Skip to content

Compute Arabic shaping scratch buffer sizes in size_t#4042

Open
ubeddulla wants to merge 1 commit into
unicode-org:mainfrom
ubeddulla:ushape-shaping-overflow
Open

Compute Arabic shaping scratch buffer sizes in size_t#4042
ubeddulla wants to merge 1 commit into
unicode-org:mainfrom
ubeddulla:ushape-shaping-overflow

Conversation

@ubeddulla

Copy link
Copy Markdown

The Arabic shaping helpers in ushape.cpp size their scratch buffers with (sourceLength + 1) * U_SIZEOF_UCHAR (and (destSize + 1) * U_SIZEOF_UCHAR) computed in 32-bit int, where the length ultimately comes from the sourceLength passed to the public u_shapeArabic; a large input wraps the multiply and the allocation that follows is too small for the writes done afterwards. handleGeneratedSpaces already has a size_t overflow guard, but it still does the multiply in int, so the value overflows before the guard can help on LP64, while expandCompositCharAtBegin, expandCompositCharAtEnd and expandCompositChar have no guard at all. This computes the sizes in size_t and adds the same guard to the three sibling helpers.

Checklist

  • Required: Issue filed: ICU-NNNNN
  • Required: The PR title must be prefixed with a JIRA Issue number. Example: "ICU-NNNNN Fix xyz"
  • Required: Each commit message must be prefixed with a JIRA Issue number. Example: "ICU-NNNNN Fix xyz"
  • Issue accepted (done by Technical Committee after discussion)
  • Tests included, if applicable
  • API docs and/or User Guide docs changed or added, if applicable
  • Approver: Feel free to merge on my behalf

@CLAassistant

CLAassistant commented Jun 25, 2026

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

@markusicu markusicu self-assigned this Jul 2, 2026
@ubeddulla

Copy link
Copy Markdown
Author

I don't have Jira access to open an ICU ticket or get one accepted on my own, so I can't add the ICU-NNNNN prefix myself. If you can file one (or point me at an existing ticket), I'll update the PR title and reword the commit to match.

This overlaps with #4043 (same file, sibling helpers), so a shared ticket would be fine if that's simpler on your end.

@markusicu

Copy link
Copy Markdown
Member

I don't have Jira access to open an ICU ticket or get one accepted on my own, so I can't add the ICU-NNNNN prefix myself.

Please create a Jira account and then a ticket: https://icu.unicode.org/bugs

This overlaps with #4043 (same file, sibling helpers), so a shared ticket would be fine if that's simpler on your end.

A combined ticket for both sounds fine.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants