From 079ab7f0b101bc237633490cb8964f7991bedf6a Mon Sep 17 00:00:00 2001 From: Jessica Hamilton Date: Thu, 12 Jan 2017 01:20:31 +1300 Subject: [PATCH] ICU add-on: validate mbState->converter before attempting to close. This resolves crashes in gawk with multibyte support. Fixes #12515, #13103. --- src/system/libroot/add-ons/icu/ICUCtypeData.cpp | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/system/libroot/add-ons/icu/ICUCtypeData.cpp b/src/system/libroot/add-ons/icu/ICUCtypeData.cpp index 9fd3ff22b9..6eed437bef 100644 --- a/src/system/libroot/add-ons/icu/ICUCtypeData.cpp +++ b/src/system/libroot/add-ons/icu/ICUCtypeData.cpp @@ -551,8 +551,13 @@ ICUCtypeData::_GetConverterForMbState(mbstate_t* mbState, status_t ICUCtypeData::_DropConverterFromMbState(mbstate_t* mbState) { - if (mbState->converter != NULL) + if (mbState->converter != NULL && (char*)mbState->converter >= mbState->data + && (char*)mbState->converter < mbState->data + 8) { + // check that the converter actually lives in *this* mbState, + // otherwise we risk freeing a converter that doesn't belong to us; + // this parallels the check in _GetConverterForMbState() ucnv_close((UConverter*)mbState->converter); + } memset(mbState, 0, sizeof(mbstate_t)); return B_OK;