Date: Tue, 30 Jun 2026 17:19:20 +0000 From: Mark Johnston <markj@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 8bc3abb7d71e - main - iconv: Fix a buffer overflow in the HZ encoding Message-ID: <6a43fa98.44ba0.2b7992fa@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=8bc3abb7d71eebe6819af1e61640067733e596dc commit 8bc3abb7d71eebe6819af1e61640067733e596dc Author: Mark Johnston <markj@FreeBSD.org> AuthorDate: 2026-06-23 16:05:31 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2026-06-30 17:00:23 +0000 iconv: Fix a buffer overflow in the HZ encoding wcrtomb may store up to 2 2-byte escape sequences to the state buffer in addition to the character itself. In the worst case, a 3-byte heap overflow is possible. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58081 Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D57949 --- lib/libiconv_modules/HZ/citrus_hz.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/libiconv_modules/HZ/citrus_hz.c b/lib/libiconv_modules/HZ/citrus_hz.c index db738b8f812e..e16ab3a8e34c 100644 --- a/lib/libiconv_modules/HZ/citrus_hz.c +++ b/lib/libiconv_modules/HZ/citrus_hz.c @@ -132,7 +132,7 @@ typedef struct { typedef struct { escape_t *inuse; int chlen; - char ch[ROWCOL_MAX]; + char ch[4 + ROWCOL_MAX]; } _HZState; #define _CEI_TO_EI(_cei_) (&(_cei_)->ei)home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a43fa98.44ba0.2b7992fa>