diff options
| author | Keith Mok <keithmok@google.com> | 2022-09-29 22:34:05 +0000 |
|---|---|---|
| committer | Keith Mok <keithmok@google.com> | 2022-10-03 02:15:50 +0000 |
| commit | a8265407660edaa1006545a6401d6409c05acb5d (patch) | |
| tree | 5cf6c3f529a27282e651796711771108f99bbdc0 | |
| parent | d8a427cc9c8a722b0911af5139b10b0a6aeb0e03 (diff) | |
| download | minikin-a8265407660edaa1006545a6401d6409c05acb5d.tar.gz | |
Fix OOB crash for registerLocaleList
When the buffer size is equal to string size,
the func in icu just return warning U_STRING_NOT_TERMINATED_WARNING
which is a negative number, and U_FAILURE would fail if error number
greater than zero only.
This would cause non null terminated string passing into following funcs
and causing different types of crash
This fixes the previous partial fix.
Bug: 248612953
Bug: 239210579
Bug: 249151446
Bug: 239267173
Test: locale_fuzzer
Ignore-AOSP-First: security
Merged-In: I651d1ff64d06b4c30e18ee69772f52a60aa5ff7a
Change-Id: I651d1ff64d06b4c30e18ee69772f52a60aa5ff7a
(cherry picked from commit 582927b0d6c6920ee6a04049eaa9e68608cfc888)
| -rw-r--r-- | libs/minikin/LocaleListCache.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libs/minikin/LocaleListCache.cpp b/libs/minikin/LocaleListCache.cpp index 5bd869e..ec47145 100644 --- a/libs/minikin/LocaleListCache.cpp +++ b/libs/minikin/LocaleListCache.cpp @@ -59,7 +59,7 @@ static size_t toLanguageTag(char* output, size_t outSize, const StringPiece& loc char likelyChars[ULOC_FULLNAME_CAPACITY]; uErr = U_ZERO_ERROR; uloc_addLikelySubtags(output, likelyChars, ULOC_FULLNAME_CAPACITY, &uErr); - if (U_FAILURE(uErr)) { + if (U_FAILURE(uErr) || (uErr == U_STRING_NOT_TERMINATED_WARNING)) { // unable to build a proper locale identifier ALOGD("uloc_addLikelySubtags(\"%s\") failed: %s", output, u_errorName(uErr)); output[0] = '\0'; |