[PATCH v2] libio: Fix CVE-2026-18374 - fopen heap buffer overflow with empty ccs=

[Florian Weimer]

* 손동균:

> diff --git a/libio/fileops.c b/libio/fileops.c
> index 9348d7c3a1..2137d0ee1f 100644
> --- a/libio/fileops.c
> +++ b/libio/fileops.c
> @@ -342,7 +342,17 @@ _IO_new_file_fopen (FILE *fp, const char *filename, const char *mode,
>  	  struct gconv_fcts fcts;
>  	  struct _IO_codecvt *cc;
>  	  char *endp = __strchrnul (cs + 5, ',');
> -	  char *ccs = malloc (endp - (cs + 5) + 3);
> +	  size_t ccs_len = endp - (cs + 5);
> +
> +	  /* Reject empty ccs= string to prevent heap buffer overflow.  */
> +	  if (ccs_len == 0)
> +	    {
> +	      (void) _IO_file_close_it (fp);
> +	      __set_errno (EINVAL);
> +	      return NULL;
> +	    }
> +
> +	  char *ccs = malloc (ccs_len + 3);
>  
>  	  if (ccs == NULL)
>  	    {

This doesn't fix the bug because in the reproducer, the ,ccs= argument
is not actually empty.  It's empty only after stripping.

Thanks,
Florian