1871634 - buffer overflow in ICU _appendKeywordsToLanguageTag

Status: RESOLVED INVALID

(Core :: Internationalization, defect)

Description

[D4ni31 [:d4ni31]]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36

Steps to reproduce:

Title

• Mozilla Firefox _appendKeywordsToLanguageTag buffer overflow Vulnerability

Summary

• A buffer overflow Vulnerability exists in the ICU uloc_tag _appendKeywordsToLanguageTag function.
• It was already patched in ICU Project 3 months ago, but it was not merged into Firefox.

ICU Project Patch Commit

• https://github.com/unicode-org/icu/pull/2600/files

Patch

icu4c/source/common/uloc_tag.cpp
@@ -1326,14 +1326,23 @@ _appendKeywordsToLanguageTag(const char* localeID, icu::ByteSink& sink, UBool st

                        attrBufLength = 0;
                        for (; i < len; i++) {
                            if (buf[i] != '-') {
-                               attrBuf[attrBufLength++] = buf[i];
+                               if (static_cast<size_t>(attrBufLength) < sizeof(attrBuf)) {
+                                   attrBuf[attrBufLength++] = buf[i];
+                               } else {
+                                   *status = U_ILLEGAL_ARGUMENT_ERROR;
+                                   return;
+                               }
                            } else {
                                i++;
                                break;
                            }
                        }
                        if (attrBufLength > 0) {
-                           attrBuf[attrBufLength] = 0;
+                           if (static_cast<size_t>(attrBufLength) < sizeof(attrBuf)) {
+                               attrBuf[attrBufLength] = 0;
+                           } else {
+                               *status = U_STRING_NOT_TERMINATED_WARNING;
+                           }

                        } else if (i >= len){
                            break;

Comment 1

[D4ni31 [:d4ni31]]

https://searchfox.org/mozilla-central/source/intl/icu/source/common/uloc_tag.cpp#1329

Comment 2

[Daniel Veditz [:dveditz]]

This code appears to be unused, or at least untested, in our tree.

Comment 3

[Tom Ritter [:tjr] (OOTO until April)]

Correct, this code is not used in firefox, especially not where an attacker could trigger the vulnerability.