forked from pool/glibc
Andreas Schwab
71ba03d4de
- aarch64-static-pie.patch: fix static PIE start code for BTI (bsc#1179450, BZ #27068) - iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224) - iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop bounds (CVE-2020-29562, bsc#1179694, BZ #26923) - printf-long-double-non-normal.patch: x86: Harden printf against non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649) - get-nprocs-cpu-online-parsing.patch: Fix parsing of /sys/devices/system/cpu/online (bsc#1180038, BZ #25859) OBS-URL: https://build.opensuse.org/request/show/856525 OBS-URL: https://build.opensuse.org/package/show/Base:System/glibc?expand=0&rev=574
83 lines
3.1 KiB
Diff
83 lines
3.1 KiB
Diff
From 9a99c682144bdbd40792ebf822fe9264e0376fb5 Mon Sep 17 00:00:00 2001
|
|
From: Arjun Shankar <arjun@redhat.com>
|
|
Date: Wed, 4 Nov 2020 12:19:38 +0100
|
|
Subject: [PATCH] iconv: Accept redundant shift sequences in IBM1364 [BZ
|
|
#26224]
|
|
|
|
The IBM1364, IBM1371, IBM1388, IBM1390 and IBM1399 character sets
|
|
share converter logic (iconvdata/ibm1364.c) which would reject
|
|
redundant shift sequences when processing input in these character
|
|
sets. This led to a hang in the iconv program (CVE-2020-27618).
|
|
|
|
This commit adjusts the converter to ignore redundant shift sequences
|
|
and adds test cases for iconv_prog hangs that would be triggered upon
|
|
their rejection. This brings the implementation in line with other
|
|
converters that also ignore redundant shift sequences (e.g. IBM930
|
|
etc., fixed in commit 692de4b3960d).
|
|
|
|
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
|
|
---
|
|
NEWS | 4 +++-
|
|
iconv/tst-iconv_prog.sh | 16 ++++++++++------
|
|
iconvdata/ibm1364.c | 14 ++------------
|
|
3 files changed, 15 insertions(+), 19 deletions(-)
|
|
|
|
Index: glibc-2.32/iconv/tst-iconv_prog.sh
|
|
===================================================================
|
|
--- glibc-2.32.orig/iconv/tst-iconv_prog.sh
|
|
+++ glibc-2.32/iconv/tst-iconv_prog.sh
|
|
@@ -102,12 +102,16 @@ hangarray=(
|
|
"\x00\x80;-c;IBM1161;UTF-8//TRANSLIT//IGNORE"
|
|
"\x00\xdb;-c;IBM1162;UTF-8//TRANSLIT//IGNORE"
|
|
"\x00\x70;-c;IBM12712;UTF-8//TRANSLIT//IGNORE"
|
|
-# These are known hangs that are yet to be fixed:
|
|
-# "\x00\x0f;-c;IBM1364;UTF-8"
|
|
-# "\x00\x0f;-c;IBM1371;UTF-8"
|
|
-# "\x00\x0f;-c;IBM1388;UTF-8"
|
|
-# "\x00\x0f;-c;IBM1390;UTF-8"
|
|
-# "\x00\x0f;-c;IBM1399;UTF-8"
|
|
+"\x00\x0f;-c;IBM1364;UTF-8"
|
|
+"\x0e\x0e;-c;IBM1364;UTF-8"
|
|
+"\x00\x0f;-c;IBM1371;UTF-8"
|
|
+"\x0e\x0e;-c;IBM1371;UTF-8"
|
|
+"\x00\x0f;-c;IBM1388;UTF-8"
|
|
+"\x0e\x0e;-c;IBM1388;UTF-8"
|
|
+"\x00\x0f;-c;IBM1390;UTF-8"
|
|
+"\x0e\x0e;-c;IBM1390;UTF-8"
|
|
+"\x00\x0f;-c;IBM1399;UTF-8"
|
|
+"\x0e\x0e;-c;IBM1399;UTF-8"
|
|
"\x00\x53;-c;IBM16804;UTF-8//TRANSLIT//IGNORE"
|
|
"\x00\x41;-c;IBM274;UTF-8//TRANSLIT//IGNORE"
|
|
"\x00\x41;-c;IBM275;UTF-8//TRANSLIT//IGNORE"
|
|
Index: glibc-2.32/iconvdata/ibm1364.c
|
|
===================================================================
|
|
--- glibc-2.32.orig/iconvdata/ibm1364.c
|
|
+++ glibc-2.32/iconvdata/ibm1364.c
|
|
@@ -158,24 +158,14 @@ enum
|
|
\
|
|
if (__builtin_expect (ch, 0) == SO) \
|
|
{ \
|
|
- /* Shift OUT, change to DBCS converter. */ \
|
|
- if (curcs == db) \
|
|
- { \
|
|
- result = __GCONV_ILLEGAL_INPUT; \
|
|
- break; \
|
|
- } \
|
|
+ /* Shift OUT, change to DBCS converter (redundant escape okay). */ \
|
|
curcs = db; \
|
|
++inptr; \
|
|
continue; \
|
|
} \
|
|
if (__builtin_expect (ch, 0) == SI) \
|
|
{ \
|
|
- /* Shift IN, change to SBCS converter. */ \
|
|
- if (curcs == sb) \
|
|
- { \
|
|
- result = __GCONV_ILLEGAL_INPUT; \
|
|
- break; \
|
|
- } \
|
|
+ /* Shift IN, change to SBCS converter (redundant escape okay). */ \
|
|
curcs = sb; \
|
|
++inptr; \
|
|
continue; \
|