ICU-23251 Fix static analyzer bugs #3758
Conversation
883a651 to
7955d20
Compare
|
Hooray! The files in the branch are the same across the force-push. 😃 ~ Your Friendly Jira-GitHub PR Checker Bot |
|
|
||
| // Set postContext to some of msg starting at index. | ||
| length=msg.length()-index; | ||
| length=msg.length()>index ? msg.length()-index : 0; |
There was a problem hiding this comment.
Is this something that could reasonably happen? If not, I suggest instead adding the length condition to the first if-statement in this function and just do nothing at all if index is out of range. You might even add an U_ASSERT() statement to assert that this function never gets called with an invalid index value.
| int32_t pos, | ||
| UErrorCode& status) | ||
| { | ||
| if (pos < 0) { |
There was a problem hiding this comment.
Same here, this is not something that should ever happen, assert (to get a nice human readable error message in debug builds if some bug causes it to happen even if it shouldn't) and then return immediately without doing anything.
| const UnicodeSet &s = RegexStaticSets::gStaticSets->fPropSets[opValue]; | ||
| if (s.contains(c)) { | ||
| success = !success; | ||
| if (c >= 0) { |
There was a problem hiding this comment.
This doesn't look right, UChar32 should be an unsigned data type, it shouldn't be possible for this value to be negative.
There was a problem hiding this comment.
UChar32 is int32_t
And U16_NEXT can return U_SENTINEL == -1
Bugs identified by the static analyzers when analyzing the chromium source code (part 3)
icu4c/source/i18n/rbt_pars.cpp - "Out of bound access to memory preceding the field 'preContext'"
icu4c/source/common/cstring.cpp - "Out of bound access to memory" if n == INT_MAX
icu4c/source/i18n/rematch.cpp - "Out of bound access to memory preceding the field 'd'" at Regex8BitSet::contains() when c == -1;
icu4c/source/i18n/number_longnames.cpp - "Out of bound access to memory" at getMixedUnitModifier
icu4c/source/common/messagepattern.cpp - "Out of bound access to memory preceding the field 'postContext'" when index < msg.length()
icu4c/source/common/ubidiln.cpp - "Out of bound access to memory" when limit==0
icu4c/source/i18n/simpletz.cpp - "The left operand of '<' is a garbage value"
TODO: Fill out the checklist below.
Checklist