icu4c: fix UTF-16 buffer under-allocation in vzone_write* #3841
+176
−120
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR fixes a heap under-allocation bug in the ICU4C VTimeZone C wrapper
write APIs (
vzone_write,vzone_writeFromStart,vzone_writeSimple).The wrapper computed
resultLengthusingUnicodeString::length(), whichreturns the number of UTF-16 code units, but allocated and copied only
resultLengthbytes. Sincechar16_tis 2 bytes, the returned buffer wassmaller than implied by the returned length.
Because the API returns
(char16_t*, length-in-code-units), callers maylegitimately read or write
resultLengthUTF-16 code units (includingadding a terminator), leading to heap out-of-bounds access.
Fix
sizeof(char16_t))(resultLength + 1)code units and explicitly NUL-terminateresultLengthUTF-16 code unitsU_MEMORY_ALLOCATION_ERRORon allocation failureImpact
Testing
intltestverifying:u_strlen(out) == outLenout[outLen] == 0