public inbox for glibc-bugs@sourceware.org help / color / mirror / Atom feed
* [Bug locale/26224] New: iconv hangs when converting some invalid inputs from several IBM character sets
@ 2020-07-09 20:21 arjun.is at lostca dot se
2020-07-09 20:22 ` [Bug locale/26224] " arjun.is at lostca dot se
` (4 more replies)
0 siblings, 5 replies; 6+ messages in thread
From: arjun.is at lostca dot se @ 2020-07-09 20:21 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=26224
Bug ID: 26224
Summary: iconv hangs when converting some invalid inputs from
several IBM character sets
Product: glibc
Version: unspecified
Status: NEW
Severity: normal
Priority: P2
Component: locale
Assignee: unassigned at sourceware dot org
Reporter: arjun.is at lostca dot se
Target Milestone: ---
I found the following hangs when running an iconv input fuzzer I wrote while
trying to fix bug 19519. The hangs are present in master:
echo -en '\x00\x0f' | iconv -t UTF-8 -c -f IBM1364
echo -en '\x00\x0f' | iconv -t UTF-8 -c -f IBM1371
echo -en '\x00\x0f' | iconv -t UTF-8 -c -f IBM1388
echo -en '\x00\x0f' | iconv -t UTF-8 -c -f IBM1390
echo -en '\x00\x0f' | iconv -t UTF-8 -c -f IBM1399
These hangs are presently mentioned but commented out in
iconv/tst-iconv_prog.sh and should eventually be un-commented when this bug is
fixed.
The fuzzer itself (attachment 11786) should also be run against these character
sets after this bug is fixed, because they skip all remaining inputs for a
character set once they encounter a hang in the corresponding converter, and
thus any other hangs (from possibly other bugs) aren't tested for.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 6+ messages in thread* [Bug locale/26224] iconv hangs when converting some invalid inputs from several IBM character sets 2020-07-09 20:21 [Bug locale/26224] New: iconv hangs when converting some invalid inputs from several IBM character sets arjun.is at lostca dot se @ 2020-07-09 20:22 ` arjun.is at lostca dot se 2020-07-09 20:27 ` fweimer at redhat dot com ` (3 subsequent siblings) 4 siblings, 0 replies; 6+ messages in thread From: arjun.is at lostca dot se @ 2020-07-09 20:22 UTC (permalink / raw) To: glibc-bugs https://sourceware.org/bugzilla/show_bug.cgi?id=26224 Arjun Shankar <arjun.is at lostca dot se> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|unassigned at sourceware dot org |arjun.is at lostca dot se -- You are receiving this mail because: You are on the CC list for the bug. ^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug locale/26224] iconv hangs when converting some invalid inputs from several IBM character sets 2020-07-09 20:21 [Bug locale/26224] New: iconv hangs when converting some invalid inputs from several IBM character sets arjun.is at lostca dot se 2020-07-09 20:22 ` [Bug locale/26224] " arjun.is at lostca dot se @ 2020-07-09 20:27 ` fweimer at redhat dot com 2020-07-09 20:43 ` fweimer at redhat dot com ` (2 subsequent siblings) 4 siblings, 0 replies; 6+ messages in thread From: fweimer at redhat dot com @ 2020-07-09 20:27 UTC (permalink / raw) To: glibc-bugs https://sourceware.org/bugzilla/show_bug.cgi?id=26224 Florian Weimer <fweimer at redhat dot com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |security+ CC| |fweimer at redhat dot com -- You are receiving this mail because: You are on the CC list for the bug. ^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug locale/26224] iconv hangs when converting some invalid inputs from several IBM character sets 2020-07-09 20:21 [Bug locale/26224] New: iconv hangs when converting some invalid inputs from several IBM character sets arjun.is at lostca dot se 2020-07-09 20:22 ` [Bug locale/26224] " arjun.is at lostca dot se 2020-07-09 20:27 ` fweimer at redhat dot com @ 2020-07-09 20:43 ` fweimer at redhat dot com 2020-10-22 7:55 ` [Bug locale/26224] iconv hangs when converting some invalid inputs from several IBM character sets (CVE-2020-27618) siddhesh at sourceware dot org 2020-11-06 2:19 ` siddhesh at sourceware dot org 4 siblings, 0 replies; 6+ messages in