mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-09 16:01:54 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/icu: backport upstream security fix for CVE-2025-5222

Browse Source 
Fixes CVE-2025-5222[1]. The patch is generated with
git format-patch -1 2c667e31cfd0b6bb1923627a932fd3453a5bac77 --relative=icu4c
and matches the Debian patch[2] aside from s/NULL/nullptr/ in the git
context. This is expected as the Debian patch is based on 72-1 and we
are on 73-2, so we have commit 2e0d30cfcf43 ("ICU-21833 Replace NULL
with nullptr in all C++ code.")

While NVD[1] and Debian[3] list ICU-22957 in their bug reports, looking
at the icu bug report[4] one can see it's marked as a duplicate of
ICU-22973[5] which also happens to be the bug ID specified in the commit
log of the commit listed in the Debian advisory[3].

[1] https://nvd.nist.gov/vuln/detail/CVE-2025-5222
[2] https://sources.debian.org/src/icu/72.1-3%2Bdeb12u1/debian/patches/0001-ICU-22973-Fix-buffer-overflow-by-using-CharString.patch
[3] https://security-tracker.debian.org/tracker/CVE-2025-5222
[4] https://unicode-org.atlassian.net/browse/ICU-22957
[5] https://unicode-org.atlassian.net/browse/ICU-22973

Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Quentin Schulz
2026-07-09 11:19:21 +02:00
committed by Thomas Perale
parent 9e52961485
commit ff80cc77b1
2 changed files with 165 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

162
package/icu/0005-ICU-22973-Fix-buffer-overflow-by-using-CharString.patch Normal file
View File

