Skip to content

Commit 8d7cdee

Browse files
thalha-a9Squash Bot
thalha-a9
authored and
Squash Bot
committed
Use uprv_calloc for array allocations to prevent integer overflow
See #4099
1 parent 9a81223 commit 8d7cdee

8 files changed

Lines changed: 25 additions & 25 deletions

File tree

‎icu4c/source/common/localematcher.cpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -372,7 +372,7 @@ LocaleMatcher::LocaleMatcher(const Builder &builder, UErrorCode &errorCode) :
372372
// so that when different types are used (e.g., language tag strings)
373373
// we can return those by parallel index.
374374
supportedLocales = static_cast<const Locale **>(
375-
uprv_malloc(supportedLocalesLength * sizeof(const Locale *)));
375+
uprv_calloc(supportedLocalesLength, sizeof(const Locale *)));
376376
// Supported LRSs in input order.
377377
// In C++, we store these permanently to simplify ownership management
378378
// in the hash tables. Duplicate LSRs (if any) are unused overhead.
@@ -406,9 +406,9 @@ LocaleMatcher::LocaleMatcher(const Builder &builder, UErrorCode &errorCode) :
406406
supportedLocalesLength, &errorCode);
407407
if (U_FAILURE(errorCode)) { return; }
408408
supportedLSRs = static_cast<const LSR **>(
409-
uprv_malloc(supportedLocalesLength * sizeof(const LSR *)));
409+
uprv_calloc(supportedLocalesLength, sizeof(const LSR *)));
410410
supportedIndexes = static_cast<int32_t *>(
411-
uprv_malloc(supportedLocalesLength * sizeof(int32_t)));
411+
uprv_calloc(supportedLocalesLength, sizeof(int32_t)));
412412
if (supportedLSRs == nullptr || supportedIndexes == nullptr) {
413413
errorCode = U_MEMORY_ALLOCATION_ERROR;
414414
return;

‎icu4c/source/common/loclikelysubtags.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -201,7 +201,7 @@ struct LikelySubtagsData {
201201

202202
if (partitionsLength > 0) {
203203
distanceData.partitions = static_cast<const char **>(
204-
uprv_malloc(partitionsLength * sizeof(const char *)));
204+
uprv_calloc(partitionsLength, sizeof(const char *)));
205205
if (distanceData.partitions == nullptr) {
206206
errorCode = U_MEMORY_ALLOCATION_ERROR;
207207
return;

‎icu4c/source/common/rbbi.cpp‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ RuleBasedBreakIterator::RuleBasedBreakIterator(RBBIDataHeader* data, UErrorCode
7373
}
7474
if (fData->fForwardTable->fLookAheadResultsSize > 0) {
7575
fLookAheadMatches = static_cast<int32_t *>(
76-
uprv_malloc(fData->fForwardTable->fLookAheadResultsSize * sizeof(int32_t)));
76+
uprv_calloc(fData->fForwardTable->fLookAheadResultsSize, sizeof(int32_t)));
7777
if (fLookAheadMatches == nullptr) {
7878
status = U_MEMORY_ALLOCATION_ERROR;
7979
return;
@@ -123,7 +123,7 @@ RuleBasedBreakIterator::RuleBasedBreakIterator(const uint8_t *compiledRules,
123123
}
124124
if (fData->fForwardTable->fLookAheadResultsSize > 0) {
125125
fLookAheadMatches = static_cast<int32_t *>(
126-
uprv_malloc(fData->fForwardTable->fLookAheadResultsSize * sizeof(int32_t)));
126+
uprv_calloc(fData->fForwardTable->fLookAheadResultsSize, sizeof(int32_t)));
127127
if (fLookAheadMatches == nullptr) {
128128
status = U_MEMORY_ALLOCATION_ERROR;
129129
return;
@@ -149,7 +149,7 @@ RuleBasedBreakIterator::RuleBasedBreakIterator(UDataMemory* udm, UErrorCode &sta
149149
}
150150
if (fData->fForwardTable->fLookAheadResultsSize > 0) {
151151
fLookAheadMatches = static_cast<int32_t *>(
152-
uprv_malloc(fData->fForwardTable->fLookAheadResultsSize * sizeof(int32_t)));
152+
uprv_calloc(fData->fForwardTable->fLookAheadResultsSize, sizeof(int32_t)));
153153
if (fLookAheadMatches == nullptr) {
154154
status = U_MEMORY_ALLOCATION_ERROR;
155155
return;
@@ -319,7 +319,7 @@ RuleBasedBreakIterator::operator=(const RuleBasedBreakIterator& that) {
319319
fLookAheadMatches = nullptr;
320320
if (fData && fData->fForwardTable->fLookAheadResultsSize > 0) {
321321
fLookAheadMatches = static_cast<int32_t *>(
322-
uprv_malloc(fData->fForwardTable->fLookAheadResultsSize * sizeof(int32_t)));
322+
uprv_calloc(fData->fForwardTable->fLookAheadResultsSize, sizeof(int32_t)));
323323
}
324324

325325

‎icu4c/source/common/ucnvsel.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -175,7 +175,7 @@ ucnvsel_open(const char* const* converterList, int32_t converterListSize,
175175
converterListSize = ucnv_countAvailable();
176176
}
177177
newSelector->encodings =
178-
(char**)uprv_malloc(converterListSize * sizeof(char*));
178+
(char**)uprv_calloc(converterListSize, sizeof(char*));
179179
if (!newSelector->encodings) {
180180
*status = U_MEMORY_ALLOCATION_ERROR;
181181
return nullptr;
@@ -716,7 +716,7 @@ static UEnumeration *selectForMask(const UConverterSelector* sel,
716716
int16_t numOnes = countOnes(mask.getAlias(), columns);
717717
// now, we know the exact space we need for index
718718
if (numOnes > 0) {
719-
result->index = static_cast<int16_t*>(uprv_malloc(numOnes * sizeof(int16_t)));
719+
result->index = static_cast<int16_t*>(uprv_calloc(numOnes, sizeof(int16_t)));
720720
if (result->index == nullptr) {
721721
*status = U_MEMORY_ALLOCATION_ERROR;
722722
return nullptr;

‎icu4c/source/common/uidna.cpp‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -228,7 +228,7 @@ _internal_toASCII(const char16_t* src, int32_t srcLength,
228228
}
229229

