Go to:
Gentoo Home
Documentation
Forums
Lists
Bugs
Planet
Store
Wiki
Get Gentoo!
Gentoo's Bugzilla – Attachment 474576 Details for
Bug 620014
dev-libs/icu: Multiple vulnerabilities CVE-2017-7867, CVE-2017-7868
Home
|
New
–
[Ex]
|
Browse
|
Search
|
Privacy Policy
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
icu-58.2-r1-CVE-2017-7867-CVE-2017-7868.patch
icu-58.2-r1-CVE-2017-7867-CVE-2017-7868.patch (text/plain), 8.47 KB, created by
Andrey Ovcharov
on 2017-05-28 12:26:31 UTC
(
hide
)
Description:
icu-58.2-r1-CVE-2017-7867-CVE-2017-7868.patch
Filename:
MIME Type:
Creator:
Andrey Ovcharov
Created:
2017-05-28 12:26:31 UTC
Size:
8.47 KB
patch
obsolete
>https://nvd.nist.gov/vuln/detail/CVE-2017-7867 >https://nvd.nist.gov/vuln/detail/CVE-2017-7868 >http://bugs.icu-project.org/trac/ticket/12888 >http://bugs.icu-project.org/trac/changeset/39671 >--- common/utext.cpp.orig 2016-06-15 13:58:17.000000000 -0500 >+++ common/utext.cpp 2017-05-25 21:51:47.000000000 -0500 >@@ -848,9 +848,16 @@ > > // Chunk size. >-// Must be less than 85, because of byte mapping from UChar indexes to native indexes. >-// Worst case is three native bytes to one UChar. (Supplemenaries are 4 native bytes >-// to two UChars.) >+// Must be less than 42 (256/6), because of byte mapping from UChar indexes to native indexes. >+// Worst case there are six UTF-8 bytes per UChar. >+// obsolete 6 byte form fd + 5 trails maps to fffd >+// obsolete 5 byte form fc + 4 trails maps to fffd >+// non-shortest 4 byte forms maps to fffd >+// normal supplementaries map to a pair of utf-16, two utf8 bytes per utf-16 unit >+// mapToUChars array size must allow for the worst case, 6. >+// This could be brought down to 4, by treating fd and fc as pure illegal, >+// rather than obsolete lead bytes. But that is not compatible with the utf-8 access macros. > // > enum { UTF8_TEXT_CHUNK_SIZE=32 }; >+enum { SIZEOF_MAPTOUCHARS=UTF8_TEXT_CHUNK_SIZE*6+6 }; > > // >@@ -890,5 +897,5 @@ > // one for a supplementary starting in the last normal position, > // and one for an entry for the buffer limit position. >- uint8_t mapToUChars[UTF8_TEXT_CHUNK_SIZE*3+6]; // Map native offset from bufNativeStart to >+ uint8_t mapToUChars[SIZEOF_MAPTOUCHARS]; // Map native offset from bufNativeStart to > // correspoding offset in filled part of buf. > int32_t align; >@@ -1033,4 +1040,5 @@ > u8b = (UTF8Buf *)ut->p; // the current buffer > mapIndex = ix - u8b->toUCharsMapStart; >+ U_ASSERT(mapIndex < (int32_t)SIZEOF_MAPTOUCHARS); > ut->chunkOffset = u8b->mapToUChars[mapIndex] - u8b->bufStartIdx; > return TRUE; >@@ -1299,4 +1307,8 @@ > // If index is at the end, there is no character there to look at. > if (ix != ut->b) { >+ // Note: this function will only move the index back if it is on a trail byte >+ // and there is a preceding lead byte and the sequence from the lead >+ // through this trail could be part of a valid UTF-8 sequence >+ // Otherwise the index remains unchanged. > U8_SET_CP_START(s8, 0, ix); > } >@@ -1312,5 +1324,8 @@ > uint8_t *mapToNative = u8b->mapToNative; > uint8_t *mapToUChars = u8b->mapToUChars; >- int32_t toUCharsMapStart = ix - (UTF8_TEXT_CHUNK_SIZE*3 + 1); >+ int32_t toUCharsMapStart = ix - SIZEOF_MAPTOUCHARS + 1; >+ // Note that toUCharsMapStart can be negative. Happens when the remaining >+ // text from current position to the beginning is less than the buffer size. >+ // + 1 because mapToUChars must have a slot at the end for the bufNativeLimit entry. > int32_t destIx = UTF8_TEXT_CHUNK_SIZE+2; // Start in the overflow region > // at end of buffer to leave room >@@ -1339,4 +1354,5 @@ > // Special case ASCII range for speed. > buf[destIx] = (UChar)c; >+ U_ASSERT(toUCharsMapStart <= srcIx); > mapToUChars[srcIx - toUCharsMapStart] = (uint8_t)destIx; > mapToNative[destIx] = (uint8_t)(srcIx - toUCharsMapStart); >@@ -1368,4 +1384,5 @@ > mapToUChars[sIx-- - toUCharsMapStart] = (uint8_t)destIx; > } while (sIx >= srcIx); >+ U_ASSERT(toUCharsMapStart <= (srcIx+1)); > > // Set native indexing limit to be the current position. >@@ -1542,4 +1559,5 @@ > U_ASSERT(index<=ut->chunkNativeLimit); > int32_t mapIndex = index - u8b->toUCharsMapStart; >+ U_ASSERT(mapIndex < (int32_t)SIZEOF_MAPTOUCHARS); > int32_t offset = u8b->mapToUChars[mapIndex] - u8b->bufStartIdx; > U_ASSERT(offset>=0 && offset<=ut->chunkLength); >--- test/intltest/utxttest.cpp (revision 39670) >+++ test/intltest/utxttest.cpp (revision 39671) >@@ -68,4 +68,6 @@ > case 7: name = "Ticket12130"; > if (exec) Ticket12130(); break; >+ case 8: name = "Ticket12888"; >+ if (exec) Ticket12888(); break; > default: name = ""; break; > } >@@ -1584,2 +1586,62 @@ > utext_close(&ut); > } >+ >+// Ticket 12888: bad handling of illegal utf-8 containing many instances of the archaic, now illegal, >+// six byte utf-8 forms. Original implementation had an assumption that >+// there would be at most three utf-8 bytes per UTF-16 code unit. >+// The five and six byte sequences map to a single replacement character. >+ >+void UTextTest::Ticket12888() { >+ const char *badString = >+ "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80" >+ "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80" >+ "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80" >+ "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80" >+ "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80" >+ "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80" >+ "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80" >+ "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80" >+ "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80" >+ "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80" >+ "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80" >+ "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80" >+ "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80" >+ "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80" >+ "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80" >+ "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80" >+ "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80" >+ "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80" >+ "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80" >+ "\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80\xfd\x80\x80\x80\x80\x80"; >+ >+ UErrorCode status = U_ZERO_ERROR; >+ LocalUTextPointer ut(utext_openUTF8(NULL, badString, -1, &status)); >+ TEST_SUCCESS(status); >+ for (;;) { >+ UChar32 c = utext_next32(ut.getAlias()); >+ if (c == U_SENTINEL) { >+ break; >+ } >+ } >+ int32_t endIdx = utext_getNativeIndex(ut.getAlias()); >+ if (endIdx != (int32_t)strlen(badString)) { >+ errln("%s:%d expected=%d, actual=%d", __FILE__, __LINE__, strlen(badString), endIdx); >+ return; >+ } >+ >+ for (int32_t prevIndex = endIdx; prevIndex>0;) { >+ UChar32 c = utext_previous32(ut.getAlias()); >+ int32_t currentIndex = utext_getNativeIndex(ut.getAlias()); >+ if (c != 0xfffd) { >+ errln("%s:%d (expected, actual, index) = (%d, %d, %d)\n", >+ __FILE__, __LINE__, 0xfffd, c, currentIndex); >+ break; >+ } >+ if (currentIndex != prevIndex - 6) { >+ errln("%s:%d: wrong index. Expected, actual = %d, %d", >+ __FILE__, __LINE__, prevIndex - 6, currentIndex); >+ break; >+ } >+ prevIndex = currentIndex; >+ } >+} >--- test/intltest/utxttest.h (revision 39670) >+++ test/intltest/utxttest.h (revision 39671) >@@ -39,4 +39,5 @@ > void Ticket10983(); > void Ticket12130(); >+ void Ticket12888(); > > private:
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 620014
: 474576