Android patch: Add noop-*.ucm to prevent 2022 security attack.

This change was introduced in Android by this patch:

https://android.googlesource.com/platform/external/icu/+/e53684e

And then amended by the ICU4.4.1 and ICU51.1 upgrades:

https://android.googlesource.com/platform/external/icu/+/ea1f181
https://android.googlesource.com/platform/external/icu/+/8393335

Change-Id: I0a446b8d85f31d0914f0dd9c995f5ccb98b25def

5 files changed, 108 insertions, 6 deletions

diff --git a/icu4c/source/common/ucnv2022.cpp b/icu4c/source/common/ucnv2022.cpp
index 3ae11a1e1..25e62c1d8 100644
--- a/icu4c/source/common/ucnv2022.cpp
+++ b/icu4c/source/common/ucnv2022.cpp
@@ -535,7 +535,9 @@ _ISO2022Open(UConverter *cnv, UConverterLoadArgs *pArgs, UErrorCode *errorCode){
             }
             if(jpCharsetMasks[version]&CSM(GB2312)) {
                 myConverterData->myConverterArray[GB2312] =
-                    ucnv_loadSharedData("ibm-5478", &stackPieces, &stackArgs, errorCode);   /* gb_2312_80-1 */
+                    /* BEGIN android-changed */
+                    ucnv_loadSharedData("noop-gb2312_gl", &stackPieces, &stackArgs, errorCode); /* gb_2312_80-1 */
+                    /* END android-changed */
             }
             if(jpCharsetMasks[version]&CSM(KSC5601)) {
                 myConverterData->myConverterArray[KSC5601] =
@@ -566,7 +568,9 @@ _ISO2022Open(UConverter *cnv, UConverterLoadArgs *pArgs, UErrorCode *errorCode){
             if(version==1) {
                 cnvName="icu-internal-25546";
             } else {
-                cnvName="ibm-949";
+                /* BEGIN android-changed */
+                cnvName="ksc_5601";
+                /* END android-changed */
                 myConverterData->version=version=0;
             }
             if(pArgs->onlyTestIsLoadable) {
@@ -610,14 +614,16 @@ _ISO2022Open(UConverter *cnv, UConverterLoadArgs *pArgs, UErrorCode *errorCode){
             }
 
             /* open the required converters and cache them */
+            /* BEGIN android-changed */
             myConverterData->myConverterArray[GB2312_1] =
-                ucnv_loadSharedData("ibm-5478", &stackPieces, &stackArgs, errorCode);
+                ucnv_loadSharedData("noop-gb2312_gl", &stackPieces, &stackArgs, errorCode);
             if(version==1) {
                 myConverterData->myConverterArray[ISO_IR_165] =
-                    ucnv_loadSharedData("iso-ir-165", &stackPieces, &stackArgs, errorCode);
+                    ucnv_loadSharedData("noop-iso-ir-165", &stackPieces, &stackArgs, errorCode);
             }
             myConverterData->myConverterArray[CNS_11643] =
-                ucnv_loadSharedData("cns-11643-1992", &stackPieces, &stackArgs, errorCode);
+                ucnv_loadSharedData("noop-cns-11643", &stackPieces, &stackArgs, errorCode);
+            /* END android-changed */
 
