summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHitendra Prajapati <hprajapati@mvista.com>2025-06-03 11:56:20 +0530
committerSteve Sakoman <steve@sakoman.com>2025-06-13 08:42:34 -0700
commite35c7960a75961be26659eb483abfba86f531db0 (patch)
tree87d2081fc54c3c83d7eb2061fc8a6c0f27a6a3b7
parent5b18890ace80564494a7544c94e4c46882d93e2b (diff)
downloadpoky-e35c7960a75961be26659eb483abfba86f531db0.tar.gz
icu: fix CVE-2025-5222
Upstream-Status: Backport from https://github.com/unicode-org/icu/commit/2c667e31cfd0b6bb1923627a932fd3453a5bac77 (From OE-Core rev: a7a82be3b409d496f7a0813055f77212a3b0ef12) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat
-rw-r--r--meta/recipes-support/icu/icu/CVE-2025-5222.patch164
-rw-r--r--meta/recipes-support/icu/icu_70.1.bb1
2 files changed, 165 insertions, 0 deletions
diff --git a/meta/recipes-support/icu/icu/CVE-2025-5222.patch b/meta/recipes-support/icu/icu/CVE-2025-5222.patch
new file mode 100644
index 0000000000..f71287c935
--- /dev/null
+++ b/meta/recipes-support/icu/icu/CVE-2025-5222.patch
@@ -0,0 +1,164 @@
1From 2c667e31cfd0b6bb1923627a932fd3453a5bac77 Mon Sep 17 00:00:00 2001
2From: Frank Tang <ftang@chromium.org>
3Date: Wed, 22 Jan 2025 11:50:59 -0800
4Subject: [PATCH] ICU-22973 Fix buffer overflow by using CharString
5
6Upstream-Status: Backport [https://github.com/unicode-org/icu/commit/2c667e31cfd0b6bb1923627a932fd3453a5bac77]
7CVE: CVE-2025-5222
8Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
9---
10 tools/genrb/parse.cpp | 47 +++++++++++++++++++++---------------
11 1 file changed, 28 insertions(+), 19 deletions(-)
12
13diff --git a/tools/genrb/parse.cpp b/tools/genrb/parse.cpp
14index 7d5ffe1..175def0 100644
15--- a/tools/genrb/parse.cpp
16+++ b/tools/genrb/parse.cpp
17@@ -818,7 +818,7 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
18 struct UString *tokenValue;
19 struct UString comment;
20 enum ETokenType token;
21- char subtag[1024];
22+ CharString subtag;
23 UnicodeString rules;
24 UBool haveRules = FALSE;
25 UVersionInfo version;
26@@ -854,7 +854,8 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
27 return NULL;
28 }
29
30- u_UCharsToChars(tokenValue->fChars, subtag, u_strlen(tokenValue->fChars) + 1);
31+ subtag.clear();
32+ subtag.appendInvariantChars(tokenValue->fChars, u_strlen(tokenValue->fChars), *status);
33
34 if (U_FAILURE(*status))
35 {
36@@ -862,7 +863,7 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
37 return NULL;
38 }
39
40- member = parseResource(state, subtag, NULL, status);
41+ member = parseResource(state, subtag.data(), NULL, status);
42
43 if (U_FAILURE(*status))
44 {
45@@ -873,7 +874,7 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
46 {
47 // Ignore the parsed resources, continue parsing.
48 }
49- else if (uprv_strcmp(subtag, "Version") == 0 && member->isString())
50+ else if (uprv_strcmp(subtag.data(), "Version") == 0 && member->isString())
51 {
52 StringResource *sr = static_cast<StringResource *>(member);
53 char ver[40];
54@@ -890,11 +891,11 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
55 result->add(member, line, *status);
56 member = NULL;
57 }
58- else if(uprv_strcmp(subtag, "%%CollationBin")==0)
59+ else if(uprv_strcmp(subtag.data(), "%%CollationBin")==0)
60 {
61 /* discard duplicate %%CollationBin if any*/
62 }
63- else if (uprv_strcmp(subtag, "Sequence") == 0 && member->isString())
64+ else if (uprv_strcmp(subtag.data(), "Sequence") == 0 && member->isString())
65 {
66 StringResource *sr = static_cast<StringResource *>(member);
67 rules = sr->fString;
68@@ -1047,7 +1048,7 @@ parseCollationElements(ParseState* state, char *tag, uint32_t startline, UBool n
69 struct UString *tokenValue;
70 struct UString comment;
71 enum ETokenType token;
72- char subtag[1024], typeKeyword[1024];
73+ CharString subtag, typeKeyword;
74 uint32_t line;
75
76 result = table_open(state->bundle, tag, NULL, status);
77@@ -1089,7 +1090,8 @@ parseCollationElements(ParseState* state, char *tag, uint32_t startline, UBool n
78 return NULL;
79 }
80
