Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
Merge branch 'fix-os-6770' into 'master'
[iconv] Fix CVE-2020-27618. Contributes to JB#54165 See merge request mer-core/glibc!41
- Loading branch information
Showing
2 changed files
with
58 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,55 @@ | ||
From 9a99c682144bdbd40792ebf822fe9264e0376fb5 Mon Sep 17 00:00:00 2001 | ||
From: Arjun Shankar <arjun@redhat.com> | ||
Date: Wed, 4 Nov 2020 12:19:38 +0100 | ||
Subject: [PATCH] iconv: Accept redundant shift sequences in IBM1364 [BZ | ||
#26224] | ||
|
||
The IBM1364, IBM1371, IBM1388, IBM1390 and IBM1399 character sets | ||
share converter logic (iconvdata/ibm1364.c) which would reject | ||
redundant shift sequences when processing input in these character | ||
sets. This led to a hang in the iconv program (CVE-2020-27618). | ||
|
||
This commit adjusts the converter to ignore redundant shift sequences | ||
and adds test cases for iconv_prog hangs that would be triggered upon | ||
their rejection. This brings the implementation in line with other | ||
converters that also ignore redundant shift sequences (e.g. IBM930 | ||
etc., fixed in commit 692de4b3960d). | ||
|
||
Reviewed-by: Carlos O'Donell <carlos@redhat.com> | ||
--- | ||
iconvdata/ibm1364.c | 14 ++------------ | ||
|
||
diff --git a/iconvdata/ibm1364.c b/iconvdata/ibm1364.c | ||
index 49e7267ab4..521f0825b7 100644 | ||
--- a/iconvdata/ibm1364.c | ||
+++ b/iconvdata/ibm1364.c | ||
@@ -158,24 +158,14 @@ enum | ||
\ | ||
if (__builtin_expect (ch, 0) == SO) \ | ||
{ \ | ||
- /* Shift OUT, change to DBCS converter. */ \ | ||
- if (curcs == db) \ | ||
- { \ | ||
- result = __GCONV_ILLEGAL_INPUT; \ | ||
- break; \ | ||
- } \ | ||
+ /* Shift OUT, change to DBCS converter (redundant escape okay). */ \ | ||
curcs = db; \ | ||
++inptr; \ | ||
continue; \ | ||
} \ | ||
if (__builtin_expect (ch, 0) == SI) \ | ||
{ \ | ||
- /* Shift IN, change to SBCS converter. */ \ | ||
- if (curcs == sb) \ | ||
- { \ | ||
- result = __GCONV_ILLEGAL_INPUT; \ | ||
- break; \ | ||
- } \ | ||
+ /* Shift IN, change to SBCS converter (redundant escape okay). */ \ | ||
curcs = sb; \ | ||
++inptr; \ | ||
continue; \ | ||
-- | ||
2.27.0 | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters