gnu/packages/patches/icu4c-CVE-2020-10531.patch

   1 Fix CVE-2020-10531:
   2
   3 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10531
   4
   5 Patch copied from upstream source repository (changes to the test suite
   6 are commented out):
   7
   8 https://github.com/unicode-org/icu/commit/b7d08bc04a4296982fcef8b6b8a354a9e4e7afca
   9
  10 From b7d08bc04a4296982fcef8b6b8a354a9e4e7afca Mon Sep 17 00:00:00 2001
  11 From: Frank Tang <ftang@chromium.org>
  12 Date: Sat, 1 Feb 2020 02:39:04 +0000
  13 Subject: [PATCH] ICU-20958 Prevent SEGV_MAPERR in append
  14
  15 See #971
  16 ---
  17  icu4c/source/common/unistr.cpp          |  6 ++-
  18  icu4c/source/test/intltest/ustrtest.cpp | 62 +++++++++++++++++++++++++
  19  icu4c/source/test/intltest/ustrtest.h   |  1 +
  20  3 files changed, 68 insertions(+), 1 deletion(-)
  21
  22 diff --git a/icu4c/source/common/unistr.cpp b/icu4c/source/common/unistr.cpp
  23 index 901bb3358ba..077b4d6ef20 100644
  24 --- a/icu4c/source/common/unistr.cpp
  25 +++ b/icu4c/source/common/unistr.cpp
  26 @@ -1563,7 +1563,11 @@ UnicodeString::doAppend(const UChar *srcChars, int32_t srcStart, int32_t srcLeng
  27    }
  28
  29    int32_t oldLength = length();
  30 -  int32_t newLength = oldLength + srcLength;
  31 +  int32_t newLength;
  32 +  if (uprv_add32_overflow(oldLength, srcLength, &newLength)) {
  33 +    setToBogus();
  34 +    return *this;
  35 +  }
  36
  37    // Check for append onto ourself
  38    const UChar* oldArray = getArrayStart();
  39 #diff --git a/icu4c/source/test/intltest/ustrtest.cpp b/icu4c/source/test/intltest/ustrtest.cpp
  40 #index b6515ea813c..ad38bdf53a3 100644
  41 #--- a/icu4c/source/test/intltest/ustrtest.cpp
  42 #+++ b/icu4c/source/test/intltest/ustrtest.cpp
  43 #@@ -67,6 +67,7 @@ void UnicodeStringTest::runIndexedTest( int32_t index, UBool exec, const char* &
  44 #     TESTCASE_AUTO(TestWCharPointers);
  45 #     TESTCASE_AUTO(TestNullPointers);
  46 #     TESTCASE_AUTO(TestUnicodeStringInsertAppendToSelf);
  47 #+    TESTCASE_AUTO(TestLargeAppend);
  48 #     TESTCASE_AUTO_END;
  49 # }
  50 #
  51 #@@ -2310,3 +2311,64 @@ void UnicodeStringTest::TestUnicodeStringInsertAppendToSelf() {
  52 #     str.insert(2, sub);
  53 #     assertEquals("", u"abbcdcde", str);
  54 # }
  55 #+
  56 #+void UnicodeStringTest::TestLargeAppend() {
  57 #+    if(quick) return;
  58 #+
  59 #+    IcuTestErrorCode status(*this, "TestLargeAppend");
  60 #+    // Make a large UnicodeString
  61 #+    int32_t len = 0xAFFFFFF;
  62 #+    UnicodeString str;
  63 #+    char16_t *buf = str.getBuffer(len);
  64 #+    // A fast way to set buffer to valid Unicode.
  65 #+    // 4E4E is a valid unicode character
  66 #+    uprv_memset(buf, 0x4e, len * 2);
  67 #+    str.releaseBuffer(len);
  68 #+    UnicodeString dest;
  69 #+    // Append it 16 times
  70 #+    // 0xAFFFFFF times 16 is 0xA4FFFFF1,
  71 #+    // which is greater than INT32_MAX, which is 0x7FFFFFFF.
  72 #+    int64_t total = 0;
  73 #+    for (int32_t i = 0; i < 16; i++) {
  74 #+        dest.append(str);
  75 #+        total += len;
  76 #+        if (total <= INT32_MAX) {
  77 #+            assertFalse("dest is not bogus", dest.isBogus());
  78 #+        } else {
  79 #+            assertTrue("dest should be bogus", dest.isBogus());
  80 #+        }
  81 #+    }
  82 #+    dest.remove();
  83 #+    total = 0;
  84 #+    for (int32_t i = 0; i < 16; i++) {
  85 #+        dest.append(str);
  86 #+        total += len;
  87 #+        if (total + len <= INT32_MAX) {
  88 #+            assertFalse("dest is not bogus", dest.isBogus());
  89 #+        } else if (total <= INT32_MAX) {
  90 #+            // Check that a string of exactly the maximum size works
  91 #+            UnicodeString str2;
  92 #+            int32_t remain = INT32_MAX - total;
  93 #+            char16_t *buf2 = str2.getBuffer(remain);
  94 #+            if (buf2 == nullptr) {
  95 #+                // if somehow memory allocation fail, return the test
  96 #+                return;
  97 #+            }
  98 #+            uprv_memset(buf2, 0x4e, remain * 2);
  99 #+            str2.releaseBuffer(remain);
 100 #+            dest.append(str2);
 101 #+            total += remain;
 102 #+            assertEquals("When a string of exactly the maximum size works", (int64_t)INT32_MAX, total);
 103 #+            assertEquals("When a string of exactly the maximum size works", INT32_MAX, dest.length());
 104 #+            assertFalse("dest is not bogus", dest.isBogus());
 105 #+
 106 #+            // Check that a string size+1 goes bogus
 107 #+            str2.truncate(1);
 108 #+            dest.append(str2);
 109 #+            total++;
 110 #+            assertTrue("dest should be bogus", dest.isBogus());
 111 #+        } else {
 112 #+            assertTrue("dest should be bogus", dest.isBogus());
 113 #+        }
 114 #+    }
 115 #+}
 116 #diff --git a/icu4c/source/test/intltest/ustrtest.h b/icu4c/source/test/intltest/ustrtest.h
 117 #index 218befdcc68..4a356a92c7a 100644
 118 #--- a/icu4c/source/test/intltest/ustrtest.h
 119 #+++ b/icu4c/source/test/intltest/ustrtest.h
 120 #@@ -97,6 +97,7 @@ class UnicodeStringTest: public IntlTest {
 121 #     void TestWCharPointers();
 122 #     void TestNullPointers();
 123 #     void TestUnicodeStringInsertAppendToSelf();
 124 #+    void TestLargeAppend();
 125 # };
 126 #
 127 # #endif