thread From: fweimer at redhat dot com @ 2020-07-09 20:43 UTC (permalink / raw) To: glibc-bugs https://sourceware.org/bugzilla/show_bug.cgi?id=26224 Florian Weimer <fweimer at redhat dot com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://sourceware.org/bugz | |illa/show_bug.cgi?id=19519 -- You are receiving this mail because: You are on the CC list for the bug. ^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug locale/26224] iconv hangs when converting some invalid inputs from several IBM character sets (CVE-2020-27618) 2020-07-09 20:21 [Bug locale/26224] New: iconv hangs when converting some invalid inputs from several IBM character sets arjun.is at lostca dot se ` (2 preceding siblings ...) 2020-07-09 20:43 ` fweimer at redhat dot com @ 2020-10-22 7:55 ` siddhesh at sourceware dot org 2020-11-06 2:19 ` siddhesh at sourceware dot org 4 siblings, 0 replies; 6+ messages in thread From: siddhesh at sourceware dot org @ 2020-10-22 7:55 UTC (permalink / raw) To: glibc-bugs https://sourceware.org/bugzilla/show_bug.cgi?id=26224 Siddhesh Poyarekar <siddhesh at sourceware dot org> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|iconv hangs when converting |iconv hangs when converting |some invalid inputs from |some invalid inputs from |several IBM character sets |several IBM character sets | |(CVE-2020-27618) Alias| |CVE-2020-27618 CC| |siddhesh at sourceware dot org -- You are receiving this mail because: You are on the CC list for the bug. ^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug locale/26224] iconv hangs when converting some invalid inputs from several IBM character sets (CVE-2020-27618) 2020-07-09 20:21 [Bug locale/26224] New: iconv hangs when converting some invalid inputs from several IBM character sets arjun.is at lostca dot se ` (3 preceding siblings ...) 2020-10-22 7:55 ` [Bug locale/26224] iconv hangs when converting some invalid inputs from several IBM character sets (CVE-2020-27618) siddhesh at sourceware dot org @ 2020-11-06 2:19 ` siddhesh at sourceware dot org 4 siblings, 0 replies; 6+ messages in thread From: siddhesh at sourceware dot org @ 2020-11-06 2:19 UTC (permalink / raw) To: glibc-bugs https://sourceware.org/bugzilla/show_bug.cgi?id=26224 Siddhesh Poyarekar <siddhesh at sourceware dot org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|NEW |RESOLVED Target Milestone|--- |2.33 --- Comment #1 from Siddhesh Poyarekar <siddhesh at sourceware dot org> --- Fixed by: commit 9a99c682144bdbd40792ebf822fe9264e0376fb5 Author: Arjun Shankar <arjun@redhat.com> Date: Wed Nov 4 12:19:38 2020 +0100 iconv: Accept redundant shift sequences in IBM1364 [BZ #26224] The IBM1364, IBM1371, IBM1388, IBM1390 and IBM1399 character sets share converter logic (iconvdata/ibm1364.c) which would reject redundant shift sequences when processing input in these character sets. This led to a hang in the iconv program (CVE-2020-27618). This commit adjusts the converter to ignore redundant shift sequences and adds test cases for iconv_prog hangs that would be triggered upon their rejection. This brings the implementation in line with other converters that also ignore redundant shift sequences (e.g. IBM930 etc., fixed in commit 692de4b3960d). Reviewed-by: Carlos O'Donell <carlos@redhat.com> -- You are receiving this mail because: You are on the CC list for the bug. ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-11-06 2:19 UTC | newest] Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2020-07-09 20:21 [Bug locale/26224] New: iconv hangs when converting some invalid inputs from several IBM character sets arjun.is at lostca dot se 2020-07-09 20:22 ` [Bug locale/26224] " arjun.is at lostca dot se 2020-07-09 20:27 ` fweimer at redhat dot com 2020-07-09 20:43 ` fweimer at redhat dot com 2020-10-22 7:55 ` [Bug locale/26224] iconv hangs when converting some invalid inputs from several IBM character sets (CVE-2020-27618) siddhesh at sourceware dot org 2020-11-06 2:19 ` siddhesh at sourceware dot org
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).