| 59 + zOutput, nOutput/2, zInput, nInput/2, zLocale, &status) * 2; | |
| 60 + } | |
| 61 + } | |
| 62 + | |
| 63 + if( U_FAILURE(status) ){ | |
| 64 icuFunctionError(p, "u_strToLower()/u_strToUpper", status); | |
| 65 + sqlite3_free(zOutput); | |
| 66 return; | |
| 67 } | |
| 68 | |
| 69 - sqlite3_result_text16(p, zOutput, -1, xFree); | |
| 70 + sqlite3_result_text16(p, zOutput, nOutput, xFree); | |
| 71 } | |
| 72 | |
| 73 /* | |
| 74 diff --git a/third_party/sqlite/src/test/icu.test b/third_party/sqlite/src/test/
icu.test | |
| 75 index 73cb9b9..22948aa 100644 | |
| 76 --- a/third_party/sqlite/src/test/icu.test | |
| 77 +++ b/third_party/sqlite/src/test/icu.test | |
| 78 @@ -56,6 +56,10 @@ set ::ograve "\xF2" | |
| 79 # | |
| 80 set ::szlig "\xDF" | |
| 81 | |
| 82 +# U+FB03 (ffi ligature) and U+FB04 (ffl ligature). They're uppercased | |
| 83 +# to 'FFI' and 'FFL'. | |
| 84 +set ::ffi_ffl "\ufb03\ufb04" | |
| 85 + | |
| 86 # Tests of the upper()/lower() functions. | |
| 87 # | |
| 88 test_expr icu-2.1 {i1='HellO WorlD'} {upper(i1)} {HELLO WORLD} | |
| 89 @@ -72,6 +76,9 @@ test_expr icu-2.6 {i1=$::OGRAVE} {upper(i1)} $::OGRAVE | |
| 90 test_expr icu-2.7 {i1=$::szlig} {upper(i1)} "SS" | |
| 91 test_expr icu-2.8 {i1='SS'} {lower(i1)} "ss" | |
| 92 | |
| 93 +test_expr icu-2.9 {i1=$::ffi_ffl} {upper(i1)} "FFIFFL" | |
| 94 +test_expr icu-2.10 {i1=$::ffi_ffl} {lower(i1)} $::ffi_ffl | |
| 95 + | |
| 96 # In turkish (locale="tr_TR"), the lower case version of I | |
| 97 # is "small dotless i" (code point 0x131 (decimal 305)). | |
| 98 # | |
| 99 -- | |
| 100 2.7.0 | |
| 101 | |
| OLD | NEW |