[Bug locale/26923] Assertion failure in iconv when converting invalid UCS4 (CVE-2020-29562)

[siddhesh at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=26923

Siddhesh Poyarekar <siddhesh at sourceware dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED
   Target Milestone|---                         |2.33

--- Comment #5 from Siddhesh Poyarekar <siddhesh at sourceware dot org> ---
Fixed in master.

commit 228edd356f03bf62dcf2b1335f25d43c602ee68d
Author: Michael Colavita <mcolavita@fb.com>
Date:   Thu Nov 19 11:44:40 2020 -0500

    iconv: Fix incorrect UCS4 inner loop bounds (BZ#26923)

    Previously, in UCS4 conversion routines we limit the number of
    characters we examine to the minimum of the number of characters in the
    input and the number of characters in the output. This is not the
    correct behavior when __GCONV_IGNORE_ERRORS is set, as we do not consume
    an output character when we skip a code unit. Instead, track the input
    and output pointers and terminate the loop when either reaches its
    limit.

    This resolves assertion failures when resetting the input buffer in a step
of
    iconv, which assumes that the input will be fully consumed given sufficient
    output space.

-- 
You are receiving this mail because:
You are on the CC list for the bug.