Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 27 Sep 2013 01:54:42 -0700
From: Michael Forney <>
Subject: [PATCH] mbsrtowcs: Fix bug when wn is a multiple of 4

If wn becomes 0 after processing a chunk of 4, mbsrtowcs currently
continues on, wrapping wn around to -1, causing the rest of the string
to be processed.

This resulted in buffer overruns if there was only space in ws for wn
wide characters.

I found this bug while tracking down a SIGSEGV in bash when globbing a large

 src/multibyte/mbsrtowcs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/multibyte/mbsrtowcs.c b/src/multibyte/mbsrtowcs.c
index b9bbc33..c5a30de 100644
--- a/src/multibyte/mbsrtowcs.c
+++ b/src/multibyte/mbsrtowcs.c
@@ -66,6 +66,7 @@ resume0:
 				*ws++ = *s++;
 				wn -= 4;
+			if (!wn) continue;
 		if (*s-1u < 0x7f) {
 			*ws++ = *s++;

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.