Bug#484138: libicu38: One simple program segfault on ARM

[Vincent Danjean]

Package: libicu38
Version: 3.8.1-1
Severity: important

  Hi,

  I'm tracking #483649 that block a transition to testing with a
soname change. #483649 is about libyaz that does not compile on arm
(all other architectures are ok). Looking at the build log, I saw that,
in fact, only one test fails in the yaz "make check" (the tst_icu_I18N
test and not the tst_oid test as I errorneously said previously in the
other bug report).
  Following the code, I saw that the SEGV comes from the libicui28n
library.

  I tried a reduced test case in the attached file.
You can try to compile and run this file with :
gcc -Wall toto.c -licui18n -g -o toto
./toto

On arm (agnesi.debian.org, sid chroot), I got :
(sid)[EMAIL PROTECTED]:~$ gcc -Wall toto.c -licui18n -g -o toto
(sid)[EMAIL PROTECTED]:~$ ./toto 
Segmentation fault

On my laptop (sid i386), no problem :
[EMAIL PROTECTED]:/tmp/test$ gcc -Wall toto.c -licui18n -g -o toto
[EMAIL PROTECTED]:/tmp/test$ ./toto
[EMAIL PROTECTED]:/tmp/test$ 


  Can you look at this bug as soon as possible, so that the transition
can occur ?

  Best regards,
    Vincent


-- System Information:
Debian Release: lenny/sid
  APT prefers unstable
  APT policy: (990, 'unstable'), (500, 'testing'), (500, 'stable'), (1, 
'experimental')
Architecture: i386 (i686)

Kernel: Linux 2.6.25-2-686 (SMP w/1 CPU core)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages libicu38 depends on:
ii  libc6                         2.7-11     GNU C Library: Shared libraries
ii  libgcc1                       1:4.3.0-5  GCC support library
ii  libstdc++6                    4.3.0-5    The GNU Standard C++ Library v3

libicu38 recommends no packages.

-- no debconf information

#include <string.h>
#include <stdlib.h>
#include <unicode/utrans.h>
#include <unicode/ustring.h>

#define xmalloc(s) malloc(s)
#define xrealloc(s, t) realloc(s, t)
#define xfree(s) free(s)

struct icu_buf_utf16
{
    UChar * utf16;
    int32_t utf16_len;
    int32_t utf16_cap;
};

struct icu_normalizer
{
    char action;
    struct icu_buf_utf16 * rules16;
    UParseError parse_error[256];
    UTransliterator * trans;
};

struct icu_buf_utf16 * icu_buf_utf16_clear(struct icu_buf_utf16 * buf16)
{
    if (buf16){
        if (buf16->utf16)
            buf16->utf16[0] = (UChar) 0;
        buf16->utf16_len = 0;
    }
    return buf16;
}

struct icu_buf_utf16 * icu_buf_utf16_resize(struct icu_buf_utf16 * buf16,
                                            size_t capacity)
{
    if (!buf16)
        return 0;

    if (capacity >  0){
        if (0 == buf16->utf16)
            buf16->utf16 = (UChar *) xmalloc(sizeof(UChar) * capacity);
        else
            buf16->utf16
                = (UChar *) xrealloc(buf16->utf16, sizeof(UChar) * capacity);

        icu_buf_utf16_clear(buf16);
        buf16->utf16_cap = capacity;
    }
    else {
        xfree(buf16->utf16);
        buf16->utf16 = 0;
        buf16->utf16_len = 0;
        buf16->utf16_cap = 0;
    }

    return buf16;
}



struct icu_buf_utf16 * icu_buf_utf16_create(size_t capacity)
{
    struct icu_buf_utf16 * buf16
        = (struct icu_buf_utf16 *) xmalloc(sizeof(struct icu_buf_utf16));

    buf16->utf16 = 0;
    buf16->utf16_len = 0;
    buf16->utf16_cap = 0;

    if (capacity > 0){
        buf16->utf16 = (UChar *) xmalloc(sizeof(UChar) * capacity);
        buf16->utf16[0] = (UChar) 0;
        buf16->utf16_cap = capacity;
    }
    return buf16;
}

UErrorCode icu_utf16_from_utf8_cstr(struct icu_buf_utf16 * dest16,
                                    const char * src8cstr,
                                    UErrorCode * status)
{
    size_t src8cstr_len = 0;
    int32_t utf16_len = 0;

    *status = U_ZERO_ERROR;
    src8cstr_len = strlen(src8cstr);

    u_strFromUTF8(dest16->utf16, dest16->utf16_cap,
                  &utf16_len,
                  src8cstr, src8cstr_len, status);

    /* check for buffer overflow, resize and retry */
    if (*status == U_BUFFER_OVERFLOW_ERROR)
    {
        icu_buf_utf16_resize(dest16, utf16_len * 2);
        *status = U_ZERO_ERROR;
        u_strFromUTF8(dest16->utf16, dest16->utf16_cap,
                      &utf16_len,
                      src8cstr, src8cstr_len, status);
    }

    if (U_SUCCESS(*status)
        && utf16_len <= dest16->utf16_cap)
        dest16->utf16_len = utf16_len;
    else
        icu_buf_utf16_clear(dest16);

    return *status;
}


int main() {

	struct icu_normalizer * normalizer
	    = (struct icu_normalizer *) xmalloc(sizeof(struct icu_normalizer));
	char rules[]="[:Punctuation:] Any-Remove";
	UErrorCode status=U_ZERO_ERROR;
	normalizer->action = 'f';
	normalizer->trans = 0;
	normalizer->rules16 =  icu_buf_utf16_create(0);
	icu_utf16_from_utf8_cstr(normalizer->rules16, rules, &status);

	normalizer->trans=utrans_openU(normalizer->rules16->utf16,
	                           normalizer->rules16->utf16_len,
				   UTRANS_FORWARD,
				   0, 0,
				   normalizer->parse_error, &status);
	return 0;

}