@@ -0,0 +1,162 @@
From 2c667e31cfd0b6bb1923627a932fd3453a5bac77 Mon Sep 17 00:00:00 2001
From: Frank Tang <ftang@chromium.org>
Date: Wed, 22 Jan 2025 11:50:59 -0800
Subject: [PATCH] ICU-22973 Fix buffer overflow by using CharString
Upstream: https://github.com/unicode-org/icu/commit/2c667e31cfd0b6bb1923627a932fd3453a5bac77
CVE: CVE-2025-5222
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
---
source/tools/genrb/parse.cpp | 49 +++++++++++++++++++++---------------
1 file changed, 29 insertions(+), 20 deletions(-)
diff --git a/source/tools/genrb/parse.cpp b/source/tools/genrb/parse.cpp
index f487241cc18..eb85d5157a6 100644
--- a/source/tools/genrb/parse.cpp
+++ b/source/tools/genrb/parse.cpp
@@ -1153,7 +1153,7 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
struct UString *tokenValue;
struct UString comment;
enum ETokenType token;
- char subtag[1024];
+ CharString subtag;
UnicodeString rules;
UBool haveRules = false;
UVersionInfo version;
@@ -1189,15 +1189,15 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
return nullptr;
}
- u_UCharsToChars(tokenValue->fChars, subtag, u_strlen(tokenValue->fChars) + 1);
-
+ subtag.clear();
+ subtag.appendInvariantChars(tokenValue->fChars, u_strlen(tokenValue->fChars), *status);
if (U_FAILURE(*status))
{
res_close(result);
return nullptr;
}
- member = parseResource(state, subtag, nullptr, status);
+ member = parseResource(state, subtag.data(), nullptr, status);
if (U_FAILURE(*status))
{
@@ -1208,7 +1208,7 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
{
// Ignore the parsed resources, continue parsing.
}
- else if (uprv_strcmp(subtag, "Version") == 0 && member->isString())
+ else if (uprv_strcmp(subtag.data(), "Version") == 0 && member->isString())
{
StringResource *sr = static_cast<StringResource *>(member);
char ver[40];
@@ -1225,11 +1225,11 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
result->add(member, line, *status);
member = nullptr;
}
- else if(uprv_strcmp(subtag, "%%CollationBin")==0)
+ else if(uprv_strcmp(subtag.data(), "%%CollationBin")==0)
{
/* discard duplicate %%CollationBin if any*/
}
- else if (uprv_strcmp(subtag, "Sequence") == 0 && member->isString())
+ else if (uprv_strcmp(subtag.data(), "Sequence") == 0 && member->isString())
{
StringResource *sr = static_cast<StringResource *>(member);
rules = sr->fString;
@@ -1395,7 +1395,7 @@ parseCollationElements(ParseState* state, char *tag, uint32_t startline, UBool n
struct UString *tokenValue;
struct UString comment;
enum ETokenType token;
- char subtag[1024], typeKeyword[1024];
+ CharString subtag, typeKeyword;
uint32_t line;
result = table_open(state->bundle, tag, nullptr, status);
@@ -1437,7 +1437,8 @@ parseCollationElements(ParseState* state, char *tag, uint32_t startline, UBool n
return nullptr;
}
- u_UCharsToChars(tokenValue->fChars, subtag, u_strlen(tokenValue->fChars) + 1);
+ subtag.clear();
+ subtag.appendInvariantChars(tokenValue->fChars, u_strlen(tokenValue->fChars), *status);
if (U_FAILURE(*status))
{
@@ -1445,9 +1446,9 @@ parseCollationElements(ParseState* state, char *tag, uint32_t startline, UBool n
return nullptr;
}
- if (uprv_strcmp(subtag, "default") == 0)
+ if (uprv_strcmp(subtag.data(), "default") == 0)
{
- member = parseResource(state, subtag, nullptr, status);
+ member = parseResource(state, subtag.data(), nullptr, status);
if (U_FAILURE(*status))
{
@@ -1466,22 +1467,29 @@ parseCollationElements(ParseState* state, char *tag, uint32_t startline, UBool n
if(token == TOK_OPEN_BRACE) {
token = getToken(state, &tokenValue, &comment, &line, status);
TableResource *collationRes;
- if (keepCollationType(subtag)) {
- collationRes = table_open(state->bundle, subtag, nullptr, status);
+ if (keepCollationType(subtag.data())) {
+ collationRes = table_open(state->bundle, subtag.data(), nullptr, status);
} else {
collationRes = nullptr;
}
// need to parse the collation data regardless
- collationRes = addCollation(state, collationRes, subtag, startline, status);
+ collationRes = addCollation(state, collationRes, subtag.data(), startline, status);
if (collationRes != nullptr) {
result->add(collationRes, startline, *status);
}
} else if(token == TOK_COLON) { /* right now, we'll just try to see if we have aliases */
/* we could have a table too */
token = peekToken(state, 1, &tokenValue, &line, &comment, status);
- u_UCharsToChars(tokenValue->fChars, typeKeyword, u_strlen(tokenValue->fChars) + 1);
- if(uprv_strcmp(typeKeyword, "alias") == 0) {
- member = parseResource(state, subtag, nullptr, status);
+ typeKeyword.clear();
+ typeKeyword.appendInvariantChars(tokenValue->fChars, u_strlen(tokenValue->fChars), *status);
+ if (U_FAILURE(*status))
+ {
+ res_close(result);
+ return nullptr;
+ }
+
+ if(uprv_strcmp(typeKeyword.data(), "alias") == 0) {
+ member = parseResource(state, subtag.data(), nullptr, status);
if (U_FAILURE(*status))
{
res_close(result);
@@ -1523,7 +1531,7 @@ realParseTable(ParseState* state, TableResource *table, char *tag, uint32_t star
struct UString *tokenValue=nullptr;
struct UString comment;
enum ETokenType token;
- char subtag[1024];
+ CharString subtag;
uint32_t line;
UBool readToken = false;
@@ -1562,7 +1570,8 @@ realParseTable(ParseState* state, TableResource *table, char *tag, uint32_t star
}
if(uprv_isInvariantUString(tokenValue->fChars, -1)) {
- u_UCharsToChars(tokenValue->fChars, subtag, u_strlen(tokenValue->fChars) + 1);
+ subtag.clear();
+ subtag.appendInvariantChars(tokenValue->fChars, u_strlen(tokenValue->fChars), *status);
} else {
*status = U_INVALID_FORMAT_ERROR;
error(line, "invariant characters required for table keys");
@@ -1575,7 +1584,7 @@ realParseTable(ParseState* state, TableResource *table, char *tag, uint32_t star
return nullptr;
}
- member = parseResource(state, subtag, &comment, status);
+ member = parseResource(state, subtag.data(), &comment, status);
if (member == nullptr || U_FAILURE(*status))
{

3
package/icu/icu.mk
View File

@@ -17,6 +17,9 @@ ICU_CPE_ID_VENDOR = unicode
ICU_CPE_ID_PRODUCT = international_components_for_unicode
ICU_CPE_ID_VERSION = $(subst -,.,$(ICU_VERSION))
# 0005-ICU-22973-Fix-buffer-overflow-by-using-CharString.patch
ICU_IGNORE_CVES += CVE-2025-5222
ICU_DEPENDENCIES = host-icu
ICU_INSTALL_STAGING = YES
ICU_CONFIG_SCRIPTS = icu-config