ICU-23251 Validate serialized spoof data offsets in SpoofData::initPtrs()

Add bounds checking for all offset+size pairs (fCFUKeys, fCFUStringIndex,
fCFUStringTable) against the total data length in SpoofData::initPtrs().
Also validate consistency: if confusable keys exist (fCFUKeysSize > 0),
the string index and string table must also be present.

Without this validation, crafted serialized data passed to
uspoof_openFromSerialized() can produce a SpoofChecker with NULL internal
pointers, causing a NULL pointer dereference when uspoof_check() is
subsequently called.

Author: TristanInSec

icu4c/source/i18n/uspoof_impl.cpp

@@ -687,6 +687,40 @@ void SpoofData::initPtrs(UErrorCode &status) {
     if (U_FAILURE(status)) {
         return;
     }
+
+    int32_t totalLen = fRawData->fLength;
+    if (totalLen < static_cast<int32_t>(sizeof(SpoofDataHeader))) {
+        status = U_INVALID_FORMAT_ERROR;
+        return;
+    }
+
+    // Validate all offset+size pairs against the total data length.
+    if (fRawData->fCFUKeys < 0 || fRawData->fCFUKeys > totalLen ||
+        fRawData->fCFUKeysSize < 0 ||
+        fRawData->fCFUKeysSize > (totalLen - fRawData->fCFUKeys) / static_cast<int32_t>(sizeof(int32_t))) {
+        status = U_INVALID_FORMAT_ERROR;
+        return;
+    }
+    if (fRawData->fCFUStringIndex < 0 || fRawData->fCFUStringIndex > totalLen ||
+        fRawData->fCFUStringIndexSize < 0 ||
+        fRawData->fCFUStringIndexSize > (totalLen - fRawData->fCFUStringIndex) / static_cast<int32_t>(sizeof(uint16_t))) {
+        status = U_INVALID_FORMAT_ERROR;
+        return;
+    }
+    if (fRawData->fCFUStringTable < 0 || fRawData->fCFUStringTable > totalLen ||
+        fRawData->fCFUStringTableLen < 0 ||
+        fRawData->fCFUStringTableLen > (totalLen - fRawData->fCFUStringTable) / static_cast<int32_t>(sizeof(char16_t))) {
+        status = U_INVALID_FORMAT_ERROR;
+        return;
+    }
+
+    // If keys exist, the value index and string table must also exist.
+    if (fRawData->fCFUKeysSize > 0 &&
+        (fRawData->fCFUStringIndex == 0 || fRawData->fCFUStringTable == 0)) {
+        status = U_INVALID_FORMAT_ERROR;
+        return;
+    }
+
     if (fRawData->fCFUKeys != 0) {
         fCFUKeys = reinterpret_cast<int32_t*>(reinterpret_cast<char*>(fRawData) + fRawData->fCFUKeys);
     }