230230
if(srcLength > b1Capacity){
231-
b1 = static_cast<char16_t*>(uprv_malloc(srcLength * U_SIZEOF_UCHAR));
231+
b1 = static_cast<char16_t*>(uprv_calloc(srcLength, U_SIZEOF_UCHAR));
232232
if(b1==nullptr){
233233
*status = U_MEMORY_ALLOCATION_ERROR;
234234
goto CLEANUP;
@@ -257,7 +257,7 @@ _internal_toASCII(const char16_t* src, int32_t srcLength,
257257
if(b1 != b1Stack){
258258
uprv_free(b1);
259259
}
260-
b1 = static_cast<char16_t*>(uprv_malloc(b1Len * U_SIZEOF_UCHAR));
260+
b1 = static_cast<char16_t*>(uprv_calloc(b1Len, U_SIZEOF_UCHAR));
261261
if(b1==nullptr){
262262
*status = U_MEMORY_ALLOCATION_ERROR;
263263
goto CLEANUP;
@@ -343,7 +343,7 @@ _internal_toASCII(const char16_t* src, int32_t srcLength,
343343
if(bufferStatus == U_BUFFER_OVERFLOW_ERROR){
344344
// redo processing of string
345345
/* we do not have enough room so grow the buffer*/
346-
b2 = static_cast<char16_t*>(uprv_malloc(b2Len * U_SIZEOF_UCHAR));
346+
b2 = static_cast<char16_t*>(uprv_calloc(b2Len, U_SIZEOF_UCHAR));
347347
if(b2 == nullptr){
348348
*status = U_MEMORY_ALLOCATION_ERROR;
349349
goto CLEANUP;
@@ -465,7 +465,7 @@ _internal_toUnicode(const char16_t* src, int32_t srcLength,
465465
if(bufferStatus == U_BUFFER_OVERFLOW_ERROR){
466466
// redo processing of string
467467
/* we do not have enough room so grow the buffer*/
468-
b1 = static_cast<char16_t*>(uprv_malloc(b1Len * U_SIZEOF_UCHAR));
468+
b1 = static_cast<char16_t*>(uprv_calloc(b1Len, U_SIZEOF_UCHAR));
469469
if(b1==nullptr){
470470
*status = U_MEMORY_ALLOCATION_ERROR;
471471
goto CLEANUP;
@@ -507,7 +507,7 @@ _internal_toUnicode(const char16_t* src, int32_t srcLength,
507507
if(bufferStatus == U_BUFFER_OVERFLOW_ERROR){
508508
// redo processing of string
509509
/* we do not have enough room so grow the buffer*/
510-
b2 = static_cast<char16_t*>(uprv_malloc(b2Len * U_SIZEOF_UCHAR));
510+
b2 = static_cast<char16_t*>(uprv_calloc(b2Len, U_SIZEOF_UCHAR));
511511
if(b2==nullptr){
512512
*status = U_MEMORY_ALLOCATION_ERROR;
513513
goto CLEANUP;
@@ -525,7 +525,7 @@ _internal_toUnicode(const char16_t* src, int32_t srcLength,
525525
if(bufferStatus == U_BUFFER_OVERFLOW_ERROR){
526526
// redo processing of string
527527
/* we do not have enough room so grow the buffer*/
528-
b3 = static_cast<char16_t*>(uprv_malloc(b3Len * U_SIZEOF_UCHAR));
528+
b3 = static_cast<char16_t*>(uprv_calloc(b3Len, U_SIZEOF_UCHAR));
529529
if(b3==nullptr){
530530
*status = U_MEMORY_ALLOCATION_ERROR;
531531
goto CLEANUP;
@@ -888,7 +888,7 @@ uidna_compare( const char16_t *s1, int32_t length1,
888888
b1Len = uidna_IDNToASCII(s1, length1, b1, b1Capacity, options, &parseError, &bufferStatus);
889889
if(bufferStatus == U_BUFFER_OVERFLOW_ERROR){
890890
// redo processing of string
891-
b1 = (char16_t*) uprv_malloc(b1Len * U_SIZEOF_UCHAR);
891+
b1 = (char16_t*) uprv_calloc(b1Len, U_SIZEOF_UCHAR);
892892
if(b1==nullptr){
893893
*status = U_MEMORY_ALLOCATION_ERROR;
894894
goto CLEANUP;
@@ -902,7 +902,7 @@ uidna_compare( const char16_t *s1, int32_t length1,
902902
b2Len = uidna_IDNToASCII(s2,length2, b2,b2Capacity, options, &parseError, &bufferStatus);
903903
if(bufferStatus == U_BUFFER_OVERFLOW_ERROR){
904904
// redo processing of string
905-
b2 = (char16_t*) uprv_malloc(b2Len * U_SIZEOF_UCHAR);
905+
b2 = (char16_t*) uprv_calloc(b2Len, U_SIZEOF_UCHAR);
906906
if(b2==nullptr){
907907
*status = U_MEMORY_ALLOCATION_ERROR;
908908
goto CLEANUP;

