Fix icu4jni Resources ("Locale") to not expose its internals.

We shouldn't expose internal arrays without copying.

Bug: 2102273

3 files changed, 100 insertions, 6 deletions

diff --git a/icu/src/main/java/com/ibm/icu4jni/util/Resources.java b/icu/src/main/java/com/ibm/icu4jni/util/Resources.java
index 0460fde..086f8d4 100644
--- a/icu/src/main/java/com/ibm/icu4jni/util/Resources.java
+++ b/icu/src/main/java/com/ibm/icu4jni/util/Resources.java
@@ -114,7 +114,7 @@ public class Resources {
             isoLanguages = getISOLanguagesNative();
         }
 
-        return isoLanguages;
+        return isoLanguages.clone();
     }
 
     /**
@@ -128,7 +128,7 @@ public class Resources {
             isoCountries = getISOCountriesNative();
         }
 
-        return isoCountries;
+        return isoCountries.clone();
     }
 
     /**
@@ -142,7 +142,7 @@ public class Resources {
             availableLocales = getAvailableLocalesNative();
         }
 
-        return availableLocales;
+        return availableLocales.clone();
     }
 
     /**
@@ -157,7 +157,7 @@ public class Resources {
             availableTimezones = TimeZone.getAvailableIDs();
         }
 
-        return availableTimezones;
+        return availableTimezones.clone();
     }
 
     /**
@@ -264,17 +264,25 @@ public class Resources {
         if (locale == null) {
             locale = defaultLocale;
         }
-
+        
         // If locale == default and the default locale hasn't changed since
         // DefaultTimeZones loaded, return the cached names.
         // TODO: We should force a reboot if the default locale changes.
         if (defaultLocale.equals(locale) && DefaultTimeZones.locale.equals(defaultLocale)) {
-            return DefaultTimeZones.names;
+            return clone2dStringArray(DefaultTimeZones.names);
         }
         
         return createTimeZoneNamesFor(locale);
     }
 
+    private static String[][] clone2dStringArray(String[][] array) {
+        String[][] result = new String[array.length][];
+        for (int i = 0; i < array.length; ++i) {
+            result[i] = array[i].clone();
+        }
+        return result;
+    }
+
     // --- Specialized ResourceBundle subclasses ------------------------------
 
     /**
diff --git a/icu/src/test/java/com/ibm/icu4jni/util/AllTests.java b/icu/src/test/java/com/ibm/icu4jni/util/AllTests.java
new file mode 100644
index 0000000..1b95075
--- /dev/null
+++ b/icu/src/test/java/com/ibm/icu4jni/util/AllTests.java
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2009 The Android Open Source Project
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.ibm.icu4jni.util;
+
+import junit.framework.Test;
+import junit.framework.TestSuite;
+
+public class AllTests {
+    public static final Test suite() {
+        TestSuite suite = tests.TestSuiteFactory.createTestSuite();
+        suite.addTestSuite(com.ibm.icu4jni.util.ResourcesTest.class);
+        return suite;
+    }
+}
diff --git a/icu/src/test/java/com/ibm/icu4jni/util/ResourcesTest.java b/icu/src/test/java/com/ibm/icu4jni/util/ResourcesTest.java
new file mode 100644
index 0000000..4112d0b
--- /dev/null
+++ b/icu/src/test/java/com/ibm/icu4jni/util/ResourcesTest.java
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2009 The Android Open Source Project
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.ibm.icu4jni.util;
+
+public class ResourcesTest extends junit.framework.TestCase {
+    public void test_getISOLanguages() throws Exception {
+        // Check that corrupting our array doesn't affect other callers.
+        assertNotNull(Resources.getISOLanguages()[0]);
+        Resources.getISOLanguages()[0] = null;
+        assertNotNull(Resources.getISOLanguages()[0]);
+    }
+
+    public void test_getISOCountries() throws Exception {
+        // Check that corrupting our array doesn't affect other callers.
+        assertNotNull(Resources.getISOCountries()[0]);
+        Resources.getISOCountries()[0] = null;
+        assertNotNull(Resources.getISOCountries()[0]);
+    }
+
+    public void test_getAvailableLocales() throws Exception {
+        // Check that corrupting our array doesn't affect other callers.
+        assertNotNull(Resources.getAvailableLocales()[0]);
+        Resources.getAvailableLocales()[0] = null;
+        assertNotNull(Resources.getAvailableLocales()[0]);
+    }
+
+    public void test_getKnownTimezones() throws Exception {
+        // Check that corrupting our array doesn't affect other callers.
+        assertNotNull(Resources.getKnownTimezones()[0]);
+        Resources.getKnownTimezones()[0] = null;
+        assertNotNull(Resources.getKnownTimezones()[0]);
+    }
+
+    public void test_getDisplayTimeZones() throws Exception {
+        // Check that corrupting our array doesn't affect other callers.
+        assertNotNull(Resources.getDisplayTimeZones(null)[0]);
+        Resources.getDisplayTimeZones(null)[0] = null;
+        assertNotNull(Resources.getDisplayTimeZones(null)[0]);
+        // getDisplayTimezones actually returns a String[][] rather than a String[].
+        assertNotNull(Resources.getDisplayTimeZones(null)[0][0]);
+        Resources.getDisplayTimeZones(null)[0][0] = null;
+        assertNotNull(Resources.getDisplayTimeZones(null)[0][0]);
+    }
+}