Skip to content

Commit 31ef6cc

Browse files
CBL-Mariner-Botazurelinux-securitykgodara912Kanishk-Bansal
authored
[AUTO-CHERRYPICK] [AutoPR- Security] Patch icu for CVE-2025-5222 [HIGH] - branch main (microsoft#14500)
Co-authored-by: Azure Linux Security Servicing Account <[email protected]> Co-authored-by: kgodara912 <[email protected]> Co-authored-by: Kanishk Bansal <[email protected]>
1 parent 512173a commit 31ef6cc

File tree

2 files changed

+170
-2
lines changed

2 files changed

+170
-2
lines changed

‎SPECS/icu/CVE-2025-5222.patch‎

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
From 37aa6320032eee9385de82a6d30167a6cdeb2fc5 Mon Sep 17 00:00:00 2001
2+
From: Frank Tang <[email protected]>
3+
Date: Wed, 22 Jan 2025 11:50:59 -0800
4+
Subject: [PATCH] ICU-22973 Fix buffer overflow by using CharString
5+
6+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
7+
Upstream-reference: https://github.com/unicode-org/icu/commit/2c667e31cfd0b6bb1923627a932fd3453a5bac77.patch
8+
---
9+
icu/icu4c/source/tools/genrb/parse.cpp | 49 +++++++++++++++-----------
10+
1 file changed, 29 insertions(+), 20 deletions(-)
11+
12+
diff --git a/icu/icu4c/source/tools/genrb/parse.cpp b/icu/icu4c/source/tools/genrb/parse.cpp
13+
index 18a8c76..b301101 100644
14+
--- a/icu/icu4c/source/tools/genrb/parse.cpp
15+
+++ b/icu/icu4c/source/tools/genrb/parse.cpp
16+
@@ -818,7 +818,7 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
17+
struct UString *tokenValue;
18+
struct UString comment;
19+
enum ETokenType token;
20+
- char subtag[1024];
21+
+ CharString subtag;
22+
UnicodeString rules;
23+
UBool haveRules = FALSE;
24+
UVersionInfo version;
25+
@@ -854,15 +854,15 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
26+
return NULL;
27+
}
28+
29+
- u_UCharsToChars(tokenValue->fChars, subtag, u_strlen(tokenValue->fChars) + 1);
30+
-
31+
+ subtag.clear();
32+
+ subtag.appendInvariantChars(tokenValue->fChars, u_strlen(tokenValue->fChars), *status);
33+
if (U_FAILURE(*status))
34+
{
35+
res_close(result);
36+
return NULL;
37+
}
38+
39+
- member = parseResource(state, subtag, NULL, status);
40+
+ member = parseResource(state, subtag.data(), NULL, status);
41+
42+
if (U_FAILURE(*status))
43+
{
44+
@@ -873,7 +873,7 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
45+
{
46+
// Ignore the parsed resources, continue parsing.
47+
}
48+
- else if (uprv_strcmp(subtag, "Version") == 0 && member->isString())
49+
+ else if (uprv_strcmp(subtag.data(), "Version") == 0 && member->isString())
50+
{
51+
StringResource *sr = static_cast<StringResource *>(member);
52+
char ver[40];
53+
@@ -890,11 +890,11 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
54+
result->add(member, line, *status);
55+
member = NULL;
56+
}
57+
- else if(uprv_strcmp(subtag, "%%CollationBin")==0)
58+
+ else if(uprv_strcmp(subtag.data(), "%%CollationBin")==0)
59+
{
60+
/* discard duplicate %%CollationBin if any*/
61+
}
62+
- else if (uprv_strcmp(subtag, "Sequence") == 0 && member->isString())
63+
+ else if (uprv_strcmp(subtag.data(), "Sequence") == 0 && member->isString())
64+
{
65+
StringResource *sr = static_cast<StringResource *>(member);
66+
rules = sr->fString;
67+
@@ -1047,7 +1047,7 @@ parseCollationElements(ParseState* state, char *tag, uint32_t startline, UBool n
68+
struct UString *tokenValue;
69+
struct UString comment;
70+
enum ETokenType token;
71+
- char subtag[1024], typeKeyword[1024];
72+
+ CharString subtag, typeKeyword;
73+
uint32_t line;
74+
75+
result = table_open(state->bundle, tag, NULL, status);
76+
@@ -1089,7 +1089,8 @@ parseCollationElements(ParseState* state, char *tag, uint32_t startline, UBool n
77+
return NULL;
78+
}
79+
80+
- u_UCharsToChars(tokenValue->fChars, subtag, u_strlen(tokenValue->fChars) + 1);
81+
+ subtag.clear();
82+
+ subtag.appendInvariantChars(tokenValue->fChars, u_strlen(tokenValue->fChars), *status);
83+
84+
if (U_FAILURE(*status))
85+
{
86+
@@ -1097,9 +1098,9 @@ parseCollationElements(ParseState* state, char *tag, uint32_t startline, UBool n
87+
return NULL;
88+
}
89+
90+
- if (uprv_strcmp(subtag, "default") == 0)
91+
+ if (uprv_strcmp(subtag.data(), "default") == 0)
92+
{
93+
- member = parseResource(state, subtag, NULL, status);
94+
+ member = parseResource(state, subtag.data(), NULL, status);
95+
96+
if (U_FAILURE(*status))
97+
{
98+
@@ -1118,22 +1119,29 @@ parseCollationElements(ParseState* state, char *tag, uint32_t startline, UBool n
99+
if(token == TOK_OPEN_BRACE) {
100+
token = getToken(state, &tokenValue, &comment, &line, status);
101+
TableResource *collationRes;
102+
- if (keepCollationType(subtag)) {
103+
- collationRes = table_open(state->bundle, subtag, NULL, status);
104+
+ if (keepCollationType(subtag.data())) {
105+
+ collationRes = table_open(state->bundle, subtag.data(), NULL, status);
106+
} else {
107+
collationRes = NULL;
108+
}
109+
// need to parse the collation data regardless
110+
- collationRes = addCollation(state, collationRes, subtag, startline, status);
111+
+ collationRes = addCollation(state, collationRes, subtag.data(), startline, status);
112+
if (collationRes != NULL) {
113+
result->add(collationRes, startline, *status);
114+
}
115+
} else if(token == TOK_COLON) { /* right now, we'll just try to see if we have aliases */
116+
/* we could have a table too */
117+
token = peekToken(state, 1, &tokenValue, &line, &comment, status);
118+
- u_UCharsToChars(tokenValue->fChars, typeKeyword, u_strlen(tokenValue->fChars) + 1);
119+
- if(uprv_strcmp(typeKeyword, "alias") == 0) {
120+
- member = parseResource(state, subtag, NULL, status);
121+
+ typeKeyword.clear();
122+
+ typeKeyword.appendInvariantChars(tokenValue->fChars, u_strlen(tokenValue->fChars), *status);
123+
+ if (U_FAILURE(*status))
124+
+ {
125+
+ res_close(result);
126+
+ return NULL;
127+
+ }
128+
+
129+
+ if(uprv_strcmp(typeKeyword.data(), "alias") == 0) {
130+
+ member = parseResource(state, subtag.data(), NULL, status);
131+
if (U_FAILURE(*status))
132+
{
133+
res_close(result);
134+
@@ -1175,7 +1183,7 @@ realParseTable(ParseState* state, TableResource *table, char *tag, uint32_t star
135+
struct UString *tokenValue=NULL;
136+
struct UString comment;
137+
enum ETokenType token;
138+
- char subtag[1024];
139+
+ CharString subtag;
140+
uint32_t line;
141+
UBool readToken = FALSE;
142+
143+
@@ -1214,7 +1222,8 @@ realParseTable(ParseState* state, TableResource *table, char *tag, uint32_t star
144+
}
145+
146+
if(uprv_isInvariantUString(tokenValue->fChars, -1)) {
147+
- u_UCharsToChars(tokenValue->fChars, subtag, u_strlen(tokenValue->fChars) + 1);
148+
+ subtag.clear();
149+
+ subtag.appendInvariantChars(tokenValue->fChars, u_strlen(tokenValue->fChars), *status);
150+
} else {
151+
*status = U_INVALID_FORMAT_ERROR;
152+
error(line, "invariant characters required for table keys");
153+
@@ -1227,7 +1236,7 @@ realParseTable(ParseState* state, TableResource *table, char *tag, uint32_t star
154+
return NULL;
155+
}
156+
157+
- member = parseResource(state, subtag, &comment, status);
158+
+ member = parseResource(state, subtag.data(), &comment, status);
159+
160+
if (member == NULL || U_FAILURE(*status))
161+
{
162+
--
163+
2.45.4
164+

