ICU-23251 Validate serialized spoof data in SpoofData deserialization

Add comprehensive validation for serialized spoof checker data:

1. initPtrs(): Bounds check all offset+size pairs (fCFUKeys, fCFUStringIndex,
   fCFUStringTable) against the total data length. Validate cross-table
   consistency: if keys exist, value index and string table must also exist;
   value index table must have at least as many entries as the keys table.

2. confusableLookup(): Guard against empty confusable data (length == 0 or
   fCFUKeys == nullptr) to prevent the do-while binary search loop from
   dereferencing a null pointer.

3. appendValueTo(): Bounds check the string table index before reading from
   fCFUStrings to prevent heap-buffer-overflow when crafted data contains
   out-of-range string references.

Without these validations, crafted serialized data passed to
uspoof_openFromSerialized() causes null pointer dereference, heap buffer
overflow reads, and other memory safety issues when the spoof checker is
subsequently used.

Author: TristanInSec

icu4c/source/common/rbbidata.cpp

@@ -102,6 +102,23 @@ void RBBIDataWrapper::init(const RBBIDataHeader *data, UErrorCode &status) {
     //       that is no longer supported.  At that time fFormatVersion was
     //       an int32_t field, rather than an array of 4 bytes.
 
+    uint32_t totalLen = fHeader->fLength;
+    if (totalLen < sizeof(RBBIDataHeader)) {
+        status = U_INVALID_FORMAT_ERROR;
+        return;
+    }
+
+    // Validate all offset+length pairs against the total data length.
+    // Prevent integer overflow by checking each addend against totalLen first.
+    if (fHeader->fFTable > totalLen || fHeader->fFTableLen > totalLen - fHeader->fFTable ||
+        fHeader->fRTable > totalLen || fHeader->fRTableLen > totalLen - fHeader->fRTable ||
+        fHeader->fTrie > totalLen || fHeader->fTrieLen > totalLen - fHeader->fTrie ||
+        fHeader->fRuleSource > totalLen || fHeader->fRuleSourceLen > totalLen - fHeader->fRuleSource ||
+        fHeader->fStatusTable > totalLen || fHeader->fStatusTableLen > totalLen - fHeader->fStatusTable) {
+        status = U_INVALID_FORMAT_ERROR;
+        return;
+    }
+
     fDontFreeData = false;
     if (data->fFTableLen != 0) {
         fForwardTable = reinterpret_cast<const RBBIStateTable*>(reinterpret_cast<const char*>(data) + fHeader->fFTable);

icu4c/source/i18n/uspoof_impl.cpp

@@ -714,9 +714,21 @@ void SpoofData::initPtrs(UErrorCode &status) {
         return;
     }
 
+    // Ensure consistency: offsets and sizes must agree.
     // If keys exist, the value index and string table must also exist.
     if (fRawData->fCFUKeysSize > 0 &&
-        (fRawData->fCFUStringIndex == 0 || fRawData->fCFUStringTable == 0)) {
+        (fRawData->fCFUKeys == 0 || fRawData->fCFUStringIndex == 0 || fRawData->fCFUStringTable == 0)) {
+        status = U_INVALID_FORMAT_ERROR;
+        return;
+    }
+    // If offset is zero, size must also be zero.
+    if ((fRawData->fCFUKeys == 0) != (fRawData->fCFUKeysSize == 0)) {
+        status = U_INVALID_FORMAT_ERROR;
+        return;
+    }
+    // Value index table must have at least as many entries as the keys table,
+    // since both are accessed by the same index from binary search.
+    if (fRawData->fCFUKeysSize > 0 && fRawData->fCFUStringIndexSize < fRawData->fCFUKeysSize) {
         status = U_INVALID_FORMAT_ERROR;
         return;
     }
@@ -802,6 +814,10 @@ int32_t SpoofData::confusableLookup(UChar32 inChar, UnicodeString &dest) const {
     // The result after the loop will be in lo.
     int32_t lo = 0;
     int32_t hi = length();
+    if (hi == 0 || fCFUKeys == nullptr) {
+        dest.append(inChar);
+        return 1;
+    }
     do {
         int32_t mid = (lo + hi) / 2;
         if (codePointAt(mid) > inChar) {
@@ -842,6 +858,12 @@ int32_t SpoofData::appendValueTo(int32_t index, UnicodeString& dest) const {
     if (stringLength == 1) {
         dest.append(static_cast<char16_t>(value));
     } else {
+        int32_t tableLen = fRawData->fCFUStringTableLen;
+        if (fCFUStrings == nullptr || value > tableLen ||
+            stringLength > tableLen - value) {
+            dest.append(static_cast<UChar32>(0xFFFD));
+            return 1;
+        }
         dest.append(fCFUStrings + value, stringLength);
     }