Fix a crash in locid.cpp.
This CL is attempting to fix a crash when formatting a decimal on MacOS Desktop browser tab strip.
Because this is a potential security issue, see bug for more details.
Bug:333453962
Change-Id: Id72dc4ebbfb7db5ac1a126690b9430b1629afd1d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/deps/icu/+/5506696
Reviewed-by: Shu-yu Guo <syg@chromium.org>
diff --git a/README.chromium b/README.chromium
index 3ef9100..ee13ac4 100644
--- a/README.chromium
+++ b/README.chromium
@@ -258,3 +258,7 @@
patches/revert_realpath.patch
- https://bugs.chromium.org/p/chromium/issues/detail?id=1473422
- https://unicode-org.atlassian.net/browse/ICU-22541
+
+11. Patch source/common/locid.cpp to resolve crashes in DecimalFormatting.
+ patches/locid.patch
+ - https://issues.chromium.org/issues/333453962
diff --git a/patches/locid.patch b/patches/locid.patch
new file mode 100644
index 0000000..3b99ce0
--- /dev/null
+++ b/patches/locid.patch
@@ -0,0 +1,18 @@
+diff --git a/source/common/locid.cpp b/source/common/locid.cpp
+index 64ff63f3..888b3d35 100644
+--- a/source/common/locid.cpp
++++ b/source/common/locid.cpp
+@@ -2689,11 +2689,11 @@ Locale::setKeywordValue(const char* keywordName, const char* keywordValue, UErro
+ }
+ uprv_strcpy(newFullName, fullName);
+ if (fullName != fullNameBuffer) {
+- // if full Name is already on the heap, need to free it.
+- uprv_free(fullName);
+ if (baseName == fullName) {
+ baseName = newFullName; // baseName should not point to freed memory.
+ }
++ // if full Name is already on the heap, need to free it.
++ uprv_free(fullName);
+ }
+ fullName = newFullName;
+ status = U_ZERO_ERROR;
diff --git a/source/common/locid.cpp b/source/common/locid.cpp
index 64ff63f..888b3d3 100644
--- a/source/common/locid.cpp
+++ b/source/common/locid.cpp
@@ -2689,11 +2689,11 @@
}
uprv_strcpy(newFullName, fullName);
if (fullName != fullNameBuffer) {
- // if full Name is already on the heap, need to free it.
- uprv_free(fullName);
if (baseName == fullName) {
baseName = newFullName; // baseName should not point to freed memory.
}
+ // if full Name is already on the heap, need to free it.
+ uprv_free(fullName);
}
fullName = newFullName;
status = U_ZERO_ERROR;
