NetBSD Problem Report #59019
From riastradh@netbsd.org Tue Jan 21 18:28:12 2025
Return-Path: <riastradh@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
client-signature RSA-PSS (2048 bits) client-digest SHA256)
(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
by mollari.NetBSD.org (Postfix) with ESMTPS id 6A1631A923A
for <gnats-bugs@gnats.NetBSD.org>; Tue, 21 Jan 2025 18:28:12 +0000 (UTC)
Message-Id: <20250121182810.BB2B41A923B@mollari.NetBSD.org>
Date: Tue, 21 Jan 2025 18:28:10 +0000 (UTC)
From: Taylor R Campbell <riastradh@NetBSD.org>
Reply-To: Taylor R Campbell <riastradh@NetBSD.org>
To: gnats-bugs@NetBSD.org
Subject: various libiconv issues
X-Send-Pr-Version: 3.95
>Number: 59019
>Notify-List: wellnhofer@aevum.de
>Category: security
>Synopsis: various libiconv issues
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: security-officer
>State: closed
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Tue Jan 21 18:30:00 +0000 2025
>Closed-Date: Fri Jul 03 18:23:33 +0000 2026
>Last-Modified: Tue Jul 07 14:00:01 +0000 2026
>Originator: Nick Wellnhofer
>Release: current, 10, 9, ...
>Organization:
>Environment:
>Description:
1. unchecked null pointer dereference of `graphic' in
_citrus_HZ_mbrtowc_priv
2. unchecked out-of-bounds write in _citrus_ZW_wcrtomb_priv
3. unchecked out-of-bounds write in _citrus_VIQR_wcrtomb_priv
>How-To-Repeat:
1. printf '\x7e\x7b\x7e\x7e' | iconv -f HZ8 -t UTF-8
2.
#include <errno.h>
#include <iconv.h>
#include <stdio.h>
#include <string.h>
int main() {
iconv_t cd = iconv_open("ZW", "UTF-8");
if (cd == (iconv_t) -1) {
fprintf(stderr, "iconv_open failed\n");
return 1;
}
char inbuf[] = { 0x00, 0x7B };
char outbuf[20];
memset(outbuf, '_', sizeof(outbuf));
char *inptr = inbuf;
size_t insize = sizeof(inbuf);
char *outptr = outbuf;
/* Note that we set outsize to 0... */
size_t outsize = 0;
iconv(cd, &inptr, &insize, &outptr, &outsize);
/* ... but data is written to outbuf */
printf("%02X %02X %02X %02X %02X %02X %02X %02X\n",
outbuf[0], outbuf[1], outbuf[2], outbuf[3],
outbuf[4], outbuf[5], outbuf[6], outbuf[7]);
iconv_close(cd);
return 0;
}
3.
#include <iconv.h>
#include <stdio.h>
#include <string.h>
int main() {
iconv_t cd = iconv_open("VIQR", "UTF-8");
if (cd == (iconv_t) -1) {
fprintf(stderr, "iconv_open failed\n");
return 1;
}
char inbuf[] = { 0x4F, 0x7E };
char outbuf[20];
memset(outbuf, '_', sizeof(outbuf));
char *inptr = inbuf;
size_t insize = sizeof(inbuf);
char *outptr = outbuf;
/* Note that we set outsize to 2... */
size_t outsize = 2;
iconv(cd, &inptr, &insize, &outptr, &outsize);
/* ... but data is written to the third byte */
printf("%02X %02X %02X %02X %02X %02X %02X %02X\n",
outbuf[0], outbuf[1], outbuf[2], outbuf[3],
outbuf[4], outbuf[5], outbuf[6], outbuf[7]);
iconv_close(cd);
return 0;
}
>Fix:
Patch to FreeBSD, probably similar to what we have:
diff --git a/libiconv_modules/HZ/citrus_hz.c b/libiconv_modules/HZ/citrus_hz.c
index 3e057a4..0ac788a 100644
--- a/libiconv_modules/HZ/citrus_hz.c
+++ b/libiconv_modules/HZ/citrus_hz.c
@@ -243,6 +243,9 @@ _citrus_HZ_mbrtowc_priv(_HZEncodingInfo * __restrict ei,
return (EINVAL);
if (ch == ESCAPE_CHAR) {
++head;
+ /* Is this correct? */
+ if (graphic == NULL)
+ break;
} else if (ch == '\n') {
if (psenc->inuse != INIT0(ei))
break;
diff --git a/libiconv_modules/UTF7/citrus_utf7.c b/libiconv_modules/UTF7/citrus_utf7.c
index 0a8cbe9..f681f34 100644
--- a/libiconv_modules/UTF7/citrus_utf7.c
+++ b/libiconv_modules/UTF7/citrus_utf7.c
@@ -332,7 +332,7 @@ done:
static int
_citrus_UTF7_utf16tomb(_UTF7EncodingInfo * __restrict ei,
