From owner-freebsd-ports-bugs@FreeBSD.ORG Fri Feb 5 14:00:15 2010 Return-Path: Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 4F908106566B for ; Fri, 5 Feb 2010 14:00:15 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 0FDB48FC1E for ; Fri, 5 Feb 2010 14:00:12 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id o15E0CvP062016 for ; Fri, 5 Feb 2010 14:00:12 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id o15E0CYH062015; Fri, 5 Feb 2010 14:00:12 GMT (envelope-from gnats) Resent-Date: Fri, 5 Feb 2010 14:00:12 GMT Resent-Message-Id: <201002051400.o15E0CYH062015@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Natacha PORTE Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 0A1BE106566C for ; Fri, 5 Feb 2010 13:55:38 +0000 (UTC) (envelope-from natbsd@instinctive.eu) Received: from mail-fx0-f224.google.com (mail-fx0-f224.google.com [209.85.220.224]) by mx1.freebsd.org (Postfix) with ESMTP id 9BDD08FC13 for ; Fri, 5 Feb 2010 13:55:37 +0000 (UTC) Received: by fxm24 with SMTP id 24so451758fxm.3 for ; Fri, 05 Feb 2010 05:55:36 -0800 (PST) Received: by 10.223.6.70 with SMTP id 6mr2395742fay.29.1265376584407; Fri, 05 Feb 2010 05:29:44 -0800 (PST) Received: from sigil.instinctive.eu (sigil.instinctive.eu [78.41.233.119]) by mx.google.com with ESMTPS id f31sm2181392fkf.12.2010.02.05.05.29.41 (version=TLSv1/SSLv3 cipher=RC4-MD5); Fri, 05 Feb 2010 05:29:43 -0800 (PST) Message-Id: <20100205132940.GK79938@sigil.instinctive.eu> Date: Fri, 5 Feb 2010 14:29:41 +0100 From: Natacha PORTE To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: Subject: ports/143575: [Patch] converters/libiconv: Fix an endless loop in the conversion to wchar_t X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Natacha PORTE List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Feb 2010 14:00:15 -0000 >Number: 143575 >Category: ports >Synopsis: [Patch] converters/libiconv: Fix an endless loop in the conversion to wchar_t >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: change-request >Submitter-Id: current-users >Arrival-Date: Fri Feb 05 14:00:11 UTC 2010 >Closed-Date: >Last-Modified: >Originator: Natacha PORTE >Release: FreeBSD 7.2-RELEASE-p4 i386 >Organization: >Environment: System: FreeBSD sigil.instinctive.eu 7.2-RELEASE-p4 FreeBSD 7.2-RELEASE-p4 #2 r200055: Thu Dec 3 16:42:18 CET 2009 nat@sigil.instinctive.eu:/usr/obj/usr/src/sys/GENERIC i386 >Description: UTF-8 to wchar_t conversion of an input ending with an incomplete multibyte sequence triggered an endless loop. newsbeuter triggered this bug quite often. >How-To-Repeat: >Fix: This has been fixed upstream: http://git.savannah.gnu.org/cgit/libiconv.git/commit/?id=2cf3ee65d04ac4e41e29aa7526361ec3f20f5e29 The attached patch is a chopped out version of this commit, keeping the actual fix while leaving test, news and whatever looked like possibly troublesome to apply. --- patch-endless-wchar_t-loop begins here --- --- lib/loop_wchar.h +++ lib/loop_wchar.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2000-2002, 2005-2006, 2008 Free Software Foundation, Inc. + * Copyright (C) 2000-2002, 2005-2006, 2008-2009 Free Software Foundation, Inc. * This file is part of the GNU LIBICONV Library. * * The GNU LIBICONV Library is free software; you can redistribute it @@ -321,7 +321,8 @@ static size_t wchar_to_loop_convert (iconv_t icd, size_t result = 0; while (*inbytesleft > 0) { size_t incount; - for (incount = 1; incount <= *inbytesleft; incount++) { + for (incount = 1; ; ) { + /* Here incount <= *inbytesleft. */ char buf[BUF_SIZE]; const char* inptr = *inbuf; size_t inleft = incount; @@ -403,6 +404,12 @@ static size_t wchar_to_loop_convert (iconv_t icd, break; } } + incount++; + if (incount > *inbytesleft) { + /* Incomplete input. */ + errno = EINVAL; + return -1; + } } } return result; --- patch-endless-wchar_t-loop ends here --- >Release-Note: >Audit-Trail: >Unformatted: