diff --git a/icu4c/source/common/ucnv_io.c b/icu4c/source/common/ucnv_io.c index dd61af7041f..8adf1db9223 100644 --- a/icu4c/source/common/ucnv_io.c +++ b/icu4c/source/common/ucnv_io.c @@ -1158,7 +1158,7 @@ ucnv_swapAliases(const UDataSwapper *ds, } /* an alias table must contain at least the table of contents array */ - if(length>=0 && length<4*(1+minTocLength)) { + if(length>=0 && (length-headerSize)<4*(1+minTocLength)) { udata_printError(ds, "ucnv_swapAliases(): too few bytes (%d after header) for an alias table\n", length-headerSize); *pErrorCode=U_INDEX_OUTOFBOUNDS_ERROR; @@ -1194,6 +1194,13 @@ ucnv_swapAliases(const UDataSwapper *ds, uint16_t *q, *q2; uint16_t oldIndex; + if((length-headerSize)<(2*(int32_t)topOffset)) { + udata_printError(ds, "ucnv_swapAliases(): too few bytes (%d after header) for an alias table\n", + length-headerSize); + *pErrorCode=U_INDEX_OUTOFBOUNDS_ERROR; + return 0; + } + outTable=(uint16_t *)((char *)outData+headerSize); /* swap the entire table of contents */ diff --git a/icu4c/source/common/ucnv_io.h b/icu4c/source/common/ucnv_io.h index 2790be4272f..3f843c2f82c 100644 --- a/icu4c/source/common/ucnv_io.h +++ b/icu4c/source/common/ucnv_io.h @@ -154,7 +154,7 @@ struct UDataSwapper; typedef struct UDataSwapper UDataSwapper; /** - * Swap an ICU converter alias table. See ucnv_io.h. + * Swap an ICU converter alias table. See ucnv_io.c. * @internal */ U_CAPI int32_t U_EXPORT2