From patchwork Fri Aug 21 12:37:08 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Weimer X-Patchwork-Id: 141916 X-Patchwork-Delegate: carlos@redhat.com Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 118744BB1C04 for ; Fri, 21 Aug 2026 12:37:48 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 118744BB1C04 Authentication-Results: sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=VSS5KD2w X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTP id 355F04BA9008 for ; Fri, 21 Aug 2026 12:37:16 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 355F04BA9008 Authentication-Results: sourceware.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 355F04BA9008 Authentication-Results: sourceware.org; arc=none smtp.remote-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787315836; cv=none; b=Gts+N8Oi6K50QPBhymywQteEZ0gzVql6s+dXCuM/Pc/h9oy5ugMqBeCkdUrl8Fzk6FIF/uQgtbfZ3p4UmGfo2rvZYoQuJk8vkLYPKoIZVtDCXkRwvUBfduBflQB55HsfU5haux/IFPQjD4xRiH/gUdSRT63Fa8m2nWj2WMZrADk= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787315836; c=relaxed/simple; bh=2BQ8TgMbO9pnslOZJxrb3e8T1jc6amrPFHBdZTnRAGA=; h=DKIM-Signature:From:To:Subject:Message-ID:Date:MIME-Version; b=nUj6SrR1vdTZ4n0iliMJwY+jn8QO9FTxE+yaLIysQixcda9FYW2Q7kWtrkbsgmO+vO7WW4YymfQXPdtJ7zM4rkUi7It6qpkOY40xPQ1g3T8bqGrm06yotuNCANwHYbcXdLcJFEiDkb8/SEnbnfKyEkZeQHh4/yg6/TIadUQyipk= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=VSS5KD2w DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 355F04BA9008 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1787315835; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type; bh=NUQiTfw8kCv+3qakF3QA7P0zom18kymz93ezfk9OsIs=; b=VSS5KD2w/7MC1lPG9G8xQ5jRD8e9FAU+sSr/wiERXROG4WDa+1gDhoCcIkOkFLVKHcF7Jj FVrpNr8CYzellOpA/32+vKa2AtmdVRWwjd9jLYjYXiqX36liLPH/dcUJLUdDYG4bXphKKu /3Xw+Q9WzbEvx4XoNRPHd+H/ew6myrI= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-184-GjGxrpBiN06Xz_WVHqm0hQ-1; Fri, 21 Aug 2026 08:37:11 -0400 X-MC-Unique: GjGxrpBiN06Xz_WVHqm0hQ-1 X-Mimecast-MFC-AGG-ID: GjGxrpBiN06Xz_WVHqm0hQ_1787315830 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id D2F831955DAA for ; Fri, 21 Aug 2026 12:37:10 +0000 (UTC) Received: from fweimer-thinkpadp1gen4i.stuttmso.csb (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 431CD423 for ; Fri, 21 Aug 2026 12:37:10 +0000 (UTC) From: Florian Weimer To: libc-alpha@sourceware.org Subject: [PATCH v2 1/2] iconvdata: JISX0213 decoding lacks pending character reset (CVE-2026-77117) Message-ID: <786cdc01ff46194a1cc464aa23f80075a9a31c65.1787315777.git.fweimer@redhat.com> X-From-Line: 786cdc01ff46194a1cc464aa23f80075a9a31c65 Mon Sep 17 00:00:00 2001 Date: Fri, 21 Aug 2026 14:37:08 +0200 User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: YGNu9KeQM98ba3Y05I-yD8pOhQjKADS5moWQC9Mc_1E_1787315830 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-9.4 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL, RCVD_IN_SBL_CSS, SPF_HELO_PASS, SPF_NONE, TXREP shortcircuit=no autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces~patchwork=sourceware.org@sourceware.org This fixes bug 34556. --- v2: Also fix the EUC bug (which was not mentioned in the AISLE report). iconvdata/euc-jisx0213.c | 3 +++ iconvdata/shift_jisx0213.c | 3 +++ 2 files changed, 6 insertions(+) base-commit: 6467136459cc86a4426e35ac8d8f9de4673b9f1f diff --git a/iconvdata/euc-jisx0213.c b/iconvdata/euc-jisx0213.c index 5572bbdb7b..61c22231e1 100644 --- a/iconvdata/euc-jisx0213.c +++ b/iconvdata/euc-jisx0213.c @@ -224,6 +224,9 @@ STANDARD_FROM_LOOP_ERR_HANDLER (1); \ } \ } \ + else \ + /* There was a pending character. Clear it. */ \ + *statep = 0; \ \ put32 (outptr, ch); \ outptr += 4; \ diff --git a/iconvdata/shift_jisx0213.c b/iconvdata/shift_jisx0213.c index 61c9c3ce6d..e9179f605e 100644 --- a/iconvdata/shift_jisx0213.c +++ b/iconvdata/shift_jisx0213.c @@ -226,6 +226,9 @@ STANDARD_FROM_LOOP_ERR_HANDLER (1); \ } \ } \ + else \ + /* There was a pending character. Clear it. */ \ + *statep = 0; \ \ put32 (outptr, ch); \ outptr += 4; \ From patchwork Fri Aug 21 12:37:23 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Weimer X-Patchwork-Id: 141917 X-Patchwork-Delegate: carlos@redhat.com Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 7E7F54BB1C38 for ; Fri, 21 Aug 2026 12:38:35 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 7E7F54BB1C38 Authentication-Results: sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=JSXJjppp X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTP id 4D0C34BA900F for ; Fri, 21 Aug 2026 12:37:49 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 4D0C34BA900F Authentication-Results: sourceware.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 4D0C34BA900F Authentication-Results: sourceware.org; arc=none smtp.remote-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787315869; cv=none; b=mjag8UQzcLwJSaOkeGDGJQ4iSmRvauU8ZKbEHvfuuDXtrabsJVhdJpWj3bwwOPpPneB7mcFxmiz3E6maz/EJ0WD9MiLwG8cb3YaNANFejG4lsq8VS5bkbUYV1PY5g8c/3/ZAeSkW+WoQVHpUZZsP+qRfLpF+GtggGRdL9+Zo82A= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787315869; c=relaxed/simple; bh=LIPaD2QbXnL0EBsxUaAG2YeyZYG33L0vASBgnKIBQZw=; h=DKIM-Signature:From:To:Subject:Message-ID:Date:MIME-Version; b=VXH+aupldAf+ogyax8jbdtoqGVWZneGpPv2w9RHGHdAvMZAnZ4VCSjq99fB1FPHZlrM8E2Un+GYnzTask7kCq9MRo1NaJOVauYb8NeCkbUo7OZDK7jcvPjSY3MfZDaTJ9tGwU9eKhHcuiIkUq79mGu7S8qHxd45E4t+fliPu774= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=JSXJjppp DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 4D0C34BA900F DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1787315868; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=0/ko/f3ov6pp+R7VcqeMfdtByEqnryDFKYth2fDmbds=; b=JSXJjpppi26+UwdXMiFXL91FrM54OPgFiSmroAFhDajdCzdL5yTz9q9WyurTUXbw4s7A3Y mWBA5BExe8sS3E6xPD8YkQpEnZDB7bTTrsf/YBXWY7+jWcAnlYqVWlLrT5hraTBydV3LDX IvgfuY8+WpO2zUfA6/rpXqd6DhV6oo4= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-84-zRK27N32OWmeP0ao6yiYMg-1; Fri, 21 Aug 2026 08:37:27 -0400 X-MC-Unique: zRK27N32OWmeP0ao6yiYMg-1 X-Mimecast-MFC-AGG-ID: zRK27N32OWmeP0ao6yiYMg_1787315846 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 7AB3218009E3 for ; Fri, 21 Aug 2026 12:37:26 +0000 (UTC) Received: from fweimer-thinkpadp1gen4i.stuttmso.csb (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id DE1691956056 for ; Fri, 21 Aug 2026 12:37:25 +0000 (UTC) From: Florian Weimer To: libc-alpha@sourceware.org Subject: [PATCH v2 2/2] iconvdata: Test case for bug 34556 In-Reply-To: <786cdc01ff46194a1cc464aa23f80075a9a31c65.1787315777.git.fweimer@redhat.com> Message-ID: References: <786cdc01ff46194a1cc464aa23f80075a9a31c65.1787315777.git.fweimer@redhat.com> X-From-Line: ce250b1710d79ff783f1cc463b86b4a6f0aa9d56 Mon Sep 17 00:00:00 2001 Date: Fri, 21 Aug 2026 14:37:23 +0200 User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: a6Dcx7NVk9vC0EEKtKHE6OK1JUW3ERwmudhnsgaDCeI_1787315846 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-10.7 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, KAM_NUMSUBJECT, KAM_SHORT, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL, SPF_HELO_PASS, SPF_NONE, TXREP shortcircuit=no autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces~patchwork=sourceware.org@sourceware.org Assisted-by: LLM --- v2: Also test the EUC bug variant. iconvdata/Makefile | 5 +- iconvdata/tst-jisx0213-progress.c | 123 ++++++++++++++++++++++++++++++ 2 files changed, 127 insertions(+), 1 deletion(-) create mode 100644 iconvdata/tst-jisx0213-progress.c diff --git a/iconvdata/Makefile b/iconvdata/Makefile index fbb0067302..ba2eec2b48 100644 --- a/iconvdata/Makefile +++ b/iconvdata/Makefile @@ -76,7 +76,8 @@ tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \ tst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \ bug-iconv10 bug-iconv11 bug-iconv12 tst-iconv-big5-hkscs-to-2ucs4 \ bug-iconv13 bug-iconv14 bug-iconv15 \ - tst-iconv-iso-2022-cn-ext tst-bug33980 + tst-iconv-iso-2022-cn-ext tst-bug33980 \ + tst-jisx0213-progress ifeq ($(have-thread-library),yes) tests += bug-iconv3 endif @@ -335,6 +336,8 @@ $(objpfx)tst-iconv-iso-2022-cn-ext.out: $(addprefix $(objpfx), $(gconv-modules)) $(addprefix $(objpfx),$(modules.so)) $(objpfx)tst-bug33980.out: $(addprefix $(objpfx), $(gconv-modules)) \ $(addprefix $(objpfx),$(modules.so)) +$(objpfx)tst-jisx0213-progress.out: \ + $(addprefix $(objpfx), $(gconv-modules)) $(addprefix $(objpfx),$(modules.so)) $(objpfx)iconv-test.out: run-iconv-test.sh \ $(addprefix $(objpfx), $(gconv-modules)) \ diff --git a/iconvdata/tst-jisx0213-progress.c b/iconvdata/tst-jisx0213-progress.c new file mode 100644 index 0000000000..e568756cb3 --- /dev/null +++ b/iconvdata/tst-jisx0213-progress.c @@ -0,0 +1,123 @@ +/* Test JISX0213 combining character conversion progress (bug 34556). + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +/* Certain JISX0213 byte sequences map to a combining sequence: U+304B + (HIRAGANA LETTER KA) followed by U+309A (COMBINING SEMI-VOICED + SOUND MARK). When converting to internal encoding (actually + UTF-32) with a small output buffer, the first code point is emitted + and the second is queued in the converter state. This test + verifies that the queued code point is consumed exactly once on + retry, so that the conversion makes progress and terminates. */ + +#include +#include +#include +#include + +#include +#include + +static void +test_one (const char *charset, const char *input, size_t outbufsize) +{ + printf ("info: %s: testing output buffer size %zu\n", charset, outbufsize); + + /* Expected UTF-32 output. */ + static const wchar_t expected[] = { 0x304b, 0x309a, 'A' }; + + iconv_t cd = iconv_open ("WCHAR_T", charset); + TEST_VERIFY_EXIT (cd != (iconv_t) -1); + + char result[64]; + size_t result_len = 0; + + char *inptr = (char *) input; + size_t inleft = strlen (input); + + char outbuf[64]; + + int iterations = 0; + while (inleft > 0) + { + char *outptr = outbuf; + size_t outleft = outbufsize; + size_t inleft_before = inleft; + + size_t ret = iconv (cd, &inptr, &inleft, &outptr, &outleft); + size_t produced = outptr - outbuf; + + TEST_VERIFY_EXIT (result_len + produced <= sizeof (result)); + memcpy (result + result_len, outbuf, produced); + result_len += produced; + + if (ret == (size_t) -1 && errno == E2BIG) + { + if (produced == 0 && inleft == inleft_before) + { + /* Output buffer too small for a single code point. */ + TEST_VERIFY_EXIT (outbufsize < 4); + break; + } + /* Bound iterations to detect non-progress bugs. */ + if (++iterations < 10) + continue; + else + { + FAIL ("%s: no progress", charset); + goto out; + } + } + if (ret == (size_t) -1) + FAIL_EXIT1 ("outbufsize %zu: iconv: %m", outbufsize); + break; + } + + /* Flush pending converter state. */ + { + char *outptr = outbuf; + size_t outleft = outbufsize; + size_t ret = iconv (cd, NULL, NULL, &outptr, &outleft); + TEST_VERIFY (ret == 0); + size_t produced = outptr - outbuf; + memcpy (result + result_len, outbuf, produced); + result_len += produced; + } + + if (outbufsize >= 4) + { + TEST_COMPARE (inleft, 0); + TEST_COMPARE_BLOB (result, result_len, + expected, sizeof (expected)); + } + + out: + TEST_VERIFY_EXIT (iconv_close (cd) == 0); +} + +static int +do_test (void) +{ + for (size_t outbufsize = 1; outbufsize <= 16; outbufsize++) + { + test_one ("EUC-JISX0213", "\244\367A", outbufsize); + test_one ("SHIFT_JISX0213", "\202\365A", outbufsize); + } + return 0; +} + +#include