diff options
| author | Keith Mok <keithmok@google.com> | 2022-09-29 22:34:05 +0000 |
|---|---|---|
| committer | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | 2022-10-19 16:39:45 +0000 |
| commit | dc728e5d6bb1a9d0d3b4e9f7882149c2168b1dff (patch) | |
| tree | 05e41f8164dc05fc94dd032e50c3c82caee90483 | |
| parent | accc70ce7e7c9b15af7f7de1836b558f0fd2e4db (diff) | |
| download | minikin-dc728e5d6bb1a9d0d3b4e9f7882149c2168b1dff.tar.gz | |
Fix OOB crash for registerLocaleList
When the buffer size is equal to string size,
the func in icu just return warning U_STRING_NOT_TERMINATED_WARNING
which is a negative number, and U_FAILURE would fail if error number
greater than zero only.
This would cause non null terminated string passing into following funcs
and causing different types of crash
This fixes the previous partial fix.
Bug: 248612953
Bug: 239210579
Bug: 249151446
Bug: 239267173
Test: locale_fuzzer
Ignore-AOSP-First: security
Merged-In: I651d1ff64d06b4c30e18ee69772f52a60aa5ff7a
Change-Id: I651d1ff64d06b4c30e18ee69772f52a60aa5ff7a
(cherry picked from commit 582927b0d6c6920ee6a04049eaa9e68608cfc888)
(cherry picked from commit a8265407660edaa1006545a6401d6409c05acb5d)
Merged-In: I651d1ff64d06b4c30e18ee69772f52a60aa5ff7a
| -rw-r--r-- | libs/minikin/LocaleListCache.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libs/minikin/LocaleListCache.cpp b/libs/minikin/LocaleListCache.cpp index 0baee05..acda312 100644 --- a/libs/minikin/LocaleListCache.cpp +++ b/libs/minikin/LocaleListCache.cpp @@ -63,7 +63,7 @@ static size_t toLanguageTag(char* output, size_t outSize, const StringPiece& loc char likelyChars[ULOC_FULLNAME_CAPACITY]; uErr = U_ZERO_ERROR; uloc_addLikelySubtags(output, likelyChars, ULOC_FULLNAME_CAPACITY, &uErr); - if (U_FAILURE(uErr)) { + if (U_FAILURE(uErr) || (uErr == U_STRING_NOT_TERMINATED_WARNING)) { // unable to build a proper locale identifier ALOGD("uloc_addLikelySubtags(\"%s\") failed: %s", output, u_errorName(uErr)); output[0] = '\0'; |