Skip to content

ICU-23443 Fix heap under-allocation and missing OOM check in VTimeZone/IZRule C wrappers#4050

Open
UnLucky252 wants to merge 1 commit into
unicode-org:mainfrom
UnLucky252:fix-ICU-23443-vzone-zrule
Open

ICU-23443 Fix heap under-allocation and missing OOM check in VTimeZone/IZRule C wrappers#4050
UnLucky252 wants to merge 1 commit into
unicode-org:mainfrom
UnLucky252:fix-ICU-23443-vzone-zrule

Conversation

@UnLucky252

Copy link
Copy Markdown

Linked Jira issue

ICU-23443

Summary

Four C wrapper functions in icu4c/source/i18n/vzone.cpp and
icu4c/source/i18n/zrule.cpp allocated their output char16_t*
buffer with uprv_malloc(length) instead of
uprv_malloc(length * sizeof(char16_t)), and then copied
length bytes instead of length * sizeof(char16_t) bytes —
so the returned buffer was half the size implied by the
returned length. They also did not check the malloc result
for nullptr before memcpy.

Affected functions:

  • vzone_write
  • vzone_writeFromStart
  • vzone_writeSimple
  • izrule_getName

Cause

UnicodeString::length() returns the number of UTF-16 code units;
each unit is sizeof(char16_t) == 2 bytes. The malloc/memcpy used
that count as a byte count. On OOM uprv_malloc returns nullptr and
the subsequent memcpy is undefined behavior.

Fix

  • Allocate and copy length * sizeof(char16_t) bytes.
  • Check the malloc result; on failure set
    status = U_MEMORY_ALLOCATION_ERROR (where a UErrorCode&
    parameter is available) and reset the out-parameters.
  • For the vzone_* functions also bail out early when the inner
    VTimeZone::write* call already set a failure.
  • izrule_getName has no UErrorCode parameter (changing the
    signature would break ABI), so on OOM it can only signal by
    setting nameLength = 0 and leaving name = nullptr.

Testing

Existing tests pass (no behavior change on the success path beyond
returning the full UTF-16 buffer that callers always assumed).
No new test added — the OOM path requires allocator injection that
is not part of the standard test harness.

Notes

Found by static analysis (Svace, ISP RAS).

Checklist

  • Required: Issue filed: ICU-23443
  • Required: The PR title must be prefixed with a JIRA Issue number. Example: "ICU-NNNNN Fix xyz"
  • Required: Each commit message must be prefixed with a JIRA Issue number. Example: "ICU-NNNNN Fix xyz"
  • Issue accepted (done by Technical Committee after discussion)
  • Tests included, if applicable
  • API docs and/or User Guide docs changed or added, if applicable
  • Approver: Feel free to merge on my behalf

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant