Patch: ucdata 2.4 bugs (ITS#1751)

			================
Written by Hallvard B. Furuseth and placed into the public domain.
This software is not subject to any license of the University of Oslo.
			================

ucgendat.c accessed unallocated memory when i == ncodes_size.

The changes others are trivial, I just include them since I'm patching
ucdata anyway:

ucdata.c   had some pointless '0 <= unsigned' comparisons.

ucstr.c    assigned a long* to an unsigned long*.  Since malloc()
           returns void*, the result need not be cast at all.

I'll send the ucgendat.c and ucdata.c patches to Mark Leisher
<mleisher@crl.nmsu.edu>.

Hallvard B. Furuseth <h.b.furuseth@usit.uio.no>, April 2002.

diff --git a/libraries/liblunicode/ucdata/ucdata.c b/libraries/liblunicode/ucdata/ucdata.c
index 9b638d8c5d70969ac429dbdf7af697479c4d21f6..e4ded225fae9c60db866aa19c14febb81e6f7c62 100644 (file)
--- a/libraries/liblunicode/ucdata/ucdata.c
+++ b/libraries/liblunicode/ucdata/ucdata.c
@@ -603,9 +603,9 @@ uccomp_hangul(unsigned long *str, int len)
 
         /* check if two current characters are L and V */
         lindex = last - LBase;
-        if (0 <= lindex && lindex < (unsigned long) LCount) {
+        if (lindex < (unsigned long) LCount) {
             unsigned long vindex = ch - VBase;
-            if (0 <= vindex && vindex < (unsigned long) VCount) {
+            if (vindex < (unsigned long) VCount) {
                 /* make syllable of form LV */
                 last = SBase + (lindex * VCount + vindex) * TCount;
                 str[rlen-1] = last; /* reset last */
@@ -615,11 +615,11 @@ uccomp_hangul(unsigned long *str, int len)
         
         /* check if two current characters are LV and T */
         sindex = last - SBase;
-        if (0 <= sindex && sindex < (unsigned long) SCount
+        if (sindex < (unsigned long) SCount
                        && (sindex % TCount) == 0)
                {
             unsigned long tindex = ch - TBase;
-            if (0 <= tindex && tindex <= (unsigned long) TCount) {
+            if (tindex <= (unsigned long) TCount) {
                 /* make syllable of form LVT */
                 last += tindex;
                 str[rlen-1] = last; /* reset last */

diff --git a/libraries/liblunicode/ucdata/ucgendat.c b/libraries/liblunicode/ucdata/ucgendat.c
index e879c60e61bfef662d14c37033a11da7ff10b0cf..2b6712231621c7510099f1acb072212f8cccc7a9 100644 (file)
--- a/libraries/liblunicode/ucdata/ucgendat.c
+++ b/libraries/liblunicode/ucdata/ucgendat.c
@@ -739,7 +739,7 @@ add_number(unsigned long code, short num, short denom)
      * Handle the case of the codes matching and simply replace the number
      * that was there before.
      */
-    if (ncodes_used > 0 && code == ncodes[i].code) {
+    if (i < ncodes_used && code == ncodes[i].code) {
         ncodes[i].idx = make_number(num, denom);
         return;
     }

diff --git a/libraries/liblunicode/ucstr.c b/libraries/liblunicode/ucstr.c
index f0cc6033221fdedb51faf08ce53657652c9f0abf..18a882111d7506ce6be17d181ad5b0a6bfb09713 100644 (file)
--- a/libraries/liblunicode/ucstr.c
+++ b/libraries/liblunicode/ucstr.c
@@ -167,7 +167,7 @@ struct berval * UTF8bvnormalize(
                i = 0;
        }
 
-       p = ucs = (long *) malloc( len * sizeof(*ucs) );
+       p = ucs = malloc( len * sizeof(*ucs) );
        if ( ucs == NULL ) {
                free(out);
                return NULL;
@@ -342,7 +342,7 @@ int UTF8bvnormcmp(
         * proper normalized form.
         */
 
-       ucs = (long *) malloc( ( ( norm1 || l1 > l2 ) ? l1 : l2 ) * sizeof(*ucs) );
+       ucs = malloc( ( ( norm1 || l1 > l2 ) ? l1 : l2 ) * sizeof(*ucs) );
        if ( ucs == NULL ) {
                return l1 > l2 ? 1 : -1; /* what to do??? */
        }
@@ -365,7 +365,7 @@ int UTF8bvnormcmp(
        if ( norm1 ) {
                ucsout1 = ucs;
                l1 = ulen;
-               ucs = (long *) malloc( l2 * sizeof(*ucs) );
+               ucs = malloc( l2 * sizeof(*ucs) );
                if ( ucs == NULL ) {
                        return l1 > l2 ? 1 : -1; /* what to do??? */
                }