ICU-23359 Fix use-after-free race in TransliteratorAlias compoundFilter by hirorogo · Pull Request #3913 · unicode-org/icu

hirorogo · 2026-03-19T16:35:58Z

Checklist

Required: Issue filed: ICU-23359
Required: The PR title must be prefixed with a JIRA Issue number. Example: "ICU-NNNNN Fix xyz"
Required: Each commit message must be prefixed with a JIRA Issue number. Example: "ICU-NNNNN Fix xyz"
Issue accepted (done by Technical Committee after discussion)
Tests included, if applicable
API docs and/or User Guide docs changed or added, if applicable
CLA signed

Summary

TransliteratorAlias stored a raw non-owning pointer to the TransliteratorEntry's compoundFilter. When the registry mutex is released between registry->get() and alias->create(), a concurrent Transliterator::unregister() call can delete the entry (and its compoundFilter) while the alias still holds a dangling pointer, causing a use-after-free.

The source comment at transreg.cpp lines 30-36 notes that BoundsChecker has reported dangling pointer errors with these entry objects, corroborating this race condition.

Changes

Clone compoundFilter in both TransliteratorAlias constructors instead of storing a raw alias pointer
Delete owned compoundFilter in ~TransliteratorAlias()
Update header comment and type from const UnicodeSet* (alias) to UnicodeSet* (owned)
Add TestTransliteratorAliasCompoundFilterRace in tsmthred.cpp to exercise concurrent createInstance() + unregister() with a compound-filter transliterator

Test plan

Existing ICU transliterator tests pass
Concurrent createInstance + unregister on the same ID no longer triggers UAF (new test: TestTransliteratorAliasCompoundFilterRace)

CLAassistant · 2026-03-19T16:36:07Z

All committers have signed the CLA.

markusicu · 2026-03-26T16:29:18Z

@hirorogo Could you please sign the CLA -- otherwise we can't look at your changes -- and create a Jira ticket with the problem description?

See unicode-org#3913

jira-pull-request-webhook · 2026-03-27T14:20:30Z

Hooray! The files in the branch are the same across the force-push. 😃

~ Your Friendly Jira-GitHub PR Checker Bot

jira-pull-request-webhook · 2026-03-27T14:22:00Z

Hooray! The files in the branch are the same across the force-push. 😃

~ Your Friendly Jira-GitHub PR Checker Bot

See unicode-org#3913

jira-pull-request-webhook · 2026-03-27T14:23:01Z

Hooray! The files in the branch are the same across the force-push. 😃

~ Your Friendly Jira-GitHub PR Checker Bot

hirorogo · 2026-04-03T05:53:04Z

I've restored the PR template, added a unit test (TestTransliteratorAliasCompoundFilterRace), and the CLA is signed. Could you please create a Jira ticket for this issue? I'll update the PR title and commit message with the ticket ID once assigned. Thank you!

TransliteratorAlias::compoundFilter was stored as a raw alias to the caller-owned filter, leading to use-after-free when the caller destroys its copy. Clone the filter into an owned instance instead. Adds concurrency test exercising concurrent createInstance() + unregister() with a compound filter to verify the fix. See unicode-org#3913

jira-pull-request-webhook · 2026-04-05T05:12:39Z

Hooray! The files in the branch are the same across the force-push. 😃

~ Your Friendly Jira-GitHub PR Checker Bot

qdan8556-glitch

hirorogo · 2026-04-06T15:19:18Z

@markusicu CLA is signed, and I've created the Jira ticket: ICU-23359. The PR title and commit message are updated with the ticket ID.

A unit test (TestTransliteratorAliasCompoundFilterRace) is included in tsmthred.cpp — it exercises concurrent createInstance() + unregister() with a compound-filter transliterator.

Could the Technical Committee please accept ICU-23359 when you get a chance? The jira-ticket CI check is currently failing because the ticket status is still "New".

Thank you!

hirorogo

(replaced — see English review below)

hirorogo

Reviewed the changes. The fix correctly addresses the root cause — the ownership ambiguity of compoundFilter.

Before this patch, TransliteratorAlias held a raw non-owning pointer to the entry's compoundFilter. Once the registry mutex is released between get() and create(), a concurrent unregister() can delete the entry and leave the alias with a dangling pointer. Cloning in the constructor and taking ownership eliminates this dependency entirely.

