gnu/packages/patches/icu4c-CVE-2017-7867-CVE-2017-7868.patch

   1 Fix CVE-2017-7867 and CVE-2017-7868:
   2
   3 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7867
   4 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7868
   5
   6 Patch copied from upstream source repository:
   7
   8 http://bugs.icu-project.org/trac/changeset/39671
   9
  10 Index: icu/source/common/utext.cpp
  11 ===================================================================
  12 --- icu/source/common/utext.cpp (revision 39670)
  13 +++ icu/source/common/utext.cpp (revision 39671)
  14 @@ -848,7 +848,13 @@
  15
  16  // Chunk size.
  17 -//     Must be less than 85, because of byte mapping from UChar indexes to native indexes.
  18 -//     Worst case is three native bytes to one UChar.  (Supplemenaries are 4 native bytes
  19 -//     to two UChars.)
  20 +//     Must be less than 42  (256/6), because of byte mapping from UChar indexes to native indexes.
  21 +//     Worst case there are six UTF-8 bytes per UChar.
  22 +//         obsolete 6 byte form fd + 5 trails maps to fffd
  23 +//         obsolete 5 byte form fc + 4 trails maps to fffd
  24 +//         non-shortest 4 byte forms maps to fffd
  25 +//         normal supplementaries map to a pair of utf-16, two utf8 bytes per utf-16 unit
  26 +//     mapToUChars array size must allow for the worst case, 6.
  27 +//     This could be brought down to 4, by treating fd and fc as pure illegal,
  28 +//     rather than obsolete lead bytes. But that is not compatible with the utf-8 access macros.
  29  //
  30  enum { UTF8_TEXT_CHUNK_SIZE=32 };
  31 @@ -890,5 +896,5 @@
  32                                                       //    one for a supplementary starting in the last normal position,
  33                                                       //    and one for an entry for the buffer limit position.
  34 -    uint8_t   mapToUChars[UTF8_TEXT_CHUNK_SIZE*3+6]; // Map native offset from bufNativeStart to
  35 +    uint8_t   mapToUChars[UTF8_TEXT_CHUNK_SIZE*6+6]; // Map native offset from bufNativeStart to
  36                                                       //   correspoding offset in filled part of buf.
  37      int32_t   align;
  38 @@ -1033,4 +1039,5 @@
  39              u8b = (UTF8Buf *)ut->p;   // the current buffer
  40              mapIndex = ix - u8b->toUCharsMapStart;
  41 +            U_ASSERT(mapIndex < (int32_t)sizeof(UTF8Buf::mapToUChars));
  42              ut->chunkOffset = u8b->mapToUChars[mapIndex] - u8b->bufStartIdx;
  43              return TRUE;
  44 @@ -1299,4 +1306,8 @@
  45          //   If index is at the end, there is no character there to look at.
  46          if (ix != ut->b) {
  47 +            // Note: this function will only move the index back if it is on a trail byte
  48 +            //       and there is a preceding lead byte and the sequence from the lead
  49 +            //       through this trail could be part of a valid UTF-8 sequence
  50 +            //       Otherwise the index remains unchanged.
  51              U8_SET_CP_START(s8, 0, ix);
  52          }
  53 @@ -1312,5 +1323,8 @@
  54          uint8_t *mapToNative = u8b->mapToNative;
  55          uint8_t *mapToUChars = u8b->mapToUChars;
  56 -        int32_t  toUCharsMapStart = ix - (UTF8_TEXT_CHUNK_SIZE*3 + 1);
  57 +        int32_t  toUCharsMapStart = ix - sizeof(UTF8Buf::mapToUChars) + 1;
  58 +        // Note that toUCharsMapStart can be negative. Happens when the remaining
  59 +        // text from current position to the beginning is less than the buffer size.
  60 +        // + 1 because mapToUChars must have a slot at the end for the bufNativeLimit entry.
  61          int32_t  destIx = UTF8_TEXT_CHUNK_SIZE+2;   // Start in the overflow region
  62                                                      //   at end of buffer to leave room
  63 @@ -1339,4 +1353,5 @@
  64                  // Special case ASCII range for speed.
