new file mode 100644
@@ -0,0 +1,164 @@
+From 2c667e31cfd0b6bb1923627a932fd3453a5bac77 Mon Sep 17 00:00:00 2001
+From: Frank Tang <ftang@chromium.org>
+Date: Wed, 22 Jan 2025 11:50:59 -0800
+Subject: [PATCH] ICU-22973 Fix buffer overflow by using CharString
+
+Upstream-Status: Backport [https://github.com/unicode-org/icu/commit/2c667e31cfd0b6bb1923627a932fd3453a5bac77]
+CVE: CVE-2025-5222
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ tools/genrb/parse.cpp | 47 +++++++++++++++++++++---------------
+ 1 file changed, 28 insertions(+), 19 deletions(-)
+
+diff --git a/tools/genrb/parse.cpp b/tools/genrb/parse.cpp
+index 7d5ffe1..175def0 100644
+--- a/tools/genrb/parse.cpp
++++ b/tools/genrb/parse.cpp
+@@ -818,7 +818,7 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
+ struct UString *tokenValue;
+ struct UString comment;
+ enum ETokenType token;
+- char subtag[1024];
++ CharString subtag;
+ UnicodeString rules;
+ UBool haveRules = FALSE;
+ UVersionInfo version;
+@@ -854,7 +854,8 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
+ return NULL;
+ }
+
+- u_UCharsToChars(tokenValue->fChars, subtag, u_strlen(tokenValue->fChars) + 1);
++ subtag.clear();
++ subtag.appendInvariantChars(tokenValue->fChars, u_strlen(tokenValue->fChars), *status);
+
+ if (U_FAILURE(*status))
+ {
+@@ -862,7 +863,7 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
+ return NULL;
+ }
+
+- member = parseResource(state, subtag, NULL, status);
++ member = parseResource(state, subtag.data(), NULL, status);
+
+ if (U_FAILURE(*status))
+ {
+@@ -873,7 +874,7 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
+ {
+ // Ignore the parsed resources, continue parsing.
+ }
+- else if (uprv_strcmp(subtag, "Version") == 0 && member->isString())
++ else if (uprv_strcmp(subtag.data(), "Version") == 0 && member->isString())
+ {
+ StringResource *sr = static_cast<StringResource *>(member);
+ char ver[40];
+@@ -890,11 +891,11 @@ addCollation(ParseState* state, TableResource *result, const char *collationTyp
+ result->add(member, line, *status);
+ member = NULL;
+ }
+- else if(uprv_strcmp(subtag, "%%CollationBin")==0)
++ else if(uprv_strcmp(subtag.data(), "%%CollationBin")==0)
+ {
+ /* discard duplicate %%CollationBin if any*/
+ }
+- else if (uprv_strcmp(subtag, "Sequence") == 0 && member->isString())
++ else if (uprv_strcmp(subtag.data(), "Sequence") == 0 && member->isString())
+ {
+ StringResource *sr = static_cast<StringResource *>(member);
+ rules = sr->fString;
+@@ -1047,7 +1048,7 @@ parseCollationElements(ParseState* state, char *tag, uint32_t startline, UBool n
+ struct UString *tokenValue;
+ struct UString comment;
+ enum ETokenType token;
+- char subtag[1024], typeKeyword[1024];
++ CharString subtag, typeKeyword;
+ uint32_t line;
+
+ result = table_open(state->bundle, tag, NULL, status);
+@@ -1089,7 +1090,8 @@ parseCollationElements(ParseState* state, char *tag, uint32_t startline, UBool n
+ return NULL;
+ }
+
+- u_UCharsToChars(tokenValue->fChars, subtag, u_strlen(tokenValue->fChars) + 1);
++ subtag.clear();
++ subtag.appendInvariantChars(tokenValue->fChars, u_strlen(tokenValue->fChars), *status);
+
+ if (U_FAILURE(*status))
+ {
+@@ -1097,9 +1099,9 @@ parseCollationElements(ParseState* state, char *tag, uint32_t startline, UBool n
+ return NULL;
+ }
+
+- if (uprv_strcmp(subtag, "default") == 0)
++ if (uprv_strcmp(subtag.data(), "default") == 0)
