mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-10 00:04:06 -09:00
b75ccc686e
Backport the upstream fix for a heap buffer overflow in
convert_fname() when growing the iconv output buffer.
Backport to: 2025.02.x
Signed-off-by: Stefan Müller <stemu86@gmx.ch>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e991fa0716)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
73 lines
2.3 KiB
Diff
73 lines
2.3 KiB
Diff
From c2640fe5171c59f87c58dc9fcb195b2d18b010ee Mon Sep 17 00:00:00 2001
|
|
From: Arkadi Vainbrand <arkadva8@gmail.com>
|
|
Date: Tue, 13 Jan 2026 12:22:04 +0200
|
|
Subject: [PATCH] Fix buffer size handling in filename conversion
|
|
|
|
* src/url.c (convert_fname): Fix buffer overflow.
|
|
|
|
Copyright-paperwork-exempt: Yes
|
|
Signed-off-by: Arkadi Vainbrand <arkadva8@gmail.com>
|
|
CVE: CVE-2026-58471
|
|
Upstream: https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee
|
|
Signed-off-by: Stefan Müller <stemu86@gmx.ch>
|
|
|
|
---
|
|
src/url.c | 20 +++++++++++++-------
|
|
1 file changed, 13 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/src/url.c b/src/url.c
|
|
index 7540e90f..f334456c 100644
|
|
--- a/src/url.c
|
|
+++ b/src/url.c
|
|
@@ -1614,7 +1614,7 @@ convert_fname (char *fname)
|
|
const char *from_encoding = opt.encoding_remote;
|
|
const char *to_encoding = opt.locale;
|
|
iconv_t cd;
|
|
- size_t len, done, inlen, outlen;
|
|
+ size_t len, inlen, outlen;
|
|
char *s;
|
|
const char *orig_fname;
|
|
|
|
@@ -1636,7 +1636,6 @@ convert_fname (char *fname)
|
|
inlen = strlen (fname);
|
|
len = outlen = inlen * 2;
|
|
converted_fname = s = xmalloc (outlen + 1);
|
|
- done = 0;
|
|
|
|
for (;;)
|
|
{
|
|
@@ -1644,7 +1643,7 @@ convert_fname (char *fname)
|
|
if (iconv (cd, (ICONV_CONST char **) &fname, &inlen, &s, &outlen) == 0
|
|
&& iconv (cd, NULL, NULL, &s, &outlen) == 0)
|
|
{
|
|
- *(converted_fname + len - outlen - done) = '\0';
|
|
+ *s = '\0';
|
|
iconv_close (cd);
|
|
DEBUGP (("Converted file name '%s' (%s) -> '%s' (%s)\n",
|
|
orig_fname, from_encoding, converted_fname, to_encoding));
|
|
@@ -1667,10 +1666,17 @@ convert_fname (char *fname)
|
|
}
|
|
else if (errno == E2BIG) /* Output buffer full */
|
|
{
|
|
- done = len;
|
|
- len = outlen = done + inlen * 2;
|
|
- converted_fname = xrealloc (converted_fname, outlen + 1);
|
|
- s = converted_fname + done;
|
|
+ size_t used = s - converted_fname;
|
|
+ size_t newlen = used + inlen * 2 + 1;
|
|
+
|
|
+ /* Ensure we actually grow the buffer */
|
|
+ if (newlen <= len)
|
|
+ newlen = len * 2;
|
|
+
|
|
+ converted_fname = xrealloc (converted_fname, newlen + 1);
|
|
+ len = newlen;
|
|
+ s = converted_fname + used;
|
|
+ outlen = len - used;
|
|
}
|
|
else /* Weird, we got an unspecified error */
|
|
{
|
|
--
|
|
GitLab
|
|
|