 
             /* set the function pointers to appropriate funtions */
diff --git a/icu4c/source/data/mappings/noop-cns-11643.ucm b/icu4c/source/data/mappings/noop-cns-11643.ucm
new file mode 100644
index 000000000..e6e8ca18d
--- /dev/null
+++ b/icu4c/source/data/mappings/noop-cns-11643.ucm
@@ -0,0 +1,31 @@
+# *******************************************************************************
+# *
+# *   Copyright (C) 2009, International Business Machines
+# *   Corporation and others.  All Rights Reserved.
+# *
+# *******************************************************************************
+#
+# File created on   Dec 2, 2009
+#
+# This is not a real CNS-11643 table, but a "fake" table to return U+FFFD
+# for every byte sequence valid in ISO-2022-CN(-Ext). Chrome and Android
+# do not want to include the real table for charsets that are extremely
+# rare, if used at all. However, not supporting ISO-2022-CN(-Ext) gets
+# them vulernable to a security issue. By including this 'fake' table,
+# they can be protected while increasing the ICU data size by ~ 10kB.
+<code_set_name>       "NOOP-CNS-11643"
+<char_name_mask>      "AXXXX"
+<mb_cur_max>          3
+<mb_cur_min>          3
+<uconv_class>         "MBCS"
+<subchar>             \x81\x7e\x7e
+
+# (state 0) lead byte, selects the CNS plane (0x80 + plane number)
+<icu:state>           81-90:1
+
+# (1..2) middle and trail bytes for valid but unassigned sequences
+<icu:state>           21-7e:2
+<icu:state>           21-7e.u
+
+CHARMAP
+END CHARMAP
diff --git a/icu4c/source/data/mappings/noop-gb2312_gl.ucm b/icu4c/source/data/mappings/noop-gb2312_gl.ucm
new file mode 100644
index 000000000..8c2e26c65
--- /dev/null
+++ b/icu4c/source/data/mappings/noop-gb2312_gl.ucm
@@ -0,0 +1,32 @@
+#________________________________________________________________________
+#
+# (C) COPYRIGHT International Business Machines Corp. 2009
+#     All Rights Reserved
+#
+#________________________________________________________________________
+#
+#       Name:    "Fake" Unicode to ISO-IR-165 table
+#       Date:    December 2, 2009
+#
+# This is not a real GB2312 GL table, but a "fake" table to return U+FFFD
+# for every byte sequence valid in GB2312 GL. Chrome and Android
+# do not want to include the real table for ISO-1022-CN(-Ext) that are extremely
+# rare, if used at all. However, the lack of support gets
+# them vulernable to a security issue. By including this 'fake' table
+# and two others, they can be protected while increasing the ICU data size
+# by ~ 10kB.
+<code_set_name>               "noop-gb2312_gl"
+<char_name_mask>              "AXXXX"
+<mb_cur_max>                  2
+<mb_cur_min>                  2
+<uconv_class>                 "DBCS"
+<subchar>                     \x21\x21
+<icu:charsetFamily>           "ASCII"
+<icu:alias>                   "ibm-5478_STD"
+
+<icu:state>                   0-20:2, 21-7e:1, 7f-ff:2
+<icu:state>                   21-7e.u
+<icu:state>
+
+CHARMAP
+END CHARMAP
diff --git a/icu4c/source/data/mappings/noop-iso-ir-165.ucm b/icu4c/source/data/mappings/noop-iso-ir-165.ucm
new file mode 100644
index 000000000..45645885e
--- /dev/null
+++ b/icu4c/source/data/mappings/noop-iso-ir-165.ucm
@@ -0,0 +1,29 @@
+#________________________________________________________________________
+#
+# (C) COPYRIGHT International Business Machines Corp. 2009
+#     All Rights Reserved
+#
+#________________________________________________________________________
+#
+#       Name:    "Fake" Unicode to ISO-IR-165 table
+#       Date:    December 2, 2009
+#
+# This is not a real ISO-IR-165 table, but a "fake" table to return U+FFFD
+# for every byte sequence valid in ISO-IR-165. Chrome and Android
+# do not want to include the real table for ISO-1022-CN(-Ext) that are
+# extremely rare, if used at all. However, the lack of support gets
+# them vulernable to a security issue. By including this 'fake' table
+# and two others, they can be protected while increasing the ICU data size
+# by only ~ 10kB.
+<code_set_name>         "noop-iso-ir-165"
+<char_name_mask>        "AXXXX"
+<mb_cur_max>            2
+<mb_cur_min>            2
+<uconv_class>           "MBCS"
+<subchar>               \x7e\x7e
+<icu:state>             0-20:2, 21-7e:1, 7f-ff:2
+<icu:state>             21-7e.u
+<icu:state>
+#
+CHARMAP
+END CHARMAP
diff --git a/icu4c/source/data/mappings/ucmlocal.mk b/icu4c/source/data/mappings/ucmlocal.mk
index c590eb6b2..a32ae0a89 100644
--- a/icu4c/source/data/mappings/ucmlocal.mk
+++ b/icu4c/source/data/mappings/ucmlocal.mk
@@ -2,6 +2,7 @@
 # Author: mscherer@google.com (Markus Scherer)
 
 # A list of additional .ucm files to build for Google.
+# Note: noop-*.ucm are for Android only to prevent 2022 security attack.
 
 UCM_SOURCE_LOCAL=gsm-03.38-2000.ucm \
    docomo-shift_jis-2012.ucm \
@@ -9,4 +10,7 @@ UCM_SOURCE_LOCAL=gsm-03.38-2000.ucm \
    kddi-jisx-208-2007.ucm \
    kddi-shift_jis-2012.ucm \
    softbank-jisx-208-2007.ucm \
-   softbank-shift_jis-2012.ucm
+   softbank-shift_jis-2012.ucm \
+   noop-cns-11643.ucm \
+   noop-gb2312_gl.ucm \
+   noop-iso-ir-165.ucm