i18npool/source/transliteration/transliteration_body.cxx | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
New commits:
commit 061f7ba80efe621503531ca9512b194ad8cefcd3
Author: Stephan Bergmann <sberg...@redhat.com>
AuthorDate: Fri Sep 17 09:24:22 2021 +0200
Commit: Stephan Bergmann <sberg...@redhat.com>
CommitDate: Fri Sep 17 11:24:46 2021 +0200
Fix calculation of alloca'ed memory size
...after 16d645e5b8f11b4ddb49a2b58bde388b28960abc "speedup
Transliteration_body::transliterateImpl", which caused
dynamic-stack-buffer-overflow
(<https://ci.libreoffice.org/job/lo_ubsan/2137/),
> ==4003==ERROR: AddressSanitizer: dynamic-stack-buffer-overflow on address
0x7fffe890f7d2 at pc 0x0000004b1c2d bp 0x7fffe890f490 sp 0x7fffe890ec40
> WRITE of size 2 at 0x7fffe890f7d2 thread T0
> #0 0x4b1c2c in __asan_memmove
/home/tdf/lode/packages/llvm-llvmorg-9.0.1.src/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cc:30
> #1 0x2b8b4222ef65 in char16_t* std::__copy_move<false, true,
std::random_access_iterator_tag>::__copy_m<char16_t>(char16_t const*, char16_t
const*, char16_t*)
/home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/stl_algobase.h:368:6
> #2 0x2b8b4222eec0 in char16_t* std::__copy_move_a<false, char16_t
const*, char16_t*>(char16_t const*, char16_t const*, char16_t*)
/home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/stl_algobase.h:385:14
> #3 0x2b8b4222d9be in char16_t* std::__copy_move_a2<false, char16_t
const*, char16_t*>(char16_t const*, char16_t const*, char16_t*)
/home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/stl_algobase.h:422:18
> #4 0x2b8b4222d2be in char16_t* std::copy<char16_t const*,
char16_t*>(char16_t const*, char16_t const*, char16_t*)
/home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/stl_algobase.h:454:15
> #5 0x2b8b4222cf43 in char16_t* std::__copy_n<char16_t const*, signed
char, char16_t*>(char16_t const*, signed char, char16_t*,
std::random_access_iterator_tag)
/home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/stl_algo.h:782:14
> #6 0x2b8b4222b495 in char16_t* std::copy_n<char16_t const*, signed
char, char16_t*>(char16_t const*, signed char, char16_t*)
/home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/stl_algo.h:806:14
> #7 0x2b8b42225872 in
i18npool::Transliteration_body::transliterateImpl(rtl::OUString const&, int,
int, com::sun::star::uno::Sequence<int>*)
/i18npool/source/transliteration/transliteration_body.cxx:145:13
> #8 0x2b8b42236f35 in
i18npool::transliteration_commonclass::transliterateString2String(rtl::OUString
const&, int, int)
/i18npool/source/transliteration/transliteration_commonclass.cxx:109:12
> #9 0x2b8b41fbc740 in i18npool::cclass_Unicode::toUpper(rtl::OUString
const&, int, int, com::sun::star::lang::Locale const&)
/i18npool/source/characterclassification/cclass_unicode.cxx:67:19
> #10 0x2b8b41fbc7b2 in non-virtual thunk to
i18npool::cclass_Unicode::toUpper(rtl::OUString const&, int, int,
com::sun::star::lang::Locale const&)
/i18npool/source/characterclassification/cclass_unicode.cxx
> #11 0x2b8b41ff1335 in
i18npool::CharacterClassificationImpl::toUpper(rtl::OUString const&, int, int,
com::sun::star::lang::Locale const&)
/i18npool/source/characterclassification/characterclassificationImpl.cxx:47:63
[...]
Change-Id: I5273e234c8921f635e31c414cb0e427ee8b04a95
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/122234
Reviewed-by: Noel Grandin <noel.gran...@collabora.co.uk>
Reviewed-by: Stephan Bergmann <sberg...@redhat.com>
Tested-by: Jenkins
diff --git a/i18npool/source/transliteration/transliteration_body.cxx
b/i18npool/source/transliteration/transliteration_body.cxx
index 3581212af8b3..1f4541082435 100644
--- a/i18npool/source/transliteration/transliteration_body.cxx
+++ b/i18npool/source/transliteration/transliteration_body.cxx
@@ -104,9 +104,8 @@ Transliteration_body::transliterateImpl(
constexpr sal_Int32 nLocalBuf = 2048;
sal_Unicode* out;
std::unique_ptr<sal_Unicode[]> pHeapBuf;
- size_t nBytes = (nCount + 1) * sizeof(sal_Unicode);
- if (nBytes <= nLocalBuf * NMAPPINGMAX)
- out = static_cast<sal_Unicode*>(alloca(nBytes));
+ if (nCount <= nLocalBuf)
+ out = static_cast<sal_Unicode*>(alloca(nCount * NMAPPINGMAX *
sizeof(sal_Unicode)));
else
{
pHeapBuf.reset(new sal_Unicode[ nCount * NMAPPINGMAX ]);