‎SPECS/icu/icu.spec‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,15 @@
33
Summary: International Components for Unicode.
44
Name: icu
55
Version: 68.2.0.9
6-
Release: 1%{?dist}
6+
Release: 2%{?dist}
77
License: BSD and MIT and Public Domain and naist-2003
88
URL: https://github.com/microsoft/icu
99
Group: System Environment/Libraries
1010
Vendor: Microsoft Corporation
1111
Distribution: Mariner
1212
#Source0: %{url}/archive/v%{version}.tar.gz
1313
Source0: %{name}-%{version}.tar.gz
14+
Patch0: CVE-2025-5222.patch
1415
BuildRequires: autoconf
1516
BuildRequires: python3
1617
BuildRequires: python3-xml
@@ -28,7 +29,7 @@ Provides: libicu-devel = %{version}-%{release}
2829
It contains the libraries and header files to create applications
2930

3031
%prep
31-
%setup -q
32+
%autosetup -p1
3233

3334
%build
3435
pushd icu/icu4c/source
@@ -60,6 +61,9 @@ make -C icu/icu4c/source DESTDIR=%{buildroot} install
6061
%{_libdir}/pkgconfig/*.pc
6162

6263
%changelog
64+
* Tue Aug 12 2025 Azure Linux Security Servicing Account <[email protected]> - 68.2.0.9-2
65+
- Patch for CVE-2025-5222
66+
6367
* Fri May 20 2022 CBL-Mariner Service Account <[email protected]> - 68.2.0.9-1
6468
- Update to version "68.2.0.9".
6569

0 commit comments

Comments
 (0)