Jan Engelhardt
19a13e1ea4
- Version bump to 53.1: * Data from the CLDR 25 release: Many bug fixes * Time zone data: 2014b, including post CLDR 25 time zone data update to CLDR. * U+20BD Ruble Sign added (from Unicode 7.0, otherwise ICU 53 still uses Unicode 6.3) * Collation code re-implemented * ICU4C now requires compilers with C99 support * Updated Spoof Checker for Unicode Security Standard version 6.3. (#10706) * many more see http://site.icu-project.org/download/53 - Clean up with spec-cleaner and remove some obsolete provide/obsolete - Use official download tarballs instead of repacks OBS-URL: https://build.opensuse.org/request/show/236140 OBS-URL: https://build.opensuse.org/package/show/X11:common:Factory/icu?expand=0&rev=43
35 lines
1.4 KiB
Diff
35 lines
1.4 KiB
Diff
From: Jan Engelhardt <jengelh@inai.de>
|
|
Reference: http://bugs.icu-project.org/trac/ticket/7808
|
|
|
|
build: resolve potential buffer overflow in icu
|
|
|
|
I: Statement might be overflowing a buffer in strncat. Common mistake:
|
|
BAD: strncat(buffer,charptr,sizeof(buffer)) is wrong, it takes the left over size as 3rd argument
|
|
GOOD: strncat(buffer,charptr,sizeof(buffer)-strlen(buffer)-1)
|
|
E: icu bufferoverflowstrncat pkgdata.cpp:299:87
|
|
|
|
---
|
|
source/tools/pkgdata/pkgdata.cpp | 6 +++---
|
|
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
|
|
Index: icu/source/tools/pkgdata/pkgdata.cpp
|
|
===================================================================
|
|
--- icu.orig/source/tools/pkgdata/pkgdata.cpp 2014-06-03 13:07:41.342876943 +0200
|
|
+++ icu/source/tools/pkgdata/pkgdata.cpp 2014-06-03 13:08:45.537882879 +0200
|
|
@@ -2069,12 +2069,12 @@
|
|
const char cmd[] = "icu-config --incpkgdatafile";
|
|
|
|
/* #1 try the same path where pkgdata was called from. */
|
|
- findDirname(progname, cmdBuf, 1024, &status);
|
|
+ findDirname(progname, cmdBuf, sizeof(cmdBuf), &status);
|
|
if(U_SUCCESS(status)) {
|
|
if (cmdBuf[0] != 0) {
|
|
- uprv_strncat(cmdBuf, U_FILE_SEP_STRING, 1024);
|
|
+ uprv_strncat(cmdBuf, U_FILE_SEP_STRING, sizeof(cmdBuf)-1-strlen(cmdBuf));
|
|
}
|
|
- uprv_strncat(cmdBuf, cmd, 1023);
|
|
+ uprv_strncat(cmdBuf, cmd, sizeof(cmdBuf)-1-strlen(cmdBuf));
|
|
|
|
if(verbose) {
|
|
fprintf(stdout, "# Calling icu-config: %s\n", cmdBuf);
|