From fd411e221a76ea71d3ec9da0d63de84cd72ab4fc Mon Sep 17 00:00:00 2001
From: Marius Gedminas <marius@gedmin.as>
Date: Fri, 23 Oct 2015 12:46:12 +0300
Subject: [PATCH 1/2] Fix buffer overrun in libunistring builds
libunistring uses UTF-8 strings without a trailing NUL byte. We're
passing such strings to tracker_parser_unaccent_nfkd_string() from
function_sparql_unaccent() in the sqlite interface. If the string has
no accented characters, writing a NUL byte at the end will step out of
bounds. This causes memory corruption and crashes.
The other caller of tracker_parser_unaccent_nfkd_string() is
process_word_utf8(), and it looks like it wants a trailing NUL, so let's
add it there.
There are no more callers of the libunistring version of
tracker_parser_unaccent_nfkd_string().
(For extra confusion, the libicu version of
tracker_parser_unaccent_nfkd_string() deals with U+0000-terminated
UTF-16 strings.)
Should fix https://bugzilla.gnome.org/show_bug.cgi?id=746195
---
src/libtracker-common/tracker-parser-libunistring.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/src/libtracker-common/tracker-parser-libunistring.c b/src/libtracker-common/tracker-parser-libunistring.c
index 9de6e46..cc4f1ee 100644
--- a/src/libtracker-common/tracker-parser-libunistring.c
+++ b/src/libtracker-common/tracker-parser-libunistring.c
@@ -157,7 +157,8 @@ get_word_info (TrackerParser *parser,
}
/* The input word in this method MUST be normalized in NFKD form,
- * and given in UTF-8, where str_length is the byte-length */
+ * and given in UTF-8, where str_length is the byte-length
+ * (note: there is no trailing NUL character!) */
gboolean
tracker_parser_unaccent_nfkd_string (gpointer str,
gsize *str_length)
@@ -169,7 +170,7 @@ tracker_parser_unaccent_nfkd_string (gpointer str,
g_return_val_if_fail (str != NULL, FALSE);
g_return_val_if_fail (str_length != NULL, FALSE);
- g_return_val_if_fail (*str_length > 0, FALSE);
+ g_return_val_if_fail (*str_length >= 0, FALSE);
word = (gchar *)str;
word_length = *str_length;
@@ -209,9 +210,6 @@ tracker_parser_unaccent_nfkd_string (gpointer str,
j += utf8_len;
}
- /* Force proper string end */
- word[j] = '\0';
-
/* Set new output length */
*str_length = j;
@@ -296,6 +294,7 @@ process_word_utf8 (TrackerParser *parser,
if (parser->enable_unaccent &&
type == TRACKER_PARSER_WORD_TYPE_OTHER_UNAC &&
tracker_parser_unaccent_nfkd_string (normalized, &new_word_length)) {
+ normalized[new_word_length] = '\0';
/* Log after UNAC stripping */
tracker_parser_message_hex (" After UNAC stripping",
normalized, new_word_length);
--
2.5.0