81- u_UCharsToChars(tokenValue->fChars, subtag, u_strlen(tokenValue->fChars) + 1);
82+ subtag.clear();
83+ subtag.appendInvariantChars(tokenValue->fChars, u_strlen(tokenValue->fChars), *status);
84
85 if (U_FAILURE(*status))
86 {
87@@ -1097,9 +1099,9 @@ parseCollationElements(ParseState* state, char *tag, uint32_t startline, UBool n
88 return NULL;
89 }
90
91- if (uprv_strcmp(subtag, "default") == 0)
92+ if (uprv_strcmp(subtag.data(), "default") == 0)
93 {
94- member = parseResource(state, subtag, NULL, status);
95+ member = parseResource(state, subtag.data(), NULL, status);
96
97 if (U_FAILURE(*status))
98 {
99@@ -1118,22 +1120,28 @@ parseCollationElements(ParseState* state, char *tag, uint32_t startline, UBool n
100 if(token == TOK_OPEN_BRACE) {
101 token = getToken(state, &tokenValue, &comment, &line, status);
102 TableResource *collationRes;
103- if (keepCollationType(subtag)) {
104- collationRes = table_open(state->bundle, subtag, NULL, status);
105+ if (keepCollationType(subtag.data())) {
106+ collationRes = table_open(state->bundle, subtag.data(), NULL, status);
107 } else {
108 collationRes = NULL;
109 }
110 // need to parse the collation data regardless
111- collationRes = addCollation(state, collationRes, subtag, startline, status);
112+ collationRes = addCollation(state, collationRes, subtag.data(), startline, status);
113 if (collationRes != NULL) {
114 result->add(collationRes, startline, *status);
115 }
116 } else if(token == TOK_COLON) { /* right now, we'll just try to see if we have aliases */
117 /* we could have a table too */
118 token = peekToken(state, 1, &tokenValue, &line, &comment, status);
119- u_UCharsToChars(tokenValue->fChars, typeKeyword, u_strlen(tokenValue->fChars) + 1);
120- if(uprv_strcmp(typeKeyword, "alias") == 0) {
121- member = parseResource(state, subtag, NULL, status);
122+ typeKeyword.clear();
123+ typeKeyword.appendInvariantChars(tokenValue->fChars, u_strlen(tokenValue->fChars), *status);
124+ if (U_FAILURE(*status))
125+ {
126+ res_close(result);
127+ return nullptr;
128+ }
129+ if(uprv_strcmp(typeKeyword.data(), "alias") == 0) {
130+ member = parseResource(state, subtag.data(), NULL, status);
131 if (U_FAILURE(*status))
132 {
133 res_close(result);
134@@ -1175,7 +1183,7 @@ realParseTable(ParseState* state, TableResource *table, char *tag, uint32_t star
135 struct UString *tokenValue=NULL;
136 struct UString comment;
137 enum ETokenType token;
138- char subtag[1024];
139+ CharString subtag;
140 uint32_t line;
141 UBool readToken = FALSE;
142
143@@ -1214,7 +1222,8 @@ realParseTable(ParseState* state, TableResource *table, char *tag, uint32_t star
144 }
145
146 if(uprv_isInvariantUString(tokenValue->fChars, -1)) {
147- u_UCharsToChars(tokenValue->fChars, subtag, u_strlen(tokenValue->fChars) + 1);
148+ subtag.clear();
149+ subtag.appendInvariantChars(tokenValue->fChars, u_strlen(tokenValue->fChars), *status);
150 } else {
151 *status = U_INVALID_FORMAT_ERROR;
152 error(line, "invariant characters required for table keys");
153@@ -1227,7 +1236,7 @@ realParseTable(ParseState* state, TableResource *table, char *tag, uint32_t star
154 return NULL;
155 }
156
157- member = parseResource(state, subtag, &comment, status);
158+ member = parseResource(state, subtag.data(), &comment, status);
159
160 if (member == NULL || U_FAILURE(*status))
161 {
162--
1632.49.0
164
diff --git a/meta/recipes-support/icu/icu_70.1.bb b/meta/recipes-support/icu/icu_70.1.bb
index dd684fe5b9..0a4e7f90f6 100644
--- a/meta/recipes-support/icu/icu_70.1.bb
+++ b/meta/recipes-support/icu/icu_70.1.bb
@@ -107,6 +107,7 @@ SRC_URI = "${BASE_SRC_URI};name=code \
107 file://filter.json \ 107 file://filter.json \
108 file://fix-install-manx.patch \ 108 file://fix-install-manx.patch \
109 file://0001-icu-Added-armeb-support.patch \ 109 file://0001-icu-Added-armeb-support.patch \
110 file://CVE-2025-5222.patch \
110 " 111 "
111 112
112SRC_URI:append:class-target = "\ 113SRC_URI:append:class-target = "\
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-16 00:56:23 +0000