  65                  buf[destIx] = (UChar)c;
  66 +                U_ASSERT(toUCharsMapStart <= srcIx);
  67                  mapToUChars[srcIx - toUCharsMapStart] = (uint8_t)destIx;
  68                  mapToNative[destIx] = (uint8_t)(srcIx - toUCharsMapStart);
  69 @@ -1368,4 +1383,5 @@
  70                      mapToUChars[sIx-- - toUCharsMapStart] = (uint8_t)destIx;
  71                  } while (sIx >= srcIx);
  72 +                U_ASSERT(toUCharsMapStart <= (srcIx+1));
  73
  74                  // Set native indexing limit to be the current position.
  75 @@ -1542,4 +1558,5 @@
  76      U_ASSERT(index<=ut->chunkNativeLimit);
  77      int32_t mapIndex = index - u8b->toUCharsMapStart;
  78 +    U_ASSERT(mapIndex < (int32_t)sizeof(UTF8Buf::mapToUChars));
  79      int32_t offset = u8b->mapToUChars[mapIndex] - u8b->bufStartIdx;
  80      U_ASSERT(offset>=0 && offset<=ut->chunkLength);
  81 Index: icu/source/test/intltest/utxttest.cpp
  82 ===================================================================
  83 --- icu/source/test/intltest/utxttest.cpp       (revision 39670)
  84 +++ icu/source/test/intltest/utxttest.cpp       (revision 39671)
  85 @@ -68,4 +68,6 @@
  86          case 7: name = "Ticket12130";
  87              if (exec) Ticket12130(); break;
  88 +        case 8: name = "Ticket12888";
  89 +            if (exec) Ticket12888(); break;
  90          default: name = "";          break;
  91      }
  92 @@ -1584,2 +1586,62 @@
  93      utext_close(&ut);
  94  }
  95 +
  96 +// Ticket 12888: bad handling of illegal utf-8 containing many instances of the archaic, now illegal,
  97 +//               six byte utf-8 forms. Original implementation had an assumption that
  98 +//               there would be at most three utf-8 bytes per UTF-16 code unit.
  99 +//               The five and six byte sequences map to a single replacement character.
 100 +
 101 +void UTextTest::Ticket12888() {
 102 +    const char *badString =
 103 +            "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80"
 104 +            "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80"
 105 +            "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80"
 106 +            "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80"
 107 +            "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80"
 108 +            "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80"
 109 +            "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80"
 110 +            "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80"
 111 +            "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80"
 112 +            "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80"
 113 +            "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80"
 114 +            "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80"
 115 +            "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80"
 116 +            "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80"
 117 +            "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80"
 118 +            "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80"
 119 +            "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80"
 120 +            "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80"
 121 +            "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80"
 122 +            "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80";
 123 +
 124 +    UErrorCode status = U_ZERO_ERROR;
 125 +    LocalUTextPointer ut(utext_openUTF8(NULL, badString, -1, &status));
 126 +    TEST_SUCCESS(status);
 127 +    for (;;) {
 128 +        UChar32 c = utext_next32(ut.getAlias());
 129 +        if (c == U_SENTINEL) {
 130 +            break;
 131 +        }
 132 +    }
 133 +    int32_t endIdx = utext_getNativeIndex(ut.getAlias());
 134 +    if (endIdx != (int32_t)strlen(badString)) {
 135 +        errln("%s:%d expected=%d, actual=%d", __FILE__, __LINE__, strlen(badString), endIdx);
 136 +        return;
 137 +    }
 138 +
 139 +    for (int32_t prevIndex = endIdx; prevIndex>0;) {
 140 +        UChar32 c = utext_previous32(ut.getAlias());
 141 +        int32_t currentIndex = utext_getNativeIndex(ut.getAlias());
 142 +        if (c != 0xfffd) {
 143 +            errln("%s:%d (expected, actual, index) = (%d, %d, %d)\n",
 144 +                    __FILE__, __LINE__, 0xfffd, c, currentIndex);
 145 +            break;
 146 +        }
 147 +        if (currentIndex != prevIndex - 6) {
 148 +            errln("%s:%d: wrong index. Expected, actual = %d, %d",
 149 +                    __FILE__, __LINE__, prevIndex - 6, currentIndex);
 150 +            break;
 151 +        }
 152 +        prevIndex = currentIndex;
 153 +    }
 154 +}
 155 Index: icu/source/test/intltest/utxttest.h
 156 ===================================================================
 157 --- icu/source/test/intltest/utxttest.h (revision 39670)
 158 +++ icu/source/test/intltest/utxttest.h (revision 39671)
 159 @@ -39,4 +39,5 @@
 160      void Ticket10983();
 161      void Ticket12130();
 162 +    void Ticket12888();
 163
 164  private: