Closed
Bug 1019940
Opened 11 years ago
Closed 4 years ago
Buffer overflow in ucol_buildPermutationTable
Categories
(Core :: JavaScript: Internationalization API, defect)
Core
JavaScript: Internationalization API
Tracking
()
RESOLVED
FIXED
People
(Reporter: mccr8, Unassigned)
References
(Blocks 1 open bug)
Details
(Keywords: coverity, csectype-bounds, sec-low)
reorderCode can end up being equal to 256, so we end up writing a 1 right past the end of the array. Doesn't seem like it could be super dangerous.
code:
// lead bytes that have alread been assigned to the permutation table
bool newLeadByteUsed[256];
...
int reorderCode = 0;
for (int i = 0; i < 256; i++) {
if (!permutationSlotFilled[i]) {
while (reorderCode < 256 && newLeadByteUsed[reorderCode]) {
reorderCode++;
}
...
newLeadByteUsed[reorderCode] = true;
Updated•10 years ago
|
Group: core-security → javascript-core-security
Updated•7 years ago
|
Blocks: coverity-analysis
Comment 1•4 years ago
|
||
Fixed by Bug 1075758 (Update ICU to 55.1)
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Updated•4 years ago
|
Group: core-security-release
You need to log in
before you can comment on or make changes to this bug.
Description
•