public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug locale/26224] New: iconv hangs when converting some invalid inputs from several IBM character sets
@ 2020-07-09 20:21 arjun.is at lostca dot se
2020-07-09 20:22 ` [Bug locale/26224] " arjun.is at lostca dot se
` (4 more replies)
0 siblings, 5 replies; 6+ messages in thread
From: arjun.is at lostca dot se @ 2020-07-09 20:21 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=26224
Bug ID: 26224
Summary: iconv hangs when converting some invalid inputs from
several IBM character sets
Product: glibc
Version: unspecified
Status: NEW
Severity: normal
Priority: P2
Component: locale
Assignee: unassigned at sourceware dot org
Reporter: arjun.is at lostca dot se
Target Milestone: ---
I found the following hangs when running an iconv input fuzzer I wrote while
trying to fix bug 19519. The hangs are present in master:
echo -en '\x00\x0f' | iconv -t UTF-8 -c -f IBM1364
echo -en '\x00\x0f' | iconv -t UTF-8 -c -f IBM1371
echo -en '\x00\x0f' | iconv -t UTF-8 -c -f IBM1388
echo -en '\x00\x0f' | iconv -t UTF-8 -c -f IBM1390
echo -en '\x00\x0f' | iconv -t UTF-8 -c -f IBM1399
These hangs are presently mentioned but commented out in
iconv/tst-iconv_prog.sh and should eventually be un-commented when this bug is
fixed.
The fuzzer itself (attachment 11786) should also be run against these character
sets after this bug is fixed, because they skip all remaining inputs for a
character set once they encounter a hang in the corresponding converter, and
thus any other hangs (from possibly other bugs) aren't tested for.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug locale/26224] iconv hangs when converting some invalid inputs from several IBM character sets
2020-07-09 20:21 [Bug locale/26224] New: iconv hangs when converting some invalid inputs from several IBM character sets arjun.is at lostca dot se
@ 2020-07-09 20:22 ` arjun.is at lostca dot se
2020-07-09 20:27 ` fweimer at redhat dot com
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: arjun.is at lostca dot se @ 2020-07-09 20:22 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=26224
Arjun Shankar <arjun.is at lostca dot se> changed:
What |Removed |Added
----------------------------------------------------------------------------
Assignee|unassigned at sourceware dot org |arjun.is at lostca dot se
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug locale/26224] iconv hangs when converting some invalid inputs from several IBM character sets
2020-07-09 20:21 [Bug locale/26224] New: iconv hangs when converting some invalid inputs from several IBM character sets arjun.is at lostca dot se
2020-07-09 20:22 ` [Bug locale/26224] " arjun.is at lostca dot se
@ 2020-07-09 20:27 ` fweimer at redhat dot com
2020-07-09 20:43 ` fweimer at redhat dot com
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: fweimer at redhat dot com @ 2020-07-09 20:27 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=26224
Florian Weimer <fweimer at redhat dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags| |security+
CC| |fweimer at redhat dot com
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug locale/26224] iconv hangs when converting some invalid inputs from several IBM character sets
2020-07-09 20:21 [Bug locale/26224] New: iconv hangs when converting some invalid inputs from several IBM character sets arjun.is at lostca dot se
2020-07-09 20:22 ` [Bug locale/26224] " arjun.is at lostca dot se
2020-07-09 20:27 ` fweimer at redhat dot com
@ 2020-07-09 20:43 ` fweimer at redhat dot com
2020-10-22 7:55 ` [Bug locale/26224] iconv hangs when converting some invalid inputs from several IBM character sets (CVE-2020-27618) siddhesh at sourceware dot org
2020-11-06 2:19 ` siddhesh at sourceware dot org
4 siblings, 0 replies; 6+ messages in thread
From: fweimer at redhat dot com @ 2020-07-09 20:43 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=26224
Florian Weimer <fweimer at redhat dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
See Also| |https://sourceware.org/bugz
| |illa/show_bug.cgi?id=19519
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug locale/26224] iconv hangs when converting some invalid inputs from several IBM character sets (CVE-2020-27618)
2020-07-09 20:21 [Bug locale/26224] New: iconv hangs when converting some invalid inputs from several IBM character sets arjun.is at lostca dot se
` (2 preceding siblings ...)
2020-07-09 20:43 ` fweimer at redhat dot com
@ 2020-10-22 7:55 ` siddhesh at sourceware dot org
2020-11-06 2:19 ` siddhesh at sourceware dot org
4 siblings, 0 replies; 6+ messages in thread
From: siddhesh at sourceware dot org @ 2020-10-22 7:55 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=26224
Siddhesh Poyarekar <siddhesh at sourceware dot org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|iconv hangs when converting |iconv hangs when converting
|some invalid inputs from |some invalid inputs from
|several IBM character sets |several IBM character sets
| |(CVE-2020-27618)
Alias| |CVE-2020-27618
CC| |siddhesh at sourceware dot org
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug locale/26224] iconv hangs when converting some invalid inputs from several IBM character sets (CVE-2020-27618)
2020-07-09 20:21 [Bug locale/26224] New: iconv hangs when converting some invalid inputs from several IBM character sets arjun.is at lostca dot se
` (3 preceding siblings ...)
2020-10-22 7:55 ` [Bug locale/26224] iconv hangs when converting some invalid inputs from several IBM character sets (CVE-2020-27618) siddhesh at sourceware dot org
@ 2020-11-06 2:19 ` siddhesh at sourceware dot org
4 siblings, 0 replies; 6+ messages in thread
From: siddhesh at sourceware dot org @ 2020-11-06 2:19 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=26224
Siddhesh Poyarekar <siddhesh at sourceware dot org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |FIXED
Status|NEW |RESOLVED
Target Milestone|--- |2.33
--- Comment #1 from Siddhesh Poyarekar <siddhesh at sourceware dot org> ---
Fixed by:
commit 9a99c682144bdbd40792ebf822fe9264e0376fb5
Author: Arjun Shankar <arjun@redhat.com>
Date: Wed Nov 4 12:19:38 2020 +0100
iconv: Accept redundant shift sequences in IBM1364 [BZ #26224]
The IBM1364, IBM1371, IBM1388, IBM1390 and IBM1399 character sets
share converter logic (iconvdata/ibm1364.c) which would reject
redundant shift sequences when processing input in these character
sets. This led to a hang in the iconv program (CVE-2020-27618).
This commit adjusts the converter to ignore redundant shift sequences
and adds test cases for iconv_prog hangs that would be triggered upon
their rejection. This brings the implementation in line with other
converters that also ignore redundant shift sequences (e.g. IBM930
etc., fixed in commit 692de4b3960d).
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-11-06 2:19 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-09 20:21 [Bug locale/26224] New: iconv hangs when converting some invalid inputs from several IBM character sets arjun.is at lostca dot se
2020-07-09 20:22 ` [Bug locale/26224] " arjun.is at lostca dot se
2020-07-09 20:27 ` fweimer at redhat dot com
2020-07-09 20:43 ` fweimer at redhat dot com
2020-10-22 7:55 ` [Bug locale/26224] iconv hangs when converting some invalid inputs from several IBM character sets (CVE-2020-27618) siddhesh at sourceware dot org
2020-11-06 2:19 ` siddhesh at sourceware dot org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).