diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-06-23 16:05:31 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-06-30 17:00:23 +0000 |
| commit | 8bc3abb7d71eebe6819af1e61640067733e596dc (patch) | |
| tree | 3a6bfc91778ac4c93577bf3cba2888eb699ca8ea | |
| parent | 2ee2274244e7f09a7bd04d1aaf9b04dfa678921a (diff) | |
iconv: Fix a buffer overflow in the HZ encoding
wcrtomb may store up to 2 2-byte escape sequences to the state buffer in
addition to the character itself. In the worst case, a 3-byte heap
overflow is possible.
Approved by: so
Security: FreeBSD-SA-26:49.iconv
Security: CVE-2026-58081
Reviewed by: kevans
Differential Revision: https://reviews.freebsd.org/D57949
| -rw-r--r-- | lib/libiconv_modules/HZ/citrus_hz.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/libiconv_modules/HZ/citrus_hz.c b/lib/libiconv_modules/HZ/citrus_hz.c index db738b8f812e..e16ab3a8e34c 100644 --- a/lib/libiconv_modules/HZ/citrus_hz.c +++ b/lib/libiconv_modules/HZ/citrus_hz.c @@ -132,7 +132,7 @@ typedef struct { typedef struct { escape_t *inuse; int chlen; - char ch[ROWCOL_MAX]; + char ch[4 + ROWCOL_MAX]; } _HZState; #define _CEI_TO_EI(_cei_) (&(_cei_)->ei) |