Skip to content

ICU-23334 Fix null-deref and stale UErrorCode in break_iterator_fuzzer#3887

Open
OwenSanzas wants to merge 1 commit intounicode-org:mainfrom
OwenSanzas:fix/break-iterator-fuzzer-null-check-and-status-reset
Open

ICU-23334 Fix null-deref and stale UErrorCode in break_iterator_fuzzer#3887
OwenSanzas wants to merge 1 commit intounicode-org:mainfrom
OwenSanzas:fix/break-iterator-fuzzer-null-check-and-status-reset

Conversation

@OwenSanzas
Copy link
Copy Markdown

@OwenSanzas OwenSanzas commented Mar 5, 2026

Summary

Fix two issues in icu4c/source/test/fuzzer/break_iterator_fuzzer.cpp:

1. Null pointer dereference (line 57)

bi->setText(fuzzstr, status) dereferences bi without checking for nullptr. If utext_openUChars or createXxxInstance fails (e.g., due to OOM setting status to error), bi is nullptr and the call causes a SEGV.

Confirmed with AddressSanitizer:

ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
The signal is caused by a READ memory access.
Hint: address points to the zero page.

Fix: Add null/error checks after utext_openUChars and after createXxxInstance, before calling bi->setText().

2. UErrorCode not reset before reuse (line 70)

The second round of createXxxInstance calls (lines 70-86) reuses status without resetting it to U_ZERO_ERROR. ICU's API protocol requires UErrorCode to be U_ZERO_ERROR before each call — if a previous call set it to error, subsequent ICU APIs silently return without executing. This makes the second phase of the harness effectively dead code whenever the first phase encounters any error.

Fix: Add status = U_ZERO_ERROR before the second phase.

Before/After Comparison (60-second fuzzing, AddressSanitizer)

Metric Original Fixed Change
Edge cov 4272 4272 0%
Features 12601 12855 +2.0%
Corpus 1353 1421 +5.0%
Exec/s 3432 3561 +3.8%

Coverage is identical. No crashes in either version during 60-second run. The fixed version runs slightly faster.

Changes

Three minimal additions (no behavioral changes to the happy path):

  1. Check utext_openUChars return value before use
  2. Check bi for nullptr before calling setText
  3. Reset status before second createXxxInstance round

Two issues in the break_iterator_fuzzer fuzz harness:

1. bi->setText(fuzzstr, status) on line 57 dereferences `bi` without
   checking for nullptr. If utext_openUChars or createXxxInstance fails
   (setting status to error), `bi` is nullptr and the subsequent call
   causes a null pointer dereference (SEGV). Add null/error checks
   after utext_openUChars and after createXxxInstance.

2. The second round of createXxxInstance calls (lines 70-86) reuses
   `status` without resetting it to U_ZERO_ERROR. If the first phase
   left status in an error state, all second-phase ICU calls silently
   return without executing. Add `status = U_ZERO_ERROR` before the
   second phase.
@CLAassistant
Copy link
Copy Markdown

CLAassistant commented Mar 5, 2026

CLA assistant check
All committers have signed the CLA.

@OwenSanzas OwenSanzas changed the title ICU-22999 Fix null-deref and stale UErrorCode in break_iterator_fuzzer Fix null-deref and stale UErrorCode in break_iterator_fuzzer Mar 5, 2026
@OwenSanzas OwenSanzas changed the title Fix null-deref and stale UErrorCode in break_iterator_fuzzer ICU-23334 Fix null-deref and stale UErrorCode in break_iterator_fuzzer Mar 7, 2026
@markusicu markusicu self-assigned this Mar 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants