[Bug locale/23711] New: wcsrtombs calls wcsnlen on input data which is not an array

["fweimer at redhat dot com" <sourceware-bugzilla at sourceware dot org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=23711

            Bug ID: 23711
           Summary: wcsrtombs calls wcsnlen on input data which is not an
                    array
           Product: glibc
           Version: 2.27
            Status: NEW
          Severity: normal
          Priority: P2
         Component: locale
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
  Target Milestone: ---
             Flags: security-

If the destination pointer is not null, __wcsrtombs does this:

      /* This code is based on the safe assumption that all internal
         multi-byte encodings use the NUL byte only to mark the end
         of the string.  */
      const wchar_t *srcend = *src + __wcsnlen (*src, len) + 1;

This is invalid because len can be much larger than the actual input data, and
calling __wcsnlen this way violates the precondition of the wcsnlen function:
the input must be an array.

-- 
You are receiving this mail because:
You are on the CC list for the bug.