A few minor observations:

static_cast<UnicodeSet*>(compoundFilter->clone()) — since clone() returns UnicodeFilter*, a dynamic_cast with a null check would be slightly more defensive. That said, the original code did the same, so this is pre-existing.
No handling if clone() returns nullptr on OOM. Looks consistent with other ICU code, just noting it.
The test's success criterion is "no crash / no sanitizer report", which means it may pass silently without ASan/TSan. Fine if CI runs sanitizer builds.

None of these are blockers.

poulsbo · 2026-04-09T18:23:04Z

icu4c/source/i18n/transreg.h

@@ -105,14 +105,14 @@ class TransliteratorAlias : public UMemory {
    //    Here ID is the ID, aliasID is the idBlock, trans is the
    //    contained RBT, and idSplitPoint is the offset in aliasID
    //    where the contained RBT goes.  compoundFilter is the
-    //    compound filter, and it is _not_ owned.
+    //    compound filter, and it is owned (cloned from entry).


suggestion: Reword comment to "(cloned from input)", with "input" being clearer than "entry" as referring to the ctor's input parameter.

Done — updated to "(cloned from input)".

jira-pull-request-webhook · 2026-04-10T07:07:55Z

Hooray! The files in the branch are the same across the force-push. 😃

~ Your Friendly Jira-GitHub PR Checker Bot

poulsbo

Looks good, thank you!

markusicu added the cla-needed label Mar 26, 2026

hirorogo added a commit to hirorogo/icu that referenced this pull request Mar 27, 2026

Fix use-after-free race in TransliteratorAlias compoundFilter

b8391c6

See unicode-org#3913

hirorogo force-pushed the fix-transreg-compoundfilter-race branch from b2507fc to b8391c6 Compare March 27, 2026 14:20

hirorogo force-pushed the fix-transreg-compoundfilter-race branch from b8391c6 to 9a89dab Compare March 27, 2026 14:21

hirorogo added a commit to hirorogo/icu that referenced this pull request Mar 27, 2026

Fix use-after-free race in TransliteratorAlias compoundFilter

856bf9c

See unicode-org#3913

hirorogo force-pushed the fix-transreg-compoundfilter-race branch from 9a89dab to 856bf9c Compare March 27, 2026 14:22

hirorogo changed the title ~~Fix use-after-free race in TransliteratorAlias compoundFilter~~ ICU-23359 Fix use-after-free race in TransliteratorAlias compoundFilter Apr 5, 2026

hirorogo force-pushed the fix-transreg-compoundfilter-race branch from 76d69f2 to fcf4324 Compare April 5, 2026 05:12

qdan8556-glitch reviewed Apr 5, 2026

View reviewed changes

hirorogo commented Apr 7, 2026

View reviewed changes

richgillam removed the cla-needed label Apr 9, 2026

richgillam self-assigned this Apr 9, 2026

markusicu requested review from aheninger, markusicu and poulsbo April 9, 2026 16:47

poulsbo reviewed Apr 9, 2026

View reviewed changes

hirorogo force-pushed the fix-transreg-compoundfilter-race branch from 3fda95b to 7c545c5 Compare April 10, 2026 07:07

ICU-23359 Fix use-after-free race in TransliteratorAlias compoundFilter

7c545c5

hirorogo requested a review from qdan8556-glitch April 10, 2026 14:39

poulsbo approved these changes Apr 10, 2026

View reviewed changes

Uh oh!

Conversation

hirorogo commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Summary

Changes

Test plan

Uh oh!

CLAassistant commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

markusicu commented Mar 26, 2026

Uh oh!

jira-pull-request-webhook bot commented Mar 27, 2026

Uh oh!

jira-pull-request-webhook bot commented Mar 27, 2026

Uh oh!

jira-pull-request-webhook bot commented Mar 27, 2026

Uh oh!

hirorogo commented Apr 3, 2026

Uh oh!

jira-pull-request-webhook bot commented Apr 5, 2026

Uh oh!

qdan8556-glitch left a comment

Choose a reason for hiding this comment

Uh oh!

hirorogo commented Apr 6, 2026 • edited by atlassian bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hirorogo left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hirorogo left a comment

Choose a reason for hiding this comment

Uh oh!

poulsbo Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

hirorogo Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

hirorogo Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

jira-pull-request-webhook bot commented Apr 10, 2026

Uh oh!

poulsbo left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

hirorogo commented Mar 19, 2026 •

edited

Loading

CLAassistant commented Mar 19, 2026 •

edited

Loading

hirorogo commented Apr 6, 2026 •

edited by atlassian bot

Loading

hirorogo left a comment •

edited

Loading