[PATCH] iconv: iconv.c: fix null pointer dereference when outbuf is NULL

[Anton Moryakov]

Hi Andreas,

Thank you for the review and for pointing out the precise condition for
state reset.

You are correct that the reset mode is triggered only when 'inbuf' is NULL
or '*inbuf' is NULL.

The purpose of this patch is to fix an undefined behavior that occurs in
this exact scenario: when 'inbuf == NULL' (reset mode), 'outbuf != NULL',
but '*outbuf == NULL'. In such cases, the expression '*outbuf +
*outbytesleft' invokes undefined behavior due to pointer arithmetic on a
null pointer, even though no actual write occurs.

This situation can arise legitimately, for example, when probing available
space or during early initialization where the output buffer is not yet
allocated.

The patch ensures safe handling of this edge case by computing the 'outend'
pointer only after confirming '*outbuf != NULL'.

Best regards,
Anton V. Moryakov

ср, 29 окт. 2025 г. в 17:45, Andreas Schwab <schwab@suse.de>:

> On Okt 29 2025, Anton Moryakov wrote:
>
> > When calling iconv() with outbuf == NULL (a valid use case for state
> > reset),
>
> Only if inbuf is NULL or points to NULL.
>
> --
> Andreas Schwab, SUSE Labs, schwab@suse.de
> GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
> "And now for something completely different."
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://sourceware.org/pipermail/libc-alpha/attachments/20251029/2ca62cf0/attachment.htm>