Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
unicode-org/icu
main @ 513a023
209
Fixes
25
CVEs
CRITICAL
Peak severity
28.9%
Coverage
Highlights
Memory Corruption: 78 prior fixes. Scrutinize any change in this area.
icu4c/source/common/locid.cpp: most-fixed (17 issues). Treat as high-risk during review.
138 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Memory Corruption: The UnicodeString class frequently encounters memory safety issues, including buffer overflows, pointer overflows, and invalid state modification under overlap or large allocation conditions. These flaws often stem from missing capacity checks and manual pointer arithmetic.
Buffer Overflow: Resource bundle fallback mechanisms and path parsing contain multiple stack-based buffer overflows. Historically, static stack-allocated buffers and unsafe copy operations (e.g., uprv_strcpy) have been exploited via excessively long path names and locale keys.
Memory Corruption: UText handling functions, specifically text access and cloning callbacks, are highly prone to pointer misalignment, use-after-free, and incorrect chunk-boundary updates. These errors permit heap out-of-bounds reads and writes.