‎icu4c/source/common/uniset.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1644,7 +1644,7 @@ bool UnicodeSet::ensureCapacity(int32_t newLen) {
16441644
return true;
16451645
}
16461646
int32_t newCapacity = nextCapacity(newLen);
1647-
UChar32* temp = static_cast<UChar32*>(uprv_malloc(newCapacity * sizeof(UChar32)));
1647+
UChar32* temp = static_cast<UChar32*>(uprv_calloc(newCapacity, sizeof(UChar32)));
16481648
if (temp == nullptr) {
16491649
setToBogus(); // set the object to bogus state if an OOM failure occurred.
16501650
return false;
@@ -1667,7 +1667,7 @@ bool UnicodeSet::ensureBufferCapacity(int32_t newLen) {
16671667
return true;
16681668
}
16691669
int32_t newCapacity = nextCapacity(newLen);
1670-
UChar32* temp = static_cast<UChar32*>(uprv_malloc(newCapacity * sizeof(UChar32)));
1670+
UChar32* temp = static_cast<UChar32*>(uprv_calloc(newCapacity, sizeof(UChar32)));
16711671
if (temp == nullptr) {
16721672
setToBogus();
16731673
return false;

‎icu4c/source/common/ustr_wcs.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ u_growAnyBufferFromStatic(void *context,
4141
int32_t length, int32_t size) {
4242
// Use char* not void* to avoid the compiler's strict-aliasing assumptions
4343
// and related warnings.
44-
char *newBuffer=(char *)uprv_malloc(reqCapacity*size);
44+
char *newBuffer=(char *)uprv_calloc(reqCapacity, size);
4545
if(newBuffer!=nullptr) {
4646
if(length>0) {
4747
uprv_memcpy(newBuffer, *pBuffer, (size_t)length*size);
@@ -146,7 +146,7 @@ _strToWCS(wchar_t *dest,
146146
* no more than 2 wchar_ts
147147
*/
148148
intTargetCapacity = (count * _BUFFER_CAPACITY_MULTIPLIER + 1) /*for null termination */;
149-
intTarget = (wchar_t*)uprv_malloc( intTargetCapacity * sizeof(wchar_t) );
149+
intTarget = (wchar_t*)uprv_calloc( intTargetCapacity, sizeof(wchar_t) );
150150

151151
if(intTarget){
152152

‎icu4c/source/i18n/timezone.cpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -630,7 +630,7 @@ static void U_CALLCONV initMap(USystemTimeZoneType type, UErrorCode& ec) {
630630
res = ures_getByKey(res, kNAMES, res, &ec); // dereference Zones section
631631
if (U_SUCCESS(ec)) {
632632
int32_t size = ures_getSize(res);
633-
int32_t* m = static_cast<int32_t*>(uprv_malloc(size * sizeof(int32_t)));
633+
int32_t* m = static_cast<int32_t*>(uprv_calloc(size, sizeof(int32_t)));
634634
if (m == nullptr) {
635635
ec = U_MEMORY_ALLOCATION_ERROR;
636636
} else {
@@ -845,7 +845,7 @@ class TZEnumeration : public StringEnumeration {
845845

846846
if (region != nullptr || rawOffset != nullptr) {
847847
int32_t filteredMapSize = DEFAULT_FILTERED_MAP_SIZE;
848-
filteredMap = static_cast<int32_t*>(uprv_malloc(filteredMapSize * sizeof(int32_t)));
848+
filteredMap = static_cast<int32_t*>(uprv_calloc(filteredMapSize, sizeof(int32_t)));
849849
if (filteredMap == nullptr) {
850850
ec = U_MEMORY_ALLOCATION_ERROR;
851851
return nullptr;
@@ -932,7 +932,7 @@ class TZEnumeration : public StringEnumeration {
932932

933933
TZEnumeration(const TZEnumeration &other) : StringEnumeration(), map(nullptr), localMap(nullptr), len(0), pos(0) {
934934
if (other.localMap != nullptr) {
935-
localMap = static_cast<int32_t*>(uprv_malloc(other.len * sizeof(int32_t)));
935+
localMap = static_cast<int32_t*>(uprv_calloc(other.len, sizeof(int32_t)));
936936
if (localMap != nullptr) {
937937
len = other.len;
938938
uprv_memcpy(localMap, other.localMap, len * sizeof(int32_t));

0 commit comments

Comments
 (0)