AuroraMiddleware/scuffed-code
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ICU-3008 udata name buffer overflow handling

Browse Source 
X-SVN-Rev: 14103
This commit is contained in:
Andy Heninger 2003-12-11 21:07:32 +00:00
parent 857974c3e5
commit 7211e3f14a
2 changed files with 43 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
icu4c/source/common/udata.c
View File

@ -991,8 +991,8 @@ doOpenChoice(const char *path, const char *type, const char *name,
const char *pathBuffer;
TinyString tocEntryName;
char oldStylePath[1024];
char oldStylePathBasename[100];
TinyString oldStylePath;
TinyString oldStylePathBasename;
const char *dataPath;
const char *tocEntrySuffix;
@ -1004,12 +1004,16 @@ doOpenChoice(const char *path, const char *type, const char *name,
const char *inBasename;
UErrorCode errorCode=U_ZERO_ERROR;
UBool isICUData= (UBool)(path==NULL);
TinyString_init(&tocEntryName);
TinyString_init(&oldStylePath);
TinyString_init(&oldStylePathBasename);
/* Make up a full mame by appending the type to the supplied
* name, assuming that a type was supplied.
*/
/* prepend the package */
TinyString_init(&tocEntryName);
TinyString_append(&tocEntryName, packageNameFromPath(path));
tocEntrySuffixIndex = tocEntryName.length;
@ -1053,16 +1057,19 @@ doOpenChoice(const char *path, const char *type, const char *name,
*/
char *rightSlash;
uprv_strcpy(oldStylePath, path);
oldStylePath[uprv_strlen(path)-1]=0; /* chop off trailing slash */
TinyString_append(&oldStylePath, path);
/* chop off trailing slash */
oldStylePath.length--;
oldStylePath.s[oldStylePath.length] = 0;
rightSlash = (char*)uprv_strrchr(oldStylePath, U_FILE_SEP_CHAR);
rightSlash = (char*)uprv_strrchr(oldStylePath.s, U_FILE_SEP_CHAR);
if(rightSlash != NULL) {
rightSlash++;
inBasename = uprv_strcpy(oldStylePathBasename, rightSlash);
uprv_strcat(oldStylePath, U_FILE_SEP_STRING);
uprv_strcat(oldStylePath, inBasename); /* one more time, for the base name */
path = oldStylePath;
TinyString_append(&oldStylePathBasename, rightSlash);
inBasename = oldStylePathBasename.s;
TinyString_append(&oldStylePath, U_FILE_SEP_STRING);
TinyString_append(&oldStylePath, inBasename); /* one more time, for the base name */
path = oldStylePath.s;
} else {
*pErrorCode = U_FILE_ACCESS_ERROR; /* hopelessly bad case */
retVal = NULL;

51
icu4c/source/test/cintltst/udatatst.c
View File

@ -280,48 +280,49 @@ static void TestUDataOpen(){
* overflow handling code.
*/
{
#if 1
/* TODO: fix doOpenChoice(). Bug 3121. */
char longTestPath[1024]; /* Implementation goes to heap at length of 128. */
char longName[1024];
/* long test path starts with a long, nonexistent directory, then
* has a second entry that is the normal test path */
/* Try a very long nonexistent directory path.
* udata_open should still succeed. Opening with the path will fail,
* then fall back to skipping the directory portion of the path.
*/
log_verbose("Testing udata_open() with really long names\n");
strcpy(longTestPath, "bogus_directory_name");
longTestPath[0] = 0;
strcat(longTestPath, "bogus_directory_name");
while (strlen(longTestPath) < 500) {
strcat(longTestPath, dirSepString);
strcat(longTestPath, "bogus_directory_name");
}
strcat(longTestPath, pathSepString);
strcat(longTestPath, testPath);
/* Make up an item name to open that includes a long, bogus path.
* udata_open will try with the path first, then strip it off and try with
* the paths from the path parameter.
*/
strcpy(longName, "bogusItemPath");
while (strlen(longName) < 500) {
strcat(longName, dirSepString);
strcat(longName, "bogusItemPath");
}
strcat(longName, dirSepString);
strcat(longName, name);
result=udata_open(longTestPath, type, longName, &status);
result=udata_open(longTestPath, type, name, &status);
if(U_FAILURE(status)){
log_err("FAIL: udata_open() failed for path = %s, name=%s, type=%s, \n errorcode=%s\n",
longTestPath, longName, type, myErrorName(status));
log_err("FAIL: udata_open() failed for path = %s\n name=%s, type=%s, \n errorcode=%s\n",
longTestPath, name, type, myErrorName(status));
} else {
log_verbose("PASS: udata_open worked\n");
udata_close(result);
}
#endif
/* Try a very long name. Won't open, but shouldn't blow up.
*/
longName[0] = 0;
while (strlen(longName) < 500) {
strcat(longName, name);
strcat(longName, "_");
}
strcat(longName, dirSepString);
strcat(longName, name);
result=udata_open(longTestPath, type, longName, &status);
if (status != U_FILE_ACCESS_ERROR) {
log_err("FAIL: udata_open() failed for path = %s\n name=%s, type=%s, \n errorcode=%s\n",
longTestPath, longName, type, myErrorName(status));
}
udata_close(result);
}
free(path);
}