mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-10 08:14:09 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/wget: fix CVE-2026-58471

Browse Source 
Backport the upstream fix for a heap buffer overflow in
convert_fname() when growing the iconv output buffer.

Backport to: 2025.02.x

Signed-off-by: Stefan Müller <stemu86@gmx.ch>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit is contained in:
Stefan Müller
2026-08-20 09:49:38 +00:00
committed by Julien Olivain
parent 89485adb29
commit e991fa0716
2 changed files with 75 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

72
package/wget/0007-src-url.c-convert_fname-Fix-buffer-overflow.patch Normal file
View File

@@ -0,0 +1,72 @@
From c2640fe5171c59f87c58dc9fcb195b2d18b010ee Mon Sep 17 00:00:00 2001
From: Arkadi Vainbrand <arkadva8@gmail.com>
Date: Tue, 13 Jan 2026 12:22:04 +0200
Subject: [PATCH] Fix buffer size handling in filename conversion
* src/url.c (convert_fname): Fix buffer overflow.
Copyright-paperwork-exempt: Yes
Signed-off-by: Arkadi Vainbrand <arkadva8@gmail.com>
CVE: CVE-2026-58471
Upstream: https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee
Signed-off-by: Stefan Müller <stemu86@gmx.ch>
---
src/url.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
diff --git a/src/url.c b/src/url.c
index 7540e90f..f334456c 100644
--- a/src/url.c
+++ b/src/url.c
@@ -1614,7 +1614,7 @@ convert_fname (char *fname)
const char *from_encoding = opt.encoding_remote;
const char *to_encoding = opt.locale;
iconv_t cd;
- size_t len, done, inlen, outlen;
+ size_t len, inlen, outlen;
char *s;
const char *orig_fname;
@@ -1636,7 +1636,6 @@ convert_fname (char *fname)
inlen = strlen (fname);
len = outlen = inlen * 2;
converted_fname = s = xmalloc (outlen + 1);
- done = 0;
for (;;)
{
@@ -1644,7 +1643,7 @@ convert_fname (char *fname)
if (iconv (cd, (ICONV_CONST char **) &fname, &inlen, &s, &outlen) == 0
&& iconv (cd, NULL, NULL, &s, &outlen) == 0)
{
- *(converted_fname + len - outlen - done) = '\0';
+ *s = '\0';
iconv_close (cd);
DEBUGP (("Converted file name '%s' (%s) -> '%s' (%s)\n",
orig_fname, from_encoding, converted_fname, to_encoding));
@@ -1667,10 +1666,17 @@ convert_fname (char *fname)
}
else if (errno == E2BIG) /* Output buffer full */
{
- done = len;
- len = outlen = done + inlen * 2;
- converted_fname = xrealloc (converted_fname, outlen + 1);
- s = converted_fname + done;
+ size_t used = s - converted_fname;
+ size_t newlen = used + inlen * 2 + 1;
+
+ /* Ensure we actually grow the buffer */
+ if (newlen <= len)
+ newlen = len * 2;
+
+ converted_fname = xrealloc (converted_fname, newlen + 1);
+ len = newlen;
+ s = converted_fname + used;
+ outlen = len - used;
}
else /* Weird, we got an unspecified error */
{
--
GitLab

3
package/wget/wget.mk
View File

@@ -21,6 +21,9 @@ WGET_IGNORE_CVES += CVE-2026-58469
# 0006-src-http.c-parse_content_range-Use-strtoll-instead-of-strtol.patch
WGET_IGNORE_CVES += CVE-2026-58470
# 0007-src-url.c-convert_fname-Fix-buffer-overflow.patch
WGET_IGNORE_CVES += CVE-2026-58471
WGET_CONF_OPTS += --disable-pcre
ifeq ($(BR2_PACKAGE_LIBPSL),y)