1019935 - Buffer overflow in uprv_tzname

Status: RESOLVED FIXED

(Core :: JavaScript: Internationalization API, defect)

Description

[Andrew McCreight [:mccr8]]

The method uprv_tzname in intl/icu/source/common/putil.cpp can write a zero to one byte past the end of the buffer:

        int32_t ret = (int32_t)readlink(TZDEFAULT, gTimeZoneBuffer, sizeof(gTimeZoneBuffer));
        if (0 < ret) {
            int32_t tzZoneInfoLen = uprv_strlen(TZZONEINFO);
            gTimeZoneBuffer[ret] = 0;

readlink() will read up to the size passed in as the third argument.  If it ends up actually filling the entire buffer, then the attempt to null-terminate the buffer writes off the end.  I think the fix is just to pass in sizeof(gTimeZoneBuffer) - 1 instead.

I doubt this is too much of a problem in practice, but I'm filing it s-s just in case.

Comment 1

[Ted Campbell [:tcampbell]]

Fixed by Bug https://bugzilla.mozilla.org/show_bug.cgi?id=1299615 (ICU 58)