iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE...
authorCharles Fol <folcharles@gmail.com>
Thu, 28 Mar 2024 15:25:38 +0000 (12:25 -0300)
committerAdrian Bunk <bunk@debian.org>
Sat, 29 Jun 2024 10:27:34 +0000 (13:27 +0300)
commitb4c621fa3af1e5400e5b6d33e88f8b8853a7ad8e
treeb7a7aa6445894576d44dff115ef57de65ecbc806
parenta0727aab0c3eed398b18a536f1c8d0539b4b533c
iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961)

ISO-2022-CN-EXT uses escape sequences to indicate character set changes
(as specified by RFC 1922).  While the SOdesignation has the expected
bounds checks, neither SS2designation nor SS3designation have its;
allowing a write overflow of 1, 2, or 3 bytes with fixed values:
'$+I', '$+J', '$+K', '$+L', '$+M', or '$*H'.

Checked on aarch64-linux-gnu.

Co-authored-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Tested-by: Carlos O'Donell <carlos@redhat.com>
Gbp-Pq: Topic all
Gbp-Pq: Name git-0001-iconv-ISO-2022-CN-EXT-fix-out-of-bound-writes-when-w.patch
iconvdata/Makefile
iconvdata/iso-2022-cn-ext.c
iconvdata/tst-iconv-iso-2022-cn-ext.c [new file with mode: 0644]