Change 537915601 by sungyc@sungyc:fig-export-icing-153-change-350:5488:citc on 2023/06/05 10:29:15

	[hunspell] Safe integer check for phone->num to prevent overflow
	
	## Test plan
	```
	sso_client -location 'https://clusterfuzz.corp.google.com/testcase-detail/download-testcase?id=5179437376995328' > /tmp/testcase-5179437376995328 && \
	blaze --blazerc=/dev/null test -c opt --config=asan-fuzzer --test_strategy=local --test_sharding_strategy=disabled \
	  --test_env=ENABLE_BLAZE_TEST_FUZZING=1  --test_arg=-runs=100 --test_arg=/tmp/testcase-5179437376995328 \
	  //third_party/hunspell/fuzzers:dict_fuzzer
	```
	
	## Description
	- We malloc memory with size = `2 * (phone->num + 1) * sizeof(char *)` for `phone->rules`.
	- If `phone->num` is too large, then it will cause integer overflow.
	
	Change `phone->num` check in L3769 to prevent overflow. Also free `phone` before returning error to prevent memory leak.
	
	PRESUBMIT=passed
	BUG=280278127
	R=mghiware
	APPROVED=mghiware
	REQUIRED_REVIEW=1
	DELTA=15 (7 added, 4 deleted, 4 changed)
	DELTA_BY_EXTENSION=cxx=11
	OCL=537406342
	FIG_CHANGESET=b89f41211e07c7f574813ec124d9743a7c505e10
	FIG_WORKSPACE=sungyc/153:icing
	MARKDOWN=true

Affected files ...

... //depot//src/hunspell/affixmgr.cxx#12 edit

==== //depot//src/hunspell/affixmgr.cxx#11 - /google/src/files/537915601/depot//src/hunspell/affixmgr.cxx ====
--- /google/src/files/537395995/depot//src/hunspell/affixmgr.cxx	2023-06-02 16:30:25.000000000 -0400
+++ /google/src/files/537915601/depot//src/hunspell/affixmgr.cxx	2023-06-05 13:29:15.000000000 -0400
@@ -1,19 +1,19 @@
-#include "license.hunspell"
-#include "license.myspell"
+#include "affixmgr.hxx"
 
+#include <ctype.h>
+#include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <stdio.h>
-#include <ctype.h>
 
+#include <limits>
 #include <memory>
 #include <vector>
 
-#include "affixmgr.hxx"
 #include "affentry.hxx"
-#include "langnum.hxx"
-
 #include "csutil.hxx"
+#include "langnum.hxx"
+#include "license.hunspell"
+#include "license.myspell"
 
 AffixMgr::AffixMgr(const char * affpath, HashMgr** ptr, int * md, const char * key) 
 {
@@ -3766,8 +3766,11 @@
                        phone->num = atoi(piece);
                        phone->rules = NULL;
                        phone->utf8 = (char) utf8;
-                       if (phone->num < 1) {
+                       if (phone->num < 1 ||
+                           phone->num > std::numeric_limits<int>::max() / (2 * sizeof(char *)) - 1) {
                           HUNSPELL_WARNING(stderr, "error: line %d: bad entry number\n", af->getlinenum());
+                          free(phone);
+                          phone = NULL;
                           return 1;
                        }
                        phone->rules = (char * *) malloc(2 * (phone->num + 1) * sizeof(char *));