From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <sourceware-bugzilla@sourceware.org>
Received: by sourceware.org (Postfix, from userid 48)
 id 08AA23948A51; Mon,  7 Dec 2020 17:19:39 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 08AA23948A51
From: "siddhesh at sourceware dot org" <sourceware-bugzilla@sourceware.org>
To: glibc-bugs@sourceware.org
Subject: [Bug locale/26923] Assertion failure in iconv when converting
 invalid UCS4 (CVE-2020-29562)
Date: Mon, 07 Dec 2020 17:19:39 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: glibc
X-Bugzilla-Component: locale
X-Bugzilla-Version: 2.30
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: siddhesh at sourceware dot org
X-Bugzilla-Status: RESOLVED
X-Bugzilla-Resolution: FIXED
X-Bugzilla-Priority: P2
X-Bugzilla-Assigned-To: unassigned at sourceware dot org
X-Bugzilla-Target-Milestone: 2.33
X-Bugzilla-Flags: security+
X-Bugzilla-Changed-Fields: bug_status resolution target_milestone
Message-ID: <bug-26923-131-SQQ0h8oAzd@http.sourceware.org/bugzilla/>
In-Reply-To: <bug-26923-131@http.sourceware.org/bugzilla/>
References: <bug-26923-131@http.sourceware.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://sourceware.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: glibc-bugs@sourceware.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Glibc-bugs mailing list <glibc-bugs.sourceware.org>
List-Unsubscribe: <https://sourceware.org/mailman/options/glibc-bugs>,
 <mailto:glibc-bugs-request@sourceware.org?subject=unsubscribe>
List-Archive: <https://sourceware.org/pipermail/glibc-bugs/>
List-Help: <mailto:glibc-bugs-request@sourceware.org?subject=help>
List-Subscribe: <https://sourceware.org/mailman/listinfo/glibc-bugs>,
 <mailto:glibc-bugs-request@sourceware.org?subject=subscribe>
X-List-Received-Date: Mon, 07 Dec 2020 17:19:40 -0000

https://sourceware.org/bugzilla/show_bug.cgi?id=3D26923

Siddhesh Poyarekar <siddhesh at sourceware dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED
   Target Milestone|---                         |2.33

--- Comment #5 from Siddhesh Poyarekar <siddhesh at sourceware dot org> ---
Fixed in master.

commit 228edd356f03bf62dcf2b1335f25d43c602ee68d
Author: Michael Colavita <mcolavita@fb.com>
Date:   Thu Nov 19 11:44:40 2020 -0500

    iconv: Fix incorrect UCS4 inner loop bounds (BZ#26923)

    Previously, in UCS4 conversion routines we limit the number of
    characters we examine to the minimum of the number of characters in the
    input and the number of characters in the output. This is not the
    correct behavior when __GCONV_IGNORE_ERRORS is set, as we do not consume
    an output character when we skip a code unit. Instead, track the input
    and output pointers and terminate the loop when either reaches its
    limit.

    This resolves assertion failures when resetting the input buffer in a s=
tep
of
    iconv, which assumes that the input will be fully consumed given suffic=
ient
    output space.

--=20
You are receiving this mail because:
You are on the CC list for the bug.=