Skip to content

Conversation

@Naveed8951
Copy link

Description

This PR fixes a heap under-allocation bug in the ICU4C VTimeZone C wrapper
write APIs (vzone_write, vzone_writeFromStart, vzone_writeSimple).

The wrapper computed resultLength using UnicodeString::length(), which
returns the number of UTF-16 code units, but allocated and copied only
resultLength bytes. Since char16_t is 2 bytes, the returned buffer was
smaller than implied by the returned length.

Because the API returns (char16_t*, length-in-code-units), callers may
legitimately read or write resultLength UTF-16 code units (including
adding a terminator), leading to heap out-of-bounds access.

Fix

  • Allocate buffers in UTF-16 code units (sizeof(char16_t))
  • Allocate (resultLength + 1) code units and explicitly NUL-terminate
  • Copy resultLength UTF-16 code units
  • Add overflow-safe size calculations
  • Return U_MEMORY_ALLOCATION_ERROR on allocation failure

Impact

  • Eliminates heap under-allocation and out-of-bounds access
  • No change to API behavior or serialized output
  • Improves robustness when handling untrusted VTIMEZONE input

Testing

  • Added a regression test in intltest verifying:
    • u_strlen(out) == outLen
    • out[outLen] == 0

@CLAassistant
Copy link

CLAassistant commented Jan 10, 2026

CLA assistant check
All committers have signed the CLA.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants