Loading
Commits on Source 6
-
The charset conversion library needs a fix that cannot be published upstream ahead of this change. Vendoring the module and pointing go.mod at the local copy lets the fix ship in the indexer binary. The copy is removed once a patched version of the library is released. The source is v1.0.2 unmodified apart from gofmt, which the repository format check requires. Nested modules fall outside ./..., so make test runs the vendored module's own suite explicitly. (cherry picked from commit 63e220ed)
-
ConvertToUtf8 passed len(utf16Buffer), a byte count, to ICU as the destination capacity for ucnv_toUChars, which counts UChars. ICU was told the buffer was twice its real size and wrote past the end of it for any input between the real and the claimed capacity. A commit author name has no size limit, so an ordinary push reaches this. It is a security fix for an out-of-bounds write with attacker-controlled contents. c_bridge.c also returned early on conversion failure without calling ucnv_close, leaking a converter. In convertFromUtf16 that path was already reachable, since UTF-8 output larger than utf8Buffer sets U_BUFFER_OVERFLOW_ERROR. In convertToUtf16 the overstated capacity kept it unreachable until now. Both are closed here. The new tests cover one UChar below, exactly at, and one above the buffer capacity, and assert that nothing is written past the end. The at-capacity case reports U_STRING_NOT_TERMINATED_WARNING, which isSuccess must keep treating as success. References https://gitlab.com/gitlab-org/gitlab/-/work_items/627435 (cherry picked from commit 6e86a3da)
-
The tests derived the buffer's UChar capacity with a literal 2 while the conversion call used unsafe.Sizeof, so the two could drift. Cgo is unavailable in test files, so the constant has to live beside the production code for both to share it. (cherry picked from commit 6ab41043)
-
Both conversion stages can overflow, but only the first was covered. Three-byte BMP characters expand past utf8Buffer while staying inside the utf16 capacity, which reaches the second stage's error return. (cherry picked from commit e6d5d473)
-
The directory is a nested module, so lint and coverage skip it while it is in place. Record that, and the steps to remove it, for whoever does the upstream cleanup. (cherry picked from commit edfa6ff4)
-
John Mason authored