mirror of
https://git.yoctoproject.org/poky
synced 2026-04-30 21:32:13 +02:00
icu: fix CVE-2025-5222
Upstream-Status: Backport from 2c667e31cf
(From OE-Core rev: a7a82be3b409d496f7a0813055f77212a3b0ef12)
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Hitendra Prajapati
committed by
Steve Sakoman
Steve Sakoman
parent
5b18890ace
commit
e35c7960a7
164
meta/recipes-support/icu/icu/CVE-2025-5222.patch
Normal file
164
meta/recipes-support/icu/icu/CVE-2025-5222.patch
Normal file
@@ -0,0 +1,164 @@
|
||||
From 2c667e31cfd0b6bb1923627a932fd3453a5bac77 Mon Sep 17 00:00:00 2001
|
||||
From: Frank Tang <ftang@chromium.org>
|
||||
Date: Wed, 22 Jan 2025 11:50:59 -0800
|
||||
Subject: [PATCH] ICU-22973 Fix buffer overflow by using CharString
|
||||
|
||||
Upstream-Status: Backport [https://github.com/unicode-org/icu/commit/2c667e31cfd0b6bb1923627a932fd3453a5bac77]
|
||||
CVE: CVE-2025-5222
|
||||
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
||||
---
|
||||
tools/genrb/parse.cpp | 47 +++++++++++++++++++++---------------
|
||||
1 file changed, 28 insertions(+), 19 deletions(-)
|
||||
|
||||
diff --git a/tools/genrb/parse.cpp b/tools/genrb/parse.cpp
|
||||
index 7d5ffe1..175def0 100644
|
||||
--- a/tools/genrb/parse.cpp
|
||||
+++ b/tools/genrb/parse.cpp
|
||||
@@ -818,7 +818,7 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
|
||||
struct UString *tokenValue;
|
||||
struct UString comment;
|
||||
enum ETokenType token;
|
||||
- char subtag[1024];
|
||||
+ CharString subtag;
|
||||
UnicodeString rules;
|
||||
UBool haveRules = FALSE;
|
||||
UVersionInfo version;
|
||||
@@ -854,7 +854,8 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
|
||||
return NULL;
|
||||
}
|
||||
|
||||
- u_UCharsToChars(tokenValue->fChars, subtag, u_strlen(tokenValue->fChars) + 1);
|
||||
+ subtag.clear();
|
||||
+ subtag.appendInvariantChars(tokenValue->fChars, u_strlen(tokenValue->fChars), *status);
|
||||
|
||||
if (U_FAILURE(*status))
|
||||
{
|
||||
@@ -862,7 +863,7 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
|
||||
return NULL;
|
||||
}
|
||||
|
||||
- member = parseResource(state, subtag, NULL, status);
|
||||
+ member = parseResource(state, subtag.data(), NULL, status);
|
||||
|
||||
if (U_FAILURE(*status))
|
||||
{
|
||||
@@ -873,7 +874,7 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
|
||||
{
|
||||
// Ignore the parsed resources, continue parsing.
|
||||
}
|
||||
- else if (uprv_strcmp(subtag, "Version") == 0 && member->isString())
|
||||
+ else if (uprv_strcmp(subtag.data(), "Version") == 0 && member->isString())
|
||||
{
|
||||
StringResource *sr = static_cast<StringResource *>(member);
|
||||
char ver[40];
|
||||
@@ -890,11 +891,11 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
|
||||
result->add(member, line, *status);
|
||||
member = NULL;
|
||||
}
|
||||
- else if(uprv_strcmp(subtag, "%%CollationBin")==0)
|
||||
+ else if(uprv_strcmp(subtag.data(), "%%CollationBin")==0)
|
||||
{
|
||||
/* discard duplicate %%CollationBin if any*/
|
||||
}
|
||||
- else if (uprv_strcmp(subtag, "Sequence") == 0 && member->isString())
|
||||
+ else if (uprv_strcmp(subtag.data(), "Sequence") == 0 && member->isString())
|
||||
{
|
||||
StringResource *sr = static_cast<StringResource *>(member);
|
||||
rules = sr->fString;
|
||||
@@ -1047,7 +1048,7 @@ parseCollationElements(ParseState* state, char *tag, uint32_t startline, UBool n
|
||||
struct UString *tokenValue;
|
||||
struct UString comment;
|
||||
enum ETokenType token;
|
||||
- char subtag[1024], typeKeyword[1024];
|
||||
+ CharString subtag, typeKeyword;
|
||||
uint32_t line;
|
||||
|
||||
result = table_open(state->bundle, tag, NULL, status);
|
||||
@@ -1089,7 +1090,8 @@ parseCollationElements(ParseState* state, char *tag, uint32_t startline, UBool n
|
||||
return NULL;
|
||||
}
|
||||
|
||||
- u_UCharsToChars(tokenValue->fChars, subtag, u_strlen(tokenValue->fChars) + 1);
|
