From f2ffe010d92607c5eebbabf306d57e4eedb05750 Mon Sep 17 00:00:00 2001 From: Allan Sandfeld Jensen Date: Wed, 3 Jan 2018 14:01:10 +0100 Subject: [Backport] Fix a range bug in Persian calendar MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bug: 774382 Test: See the bug (CVE-2017-774382) Change-Id: I587754fe6664c5486fa4569d6299579c71abe523 Reviewed-by: Michael Brüning --- chromium/third_party/icu/README.chromium | 6 ++++++ chromium/third_party/icu/source/i18n/persncal.cpp | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/chromium/third_party/icu/README.chromium b/chromium/third_party/icu/README.chromium index 9d47b95b6fb..975868d39ea 100644 --- a/chromium/third_party/icu/README.chromium +++ b/chromium/third_party/icu/README.chromium @@ -307,3 +307,9 @@ D. Local Modifications http://crbug.com/770452 - patches/loc_keyvaleu.patch + +13. Persian calendar range fix. + + http://crbug.com/774382 + + - patches/persian_cal.patch (fixed in ICU 60.1) diff --git a/chromium/third_party/icu/source/i18n/persncal.cpp b/chromium/third_party/icu/source/i18n/persncal.cpp index f66ac676a4a..f38f779fea9 100644 --- a/chromium/third_party/icu/source/i18n/persncal.cpp +++ b/chromium/third_party/icu/source/i18n/persncal.cpp @@ -213,7 +213,7 @@ void PersianCalendar::handleComputeFields(int32_t julianDay, UErrorCode &/*statu int32_t year, month, dayOfMonth, dayOfYear; int32_t daysSinceEpoch = julianDay - PERSIAN_EPOCH; - year = 1 + ClockMath::floorDivide(33 * daysSinceEpoch + 3, 12053); + year = 1 + (int32_t)ClockMath::floorDivide(33 * (int64_t)daysSinceEpoch + 3, (int64_t)12053); int32_t farvardin1 = 365 * (year - 1) + ClockMath::floorDivide(8 * year + 21, 33); dayOfYear = (daysSinceEpoch - farvardin1); // 0-based -- cgit v1.2.1