Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(48)

Side by Side Diff: third_party/sqlite/patches/0013-icu-Fix-buffer-overflow-when-case-mapping-expands-to.patch

Issue 1746453002: [sqlite] Backport icuCaseFunc16 patch from SQLite. Base URL: https://chromium.googlesource.com/chromium/src.git@zzsql_patch_backport_icu_compare
Patch Set: Created 4 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
(Empty)
1 From e2beb15e5092bd882ba261e403daf76ef1b26456 Mon Sep 17 00:00:00 2001
2 From: Scott Hess <shess@chromium.org>
3 Date: Fri, 26 Feb 2016 10:49:33 -0800
4 Subject: [PATCH 13/13] [icu] Fix buffer overflow when case mapping expands too
5 far.
6
7 Previously the buffer was doubled in size to accomodate cases where the
8 case-mapped version was larger, but some cases expand by more than
9 double. Detect U_BUFFER_OVERFLOW_ERROR and expand to the provided size.
10
11 Original Chromium checkin:
12 https://codereview.chromium.org/1704103002
13 ---
14 third_party/sqlite/src/ext/icu/icu.c | 31 +++++++++++++++++++++++++------
15 third_party/sqlite/src/test/icu.test | 7 +++++++
16 2 files changed, 32 insertions(+), 6 deletions(-)
17
18 diff --git a/third_party/sqlite/src/ext/icu/icu.c b/third_party/sqlite/src/ext/i cu/icu.c
19 index 7e2b800..d384f71 100644
20 --- a/third_party/sqlite/src/ext/icu/icu.c
21 +++ b/third_party/sqlite/src/ext/icu/icu.c
22 @@ -341,26 +341,45 @@ static void icuCaseFunc16(sqlite3_context *p, int nArg, sq lite3_value **apArg){
23 if( !zInput ){
24 return;
25 }
26 - nInput = sqlite3_value_bytes16(apArg[0]);
27 + nOutput = nInput = sqlite3_value_bytes16(apArg[0]);
28
29 - nOutput = nInput * 2 + 2;
30 zOutput = sqlite3_malloc(nOutput);
31 if( !zOutput ){
32 return;
33 }
34
35 if( sqlite3_user_data(p) ){
36 - u_strToUpper(zOutput, nOutput/2, zInput, nInput/2, zLocale, &status);
37 + nOutput = u_strToUpper(
38 + zOutput, nOutput/2, zInput, nInput/2, zLocale, &status) * 2;
39 }else{
40 - u_strToLower(zOutput, nOutput/2, zInput, nInput/2, zLocale, &status);
41 + nOutput = u_strToLower(
42 + zOutput, nOutput/2, zInput, nInput/2, zLocale, &status) * 2;
43 }
44
45 - if( !U_SUCCESS(status) ){
46 + if ( status == U_BUFFER_OVERFLOW_ERROR ) {
47 + UChar* newOutput = sqlite3_realloc(zOutput, nOutput);
48 + if( !newOutput ){
49 + sqlite3_free(zOutput);
50 + return;
51 + }
52 + zOutput = newOutput;
53 + status = U_ZERO_ERROR;
54 + if( sqlite3_user_data(p) ){
55 + nOutput = u_strToUpper(
56 + zOutput, nOutput/2, zInput, nInput/2, zLocale, &status) * 2;
57 + }else{
58 + nOutput = u_strToLower(
59 + zOutput, nOutput/2, zInput, nInput/2, zLocale, &status) * 2;
60 + }
61 + }
62 +
63 + if( U_FAILURE(status) ){
64 icuFunctionError(p, "u_strToLower()/u_strToUpper", status);
65 + sqlite3_free(zOutput);
66 return;
67 }
68
69 - sqlite3_result_text16(p, zOutput, -1, xFree);
70 + sqlite3_result_text16(p, zOutput, nOutput, xFree);
71 }
72
73 /*
74 diff --git a/third_party/sqlite/src/test/icu.test b/third_party/sqlite/src/test/ icu.test
75 index 73cb9b9..22948aa 100644
76 --- a/third_party/sqlite/src/test/icu.test
77 +++ b/third_party/sqlite/src/test/icu.test
78 @@ -56,6 +56,10 @@ set ::ograve "\xF2"
79 #
80 set ::szlig "\xDF"
81
82 +# U+FB03 (ffi ligature) and U+FB04 (ffl ligature). They're uppercased
83 +# to 'FFI' and 'FFL'.
84 +set ::ffi_ffl "\ufb03\ufb04"
85 +
86 # Tests of the upper()/lower() functions.
87 #
88 test_expr icu-2.1 {i1='HellO WorlD'} {upper(i1)} {HELLO WORLD}
89 @@ -72,6 +76,9 @@ test_expr icu-2.6 {i1=$::OGRAVE} {upper(i1)} $::OGRAVE
90 test_expr icu-2.7 {i1=$::szlig} {upper(i1)} "SS"
91 test_expr icu-2.8 {i1='SS'} {lower(i1)} "ss"
92
93 +test_expr icu-2.9 {i1=$::ffi_ffl} {upper(i1)} "FFIFFL"
94 +test_expr icu-2.10 {i1=$::ffi_ffl} {lower(i1)} $::ffi_ffl
95 +
96 # In turkish (locale="tr_TR"), the lower case version of I
97 # is "small dotless i" (code point 0x131 (decimal 305)).
98 #
99 --
100 2.7.0
101
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698