||||
+ subtag.clear();
|
||||
+ subtag.appendInvariantChars(tokenValue->fChars, u_strlen(tokenValue->fChars), *status);
|
||||
|
||||
if (U_FAILURE(*status))
|
||||
{
|
||||
@@ -1097,9 +1099,9 @@ parseCollationElements(ParseState* state, char *tag, uint32_t startline, UBool n
|
||||
return NULL;
|
||||
}
|
||||
|
||||
- if (uprv_strcmp(subtag, "default") == 0)
|
||||
+ if (uprv_strcmp(subtag.data(), "default") == 0)
|
||||
{
|
||||
- member = parseResource(state, subtag, NULL, status);
|
||||
+ member = parseResource(state, subtag.data(), NULL, status);
|
||||
|
||||
if (U_FAILURE(*status))
|
||||
{
|
||||
@@ -1118,22 +1120,28 @@ parseCollationElements(ParseState* state, char *tag, uint32_t startline, UBool n
|
||||
if(token == TOK_OPEN_BRACE) {
|
||||
token = getToken(state, &tokenValue, &comment, &line, status);
|
||||
TableResource *collationRes;
|
||||
- if (keepCollationType(subtag)) {
|
||||
- collationRes = table_open(state->bundle, subtag, NULL, status);
|
||||
+ if (keepCollationType(subtag.data())) {
|
||||
+ collationRes = table_open(state->bundle, subtag.data(), NULL, status);
|
||||
} else {
|
||||
collationRes = NULL;
|
||||
}
|
||||
// need to parse the collation data regardless
|
||||
- collationRes = addCollation(state, collationRes, subtag, startline, status);
|
||||
+ collationRes = addCollation(state, collationRes, subtag.data(), startline, status);
|
||||
if (collationRes != NULL) {
|
||||
result->add(collationRes, startline, *status);
|
||||
}
|
||||
} else if(token == TOK_COLON) { /* right now, we'll just try to see if we have aliases */
|
||||
/* we could have a table too */
|
||||
token = peekToken(state, 1, &tokenValue, &line, &comment, status);
|
||||
- u_UCharsToChars(tokenValue->fChars, typeKeyword, u_strlen(tokenValue->fChars) + 1);
|
||||
- if(uprv_strcmp(typeKeyword, "alias") == 0) {
|
||||
- member = parseResource(state, subtag, NULL, status);
|
||||
+ typeKeyword.clear();
|
||||
+ typeKeyword.appendInvariantChars(tokenValue->fChars, u_strlen(tokenValue->fChars), *status);
|
||||
+ if (U_FAILURE(*status))
|
||||
+ {
|
||||
+ res_close(result);
|
||||
+ return nullptr;
|
||||
+ }
|
||||
+ if(uprv_strcmp(typeKeyword.data(), "alias") == 0) {
|
||||
+ member = parseResource(state, subtag.data(), NULL, status);
|
||||
if (U_FAILURE(*status))
|
||||
{
|
||||
res_close(result);
|
||||
@@ -1175,7 +1183,7 @@ realParseTable(ParseState* state, TableResource *table, char *tag, uint32_t star
|
||||
struct UString *tokenValue=NULL;
|
||||
struct UString comment;
|
||||
enum ETokenType token;
|
||||
- char subtag[1024];
|
||||
+ CharString subtag;
|
||||
uint32_t line;
|
||||
UBool readToken = FALSE;
|
||||
|
||||
@@ -1214,7 +1222,8 @@ realParseTable(ParseState* state, TableResource *table, char *tag, uint32_t star
|
||||
}
|
||||
|
||||
if(uprv_isInvariantUString(tokenValue->fChars, -1)) {
|
||||
- u_UCharsToChars(tokenValue->fChars, subtag, u_strlen(tokenValue->fChars) + 1);
|
||||
+ subtag.clear();
|
||||
+ subtag.appendInvariantChars(tokenValue->fChars, u_strlen(tokenValue->fChars), *status);
|
||||
} else {
|
||||
*status = U_INVALID_FORMAT_ERROR;
|
||||
error(line, "invariant characters required for table keys");
|
||||
@@ -1227,7 +1236,7 @@ realParseTable(ParseState* state, TableResource *table, char *tag, uint32_t star
|
||||
return NULL;
|
||||
}
|
||||
|
||||
- member = parseResource(state, subtag, &comment, status);
|
||||
+ member = parseResource(state, subtag.data(), &comment, status);
|
||||
|
||||
if (member == NULL || U_FAILURE(*status))
|
||||
{
|
||||
--
|
||||
2.49.0
|
||||
|
||||
@@ -107,6 +107,7 @@ SRC_URI = "${BASE_SRC_URI};name=code \
|
||||
file://filter.json \
|
||||
file://fix-install-manx.patch \
|
||||
file://0001-icu-Added-armeb-support.patch \
|
||||
file://CVE-2025-5222.patch \
|
||||
"
|
||||
|
||||
SRC_URI:append:class-target = "\
|
||||
|
||||
Reference in New Issue
Block a user