[PATCH v2] libio: Fix CVE-2026-18374 - fopen heap buffer overflow with empty ccs=

[손동균/Process & Infra Lab(SR)/삼성전자]

Hi all,

My v1 of this patch did not apply cleanly -- most likely my mail client
damaged the inline diff (line wrapping / whitespace), so the automated
apply check failed. I'm resending a clean version generated with
git format-patch on current master and attached to this mail to avoid any
whitespace issues. Apologies for the noise.

The patch has been regenerated on top of current master
(655656fcc6 "manual: Fix some typos in the Low-Level Input/Output
chapter") and verified to apply cleanly with both "git apply --check" and
"git am".

Changes since v1:
  - No functional changes. v2 is the same fix as v1, regenerated on
    current master as a clean, applyable patch.

Summary
-------
CVE-2026-18374: heap buffer overflow in fopen() with an empty ,ccs=
parameter (GLIBC-SA-2026-0015, CVSS 4.9,
AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).

When fopen("file", "r,ccs=") is called with an empty charset
specification, endp - (cs + 5) == 0, so only 3 bytes are allocated for
the ccs buffer. This patch rejects an empty ccs= string with EINVAL
before allocation, and extracts the length into a size_t (ccs_len) for
clarity. A regression test is added to libio/tst-fopenloc.c.

The patch is attached as:
  0001-CVE-2026-18374-v2.patch

Thanks,
Dongkyun Son
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-CVE-2026-18374-v2.patch
Type: application/octet-stream
Size: 2967 bytes
Desc: not available
URL: <https://sourceware.org/pipermail/libc-alpha/attachments/20260828/17612b85/attachment.obj>