From: Richard Sandiford <richard@codesourcery.com>
Date: Fri, 18 Oct 2013 20:58:31 +0000 (+0000)
Subject: Fix localedef collation handling of <U0000> (bug 15948).
X-Git-Tag: glibc-2.19~590
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5abe0682337db0aa15e2adf027d10e5b75b31c5a;p=thirdparty%2Fglibc.git

Fix localedef collation handling of <U0000> (bug 15948).
---

diff --git a/ChangeLog b/ChangeLog
index c9fd07dee82..1078b357cb4 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2013-10-18  Richard Sandiford  <richard@codesourcery.com>
+	    Joseph Myers  <joseph@codesourcery.com
+
+	[BZ #15948]
+	* locale/programs/ld-collate.c (new_element): Handle <U0000> as a
+	single character.
+	(add_to_tablewc): Assert sequence of wide characters is nonempty.
+
 2013-10-18  Siddhesh Poyarekar  <siddhesh@redhat.com>
 
 	* elf/tst-tls-dlinfo.c: Don't include tls.h.
diff --git a/NEWS b/NEWS
index 0efdde5561e..212859c2ddf 100644
--- a/NEWS
+++ b/NEWS
@@ -14,9 +14,9 @@ Version 2.19
   15609, 15610, 15632, 15640, 15672, 15680, 15681, 15723, 15734, 15735,
   15736, 15748, 15749, 15754, 15760, 15764, 15797, 15844, 15847, 15849,
   15855, 15856, 15857, 15859, 15867, 15886, 15887, 15890, 15892, 15893,
-  15895, 15897, 15905, 15909, 15919, 15921, 15923, 15939, 15963, 15966,
-  15895, 15897, 15905, 15909, 15919, 15921, 15923, 15939, 15963, 15966,
-  15988, 16032, 16034, 16036, 16041.
+  15895, 15897, 15905, 15909, 15919, 15921, 15923, 15939, 15948, 15963,
+  15966, 15895, 15897, 15905, 15909, 15919, 15921, 15923, 15939, 15963,
+  15966, 15988, 16032, 16034, 16036, 16041.
 
 * CVE-2012-4412 The strcoll implementation caches indices and rules for
   large collation sequences to optimize multiple passes.  This cache
diff --git a/locale/programs/ld-collate.c b/locale/programs/ld-collate.c
index d88a6de56e6..f7ae09792a2 100644
--- a/locale/programs/ld-collate.c
+++ b/locale/programs/ld-collate.c
@@ -352,6 +352,9 @@ new_element (struct locale_collate_t *collate, const char *mbs, size_t mbslen,
     {
       size_t nwcs = wcslen ((wchar_t *) wcs);
       uint32_t zero = 0;
+      /* Handle <U0000> as a single character.  */
+      if (nwcs == 0)
+	nwcs = 1;
       obstack_grow (&collate->mempool, wcs, nwcs * sizeof (uint32_t));
       obstack_grow (&collate->mempool, &zero, sizeof (uint32_t));
       newp->wcs = (uint32_t *) obstack_finish (&collate->mempool);
@@ -2078,6 +2081,7 @@ add_to_tablewc (uint32_t ch, struct element_t *runp)
 	      weightidx = output_weightwc (atwc.weightpool, atwc.collate,
 					   runp);
 
+	      assert (runp->nwcs > 0);
 	      added = (1 + 1 + runp->nwcs - 1) * sizeof (int32_t);
 	      if (sizeof (int) == sizeof (int32_t))
 		obstack_make_room (atwc.extrapool, added);