+ {
+- member = parseResource(state, subtag, NULL, status);
++ member = parseResource(state, subtag.data(), NULL, status);
+
+ if (U_FAILURE(*status))
+ {
+@@ -1118,22 +1120,28 @@ parseCollationElements(ParseState* state, char *tag, uint32_t startline, UBool n
+ if(token == TOK_OPEN_BRACE) {
+ token = getToken(state, &tokenValue, &comment, &line, status);
+ TableResource *collationRes;
+- if (keepCollationType(subtag)) {
+- collationRes = table_open(state->bundle, subtag, NULL, status);
++ if (keepCollationType(subtag.data())) {
++ collationRes = table_open(state->bundle, subtag.data(), NULL, status);
+ } else {
+ collationRes = NULL;
+ }
+ // need to parse the collation data regardless
+- collationRes = addCollation(state, collationRes, subtag, startline, status);
++ collationRes = addCollation(state, collationRes, subtag.data(), startline, status);
+ if (collationRes != NULL) {
+ result->add(collationRes, startline, *status);
+ }
+ } else if(token == TOK_COLON) { /* right now, we'll just try to see if we have aliases */
+ /* we could have a table too */
+ token = peekToken(state, 1, &tokenValue, &line, &comment, status);
+- u_UCharsToChars(tokenValue->fChars, typeKeyword, u_strlen(tokenValue->fChars) + 1);
+- if(uprv_strcmp(typeKeyword, "alias") == 0) {
+- member = parseResource(state, subtag, NULL, status);
++ typeKeyword.clear();
++ typeKeyword.appendInvariantChars(tokenValue->fChars, u_strlen(tokenValue->fChars), *status);
++ if (U_FAILURE(*status))
++ {
++ res_close(result);
++ return nullptr;
++ }
++ if(uprv_strcmp(typeKeyword.data(), "alias") == 0) {
++ member = parseResource(state, subtag.data(), NULL, status);
+ if (U_FAILURE(*status))
+ {
+ res_close(result);
+@@ -1175,7 +1183,7 @@ realParseTable(ParseState* state, TableResource *table, char *tag, uint32_t star
+ struct UString *tokenValue=NULL;
+ struct UString comment;
+ enum ETokenType token;
+- char subtag[1024];
++ CharString subtag;
+ uint32_t line;
+ UBool readToken = FALSE;
+
+@@ -1214,7 +1222,8 @@ realParseTable(ParseState* state, TableResource *table, char *tag, uint32_t star
+ }
+
+ if(uprv_isInvariantUString(tokenValue->fChars, -1)) {
+- u_UCharsToChars(tokenValue->fChars, subtag, u_strlen(tokenValue->fChars) + 1);
++ subtag.clear();
++ subtag.appendInvariantChars(tokenValue->fChars, u_strlen(tokenValue->fChars), *status);
+ } else {
+ *status = U_INVALID_FORMAT_ERROR;
+ error(line, "invariant characters required for table keys");
+@@ -1227,7 +1236,7 @@ realParseTable(ParseState* state, TableResource *table, char *tag, uint32_t star
+ return NULL;
+ }
+
+- member = parseResource(state, subtag, &comment, status);
++ member = parseResource(state, subtag.data(), &comment, status);
+
+ if (member == NULL || U_FAILURE(*status))
+ {
+--
+2.49.0
+
@@ -107,6 +107,7 @@ SRC_URI = "${BASE_SRC_URI};name=code \
file://filter.json \
file://fix-install-manx.patch \
file://0001-icu-Added-armeb-support.patch \
+ file://CVE-2025-5222.patch \
"
SRC_URI:append:class-target = "\
Upstream-Status: Backport from https://github.com/unicode-org/icu/commit/2c667e31cfd0b6bb1923627a932fd3453a5bac77 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> --- .../icu/icu/CVE-2025-5222.patch | 164 ++++++++++++++++++ meta/recipes-support/icu/icu_70.1.bb | 1 + 2 files changed, 165 insertions(+) create mode 100644 meta/recipes-support/icu/icu/CVE-2025-5222.patch