[Bug libc/28524] Conversion from ISO-2022-JP-3 with iconv may emit spurious NUL character on state reset

["fweimer at redhat dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=28524

--- Comment #6 from Florian Weimer <fweimer at redhat dot com> ---
(In reply to Nikita Popov from comment #4)
> "the bug cannot be invoked through user input and requires iconv to be
> invoked with NULL inbuf"
> I never claimed opposite. I mentioned "certain use patterns" where reset
> operation on iconv state should ensue. But, considering the importance of
> the GLIBC project, I believe the issue in question is worth fixing.

Just to provide some context: We are trying to explain here why this isn't a
*security* bug (it has been flagged as a security issue elsewhere, presumably
by accident because it was a regression introduced by a security fix). Of
course it's a bug, and thank you for reporting and fixing it!

Without concrete evidence of application impact, I think this bug is just glibc
computing an incorrect result. Any bug could theoretically introduce an
application vulnerability, but we have to draw a line somewhere because
otherwise the distinction between security and non-security bugs becomes
meaningless.

As far as I understand it, this issue can only occur if the input sequence does
not return to the initial shift state, which is already partially corrupted. 
Otherwise there isn't any work left to do for the do_flush case in
iconv/skeleton.c, and the bug does not materialize at all.

-- 
You are receiving this mail because:
You are on the CC list for the bug.