mirror/glibc
2
0
Fork 0
mirror of git://sourceware.org/git/glibc.git synced 2025-03-31 14:01:18 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix buffer overrun in EUC-KR conversion module (bz #24973)

Browse Source 
The byte 0xfe as input to the EUC-KR conversion denotes a user-defined
area and is not allowed.  The from_euc_kr function used to skip two bytes
when told to skip over the unknown designation, potentially running over
the buffer end.

(cherry picked from commit ee7a3144c9922808181009b7b3e50e852fb4999b)
This commit is contained in:
Andreas Schwab 2021-01-06 11:03:44 +05:30 committed by Siddhesh Poyarekar
parent 1d49bede4d
commit 0d9793e82a
4 changed files with 59 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
iconvdata/Makefile
View File

@ -73,7 +73,8 @@ modules.so := $(addsuffix .so, $(modules))
ifeq (yes,$(build-shared))
tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \
tst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \
bug-iconv10 bug-iconv11 bug-iconv12 tst-iconv-big5-hkscs-to-2ucs4
bug-iconv10 bug-iconv11 bug-iconv12 tst-iconv-big5-hkscs-to-2ucs4 \
bug-iconv13
ifeq ($(have-thread-library),yes)
tests += bug-iconv3
endif

53
iconvdata/bug-iconv13.c Normal file
View File

@ -0,0 +1,53 @@
/* bug 24973: Test EUC-KR module
Copyright (C) 2020 Free Software Foundation, Inc.
This file is part of the GNU C Library.
The GNU C Library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
The GNU C Library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with the GNU C Library; if not, see
<https://www.gnu.org/licenses/>. */
#include <errno.h>
#include <iconv.h>
#include <stdio.h>
#include <support/check.h>
static int
do_test (void)
{
iconv_t cd = iconv_open ("UTF-8//IGNORE", "EUC-KR");
TEST_VERIFY_EXIT (cd != (iconv_t) -1);
/* 0xfe (->0x7e : row 94) and 0xc9 (->0x49 : row 41) are user-defined
areas, which are not allowed and should be skipped over due to
//IGNORE. The trailing 0xfe also is an incomplete sequence, which
should be checked first. */
char input[4] = { '\xc9', '\xa1', '\0', '\xfe' };
char *inptr = input;
size_t insize = sizeof (input);
char output[4];
char *outptr = output;
size_t outsize = sizeof (output);
/* This used to crash due to buffer overrun. */
TEST_VERIFY (iconv (cd, &inptr, &insize, &outptr, &outsize) == (size_t) -1);
TEST_VERIFY (errno == EINVAL);
/* The conversion should produce one character, the converted null
character. */
TEST_VERIFY (sizeof (output) - outsize == 1);
TEST_VERIFY_EXIT (iconv_close (cd) != -1);
return 0;
}
#include <support/test-driver.c>

6
iconvdata/euc-kr.c
View File

@ -80,11 +80,7 @@ euckr_from_ucs4 (uint32_t ch, unsigned char *cp)
\
if (ch <= 0x9f) \
++inptr; \
/* 0xfe(->0x7e : row 94) and 0xc9(->0x59 : row 41) are \
user-defined areas. */ \
else if (__builtin_expect (ch == 0xa0, 0) \
|| __builtin_expect (ch > 0xfe, 0) \
|| __builtin_expect (ch == 0xc9, 0)) \
else if (__glibc_unlikely (ch == 0xa0)) \
{ \
/* This is illegal. */ \
STANDARD_FROM_LOOP_ERR_HANDLER (1); \

6
iconvdata/ksc5601.h
View File

@ -50,15 +50,15 @@ ksc5601_to_ucs4 (const unsigned char **s, size_t avail, unsigned char offset)
unsigned char ch2;
int idx;
if (avail < 2)
return 0;
/* row 94(0x7e) and row 41(0x49) are user-defined area in KS C 5601 */
if (ch < offset || (ch - offset) <= 0x20 || (ch - offset) >= 0x7e
|| (ch - offset) == 0x49)
return __UNKNOWN_10646_CHAR;
if (avail < 2)
return 0;
ch2 = (*s)[1];
if (ch2 < offset || (ch2 - offset) <= 0x20 || (ch2 - offset) >= 0x7f)
return __UNKNOWN_10646_CHAR;