authorgravatar for alex@alexrp.comAlex Rønne Petersen <alex@alexrp.com> 2025-02-14 00:50:16+01:00
committergravatar for alex@alexrp.comAlex Rønne Petersen <alex@alexrp.com> 2025-02-14 06:42:57+01:00
log8a3aebaee0a68d037a6f311bc5c1b426e8e1884c
tree203f87ae9dae83b676df7e3a81156f5a1e9c525f
parent462d26171ba1c7f5174aa08f5c2054a0a8035bac

musl: Apply Rich Felker's CVE-2025-26519 mitigation patches.

https://www.openwall.com/lists/oss-security/2025/02/13/2 Closes #22883.

1 files changed, 5 insertions(+), 1 deletions(-)

lib/libc/musl/src/locale/iconv.c+5-1
...@@ -495,7 +495,7 @@ size_t iconv(iconv_t cd, char **restrict in, size_t *restrict inb, char **restri...@@ -495,7 +495,7 @@ size_t iconv(iconv_t cd, char **restrict in, size_t *restrict inb, char **restri
495 if (c >= 93 || d >= 94) {495 if (c >= 93 || d >= 94) {
496 c += (0xa1-0x81);496 c += (0xa1-0x81);
497 d += 0xa1;497 d += 0xa1;
498 if (c >= 93 || c>=0xc6-0x81 && d>0x52)498 if (c > 0xc6-0x81 || c==0xc6-0x81 && d>0x52)
499 goto ilseq;499 goto ilseq;
500 if (d-'A'<26) d = d-'A';500 if (d-'A'<26) d = d-'A';
501 else if (d-'a'<26) d = d-'a'+26;501 else if (d-'a'<26) d = d-'a'+26;
...@@ -538,6 +538,10 @@ size_t iconv(iconv_t cd, char **restrict in, size_t *restrict inb, char **restri...@@ -538,6 +538,10 @@ size_t iconv(iconv_t cd, char **restrict in, size_t *restrict inb, char **restri
538 if (*outb < k) goto toobig;538 if (*outb < k) goto toobig;
539 memcpy(*out, tmp, k);539 memcpy(*out, tmp, k);
540 } else k = wctomb_utf8(*out, c);540 } else k = wctomb_utf8(*out, c);
541 /* This failure condition should be unreachable, but
542 * is included to prevent decoder bugs from translating
543 * into advancement outside the output buffer range. */
544 if (k>4) goto ilseq;
541 *out += k;545 *out += k;
542 *outb -= k;546 *outb -= k;
543 break;547 break;