Index: third_party/sqlite/patches/0013-backport-Fix-buffer-overrun-in-ICU-extension-s-casem.patch |
diff --git a/third_party/sqlite/patches/0013-backport-Fix-buffer-overrun-in-ICU-extension-s-casem.patch b/third_party/sqlite/patches/0013-backport-Fix-buffer-overrun-in-ICU-extension-s-casem.patch |
deleted file mode 100644 |
index d18fd15f2f950bcb6c3f9122aed72ba5d7240203..0000000000000000000000000000000000000000 |
--- a/third_party/sqlite/patches/0013-backport-Fix-buffer-overrun-in-ICU-extension-s-casem.patch |
+++ /dev/null |
@@ -1,119 +0,0 @@ |
-From 0d13e8740021aeeb849662f03f49720287cabe0c Mon Sep 17 00:00:00 2001 |
-From: Scott Hess <shess@chromium.org> |
-Date: Fri, 26 Feb 2016 10:49:33 -0800 |
-Subject: [PATCH 13/13] [backport] Fix buffer overrun in ICU extension's |
- casemap functions. |
- |
-Original Chromium CL at https://codereview.chromium.org/1704103002 |
- |
-"Fix sqlite3's handling of casemapping result 3 times as long as input" |
- |
-SQLite interpretation at http://www.sqlite.org/src/info/b8dc1b9f5d413000 |
- |
-"Fix a potential buffer overflow in the ICU upper() function." |
- |
-BUG=586079 |
---- |
- third_party/sqlite/src/ext/icu/icu.c | 48 +++++++++++++++++++++--------------- |
- third_party/sqlite/src/test/icu.test | 9 +++++++ |
- 2 files changed, 37 insertions(+), 20 deletions(-) |
- |
-diff --git a/third_party/sqlite/src/ext/icu/icu.c b/third_party/sqlite/src/ext/icu/icu.c |
-index 5654366..263cd98 100644 |
---- a/third_party/sqlite/src/ext/icu/icu.c |
-+++ b/third_party/sqlite/src/ext/icu/icu.c |
-@@ -355,11 +355,11 @@ static void icuRegexpFunc(sqlite3_context *p, int nArg, sqlite3_value **apArg){ |
- */ |
- static void icuCaseFunc16(sqlite3_context *p, int nArg, sqlite3_value **apArg){ |
- const UChar *zInput; |
-- UChar *zOutput; |
-+ UChar *zOutput = 0; |
- int nInput; |
-- int nOutput; |
-- |
-- UErrorCode status = U_ZERO_ERROR; |
-+ int nOut; |
-+ int cnt; |
-+ UErrorCode status; |
- const char *zLocale = 0; |
- |
- assert(nArg==1 || nArg==2); |
-@@ -371,26 +371,34 @@ static void icuCaseFunc16(sqlite3_context *p, int nArg, sqlite3_value **apArg){ |
- if( !zInput ){ |
- return; |
- } |
-- nInput = sqlite3_value_bytes16(apArg[0]); |
-- |
-- nOutput = nInput * 2 + 2; |
-- zOutput = sqlite3_malloc(nOutput); |
-- if( !zOutput ){ |
-+ nOut = nInput = sqlite3_value_bytes16(apArg[0]); |
-+ if( nOut==0 ){ |
-+ sqlite3_result_text16(p, "", 0, SQLITE_STATIC); |
- return; |
- } |
- |
-- if( sqlite3_user_data(p) ){ |
-- u_strToUpper(zOutput, nOutput/2, zInput, nInput/2, zLocale, &status); |
-- }else{ |
-- u_strToLower(zOutput, nOutput/2, zInput, nInput/2, zLocale, &status); |
-- } |
-- |
-- if( !U_SUCCESS(status) ){ |
-- icuFunctionError(p, "u_strToLower()/u_strToUpper", status); |
-- return; |
-+ for(cnt=0; cnt<2; cnt++){ |
-+ UChar *zNew = sqlite3_realloc(zOutput, nOut); |
-+ if( zNew==0 ){ |
-+ sqlite3_free(zOutput); |
-+ sqlite3_result_error_nomem(p); |
-+ return; |
-+ } |
-+ zOutput = zNew; |
-+ status = U_ZERO_ERROR; |
-+ if( sqlite3_user_data(p) ){ |
-+ nOut = 2*u_strToUpper(zOutput,nOut/2,zInput,nInput/2,zLocale,&status); |
-+ }else{ |
-+ nOut = 2*u_strToLower(zOutput,nOut/2,zInput,nInput/2,zLocale,&status); |
-+ } |
-+ if( !U_SUCCESS(status) ){ |
-+ if( status==U_BUFFER_OVERFLOW_ERROR ) continue; |
-+ icuFunctionError(p, |
-+ sqlite3_user_data(p) ? "u_strToUpper()" : "u_strToLower", status); |
-+ return; |
-+ } |
- } |
-- |
-- sqlite3_result_text16(p, zOutput, -1, xFree); |
-+ sqlite3_result_text16(p, zOutput, nOut, xFree); |
- } |
- |
- /* |
-diff --git a/third_party/sqlite/src/test/icu.test b/third_party/sqlite/src/test/icu.test |
-index 73cb9b9..743bcfa 100644 |
---- a/third_party/sqlite/src/test/icu.test |
-+++ b/third_party/sqlite/src/test/icu.test |
-@@ -72,6 +72,10 @@ test_expr icu-2.6 {i1=$::OGRAVE} {upper(i1)} $::OGRAVE |
- test_expr icu-2.7 {i1=$::szlig} {upper(i1)} "SS" |
- test_expr icu-2.8 {i1='SS'} {lower(i1)} "ss" |
- |
-+do_execsql_test icu-2.9 { |
-+ SELECT upper(char(0xfb04,0xfb04,0xfb04,0xfb04)); |
-+} {FFLFFLFFLFFL} |
-+ |
- # In turkish (locale="tr_TR"), the lower case version of I |
- # is "small dotless i" (code point 0x131 (decimal 305)). |
- # |
-@@ -133,4 +137,9 @@ do_catchsql_test icu-5.4 { |
- do_catchsql_test icu-5.4 { SELECT 'abc' REGEXP } {1 {near " ": syntax error}} |
- do_catchsql_test icu-5.5 { SELECT 'abc' REGEXP, 1 } {1 {near ",": syntax error}} |
- |
-+ |
-+do_malloc_test icu-6.10 -sqlbody { |
-+ SELECT upper(char(0xfb04,0xdf,0xfb04,0xe8,0xfb04)); |
-+} |
-+ |
- finish_test |
--- |
-2.7.0 |
- |