ITS#9955 liblunicode: fix buffer size in UTF8bvnormalize

output buffer may overrun 1 byte for specially crafted approxMatch search filters.
Not exploitable, no operational or security impact.

diff --git a/libraries/liblunicode/ucstr.c b/libraries/liblunicode/ucstr.c
index e95db43e7df6c0bdae97029cfc979d616877faed..88b41fcd38b89b9b1eb404f9c3312ec5855cef59 100644 (file)
--- a/libraries/liblunicode/ucstr.c
+++ b/libraries/liblunicode/ucstr.c
@@ -240,6 +240,17 @@ fail:
                if ( approx ) {
                        for ( j = 0; j < ucsoutlen; j++ ) {
                                if ( ucsout[j] < 0x80 ) {
+                                       if ( outpos >= outsize ) {
+                                               outsize += ( ucsoutlen - j ) + 1;
+                                               outtmp = (char *) ber_memrealloc_x( out, outsize, ctx );
+                                               if ( outtmp == NULL ) {
+                                                       ber_memfree_x( ucsout, ctx );
+                                                       ber_memfree_x( ucs, ctx );
+                                                       ber_memfree_x( out, ctx );
+                                                       goto fail;
+                                               }
+                                               out = outtmp;
+                                       }
                                        out[outpos++] = ucsout[j];
                                }
                        }