- char * __restrict s, size_t n __unused, uint16_t u16,
+ char * __restrict s, size_t n, uint16_t u16,
_UTF7State * __restrict psenc, size_t * __restrict nresult)
{
int bits, i;
@@ -343,14 +343,22 @@ _citrus_UTF7_utf16tomb(_UTF7EncodingInfo * __restrict ei,
if (ISSAFE(ei, u16)) {
if (psenc->mode) {
if (psenc->bits > 0) {
+ if (n < 3 + (u16 == BASE64_IN))
+ return (E2BIG);
bits = BASE64_BIT - psenc->bits;
i = (psenc->cache << bits) & BASE64_MAX;
psenc->ch[psenc->chlen++] = base64[i];
psenc->bits = psenc->cache = 0;
+ } else {
+ if (n < 2 + (u16 == BASE64_IN))
+ return (E2BIG);
}
if (u16 == BASE64_OUT || FINDLEN(ei, u16) >= 0)
psenc->ch[psenc->chlen++] = BASE64_OUT;
psenc->mode = 0;
+ } else {
+ if (n < 1 + (u16 == BASE64_IN))
+ return (E2BIG);
}
if (psenc->bits != 0)
return (EINVAL);
@@ -358,6 +366,9 @@ _citrus_UTF7_utf16tomb(_UTF7EncodingInfo * __restrict ei,
if (u16 == BASE64_IN)
psenc->ch[psenc->chlen++] = BASE64_OUT;
} else {
+ bits = UTF16_BIT + psenc->bits;
+ if (n < bits / BASE64_BIT + !psenc->mode)
+ return (E2BIG);
if (!psenc->mode) {
if (psenc->bits > 0)
return (EINVAL);
@@ -365,7 +376,6 @@ _citrus_UTF7_utf16tomb(_UTF7EncodingInfo * __restrict ei,
psenc->mode = 1;
}
psenc->cache = (psenc->cache << UTF16_BIT) | u16;
- bits = UTF16_BIT + psenc->bits;
psenc->bits = bits % BASE64_BIT;
while ((bits -= BASE64_BIT) >= 0) {
i = (psenc->cache >> bits) & BASE64_MAX;
diff --git a/libiconv_modules/VIQR/citrus_viqr.c b/libiconv_modules/VIQR/citrus_viqr.c
index a6bc5e7..052acbf 100644
--- a/libiconv_modules/VIQR/citrus_viqr.c
+++ b/libiconv_modules/VIQR/citrus_viqr.c
@@ -336,7 +336,11 @@ _citrus_VIQR_wcrtomb_priv(_VIQREncodingInfo * __restrict ei,
int ch = 0;
switch (psenc->chlen) {
- case 0: case 1:
+ case 0:
+ break;
+ case 1:
+ if (n-- < 1)
+ goto e2big;
break;
default:
return (EINVAL);
diff --git a/libiconv_modules/ZW/citrus_zw.c b/libiconv_modules/ZW/citrus_zw.c
index f72b349..bc0cdca 100644
--- a/libiconv_modules/ZW/citrus_zw.c
+++ b/libiconv_modules/ZW/citrus_zw.c
@@ -272,9 +272,12 @@ _citrus_ZW_wcrtomb_priv(_ZWEncodingInfo * __restrict ei __unused,
ch = (unsigned char)wc;
switch (psenc->charset) {
case NONE:
- if (ch == '\0' || ch == '\n')
+ if (ch == '\0' || ch == '\n') {
+ if (n < 1)
+ return (E2BIG);
+ n -= 1;
psenc->ch[psenc->chlen++] = ch;
- else {
+ } else {
if (n < 4)
return (E2BIG);
n -= 4;
>Release-Note:
>Audit-Trail:
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59019 CVS commit: src
Date: Tue, 30 Jun 2026 23:14:39 +0000
Module Name: src
Committed By: riastradh
Date: Tue Jun 30 23:14:39 UTC 2026
Modified Files:
src/distrib/sets/lists/debug: mi
src/distrib/sets/lists/tests: mi
src/tests/lib/libc/locale: Makefile
Added Files:
src/tests/lib/libc/locale: t_iconv.c
Log Message:
iconv(3): Draft some automatic tests.
Based on a report by Nick Wellnhofer.
PR 59019: various iconv issues
To generate a diff of this commit:
cvs rdiff -u -r1.514 -r1.515 src/distrib/sets/lists/debug/mi
cvs rdiff -u -r1.1422 -r1.1423 src/distrib/sets/lists/tests/mi
cvs rdiff -u -r1.18 -r1.19 src/tests/lib/libc/locale/Makefile
cvs rdiff -u -r0 -r1.1 src/tests/lib/libc/locale/t_iconv.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59019 CVS commit: src
Date: Tue, 30 Jun 2026 23:15:31 +0000
Module Name: src
Committed By: riastradh
Date: Tue Jun 30 23:15:31 UTC 2026
Modified Files:
src/lib/libc/citrus/modules: citrus_hz.c
src/tests/lib/libc/locale: t_iconv.c
Log Message:
iconv(3): Fix null pointer dereference with HZ8 encoding.
Based on a report by Nick Wellnhofer.
PR 59019: various iconv issues
To generate a diff of this commit:
cvs rdiff -u -r1.4 -r1.5 src/lib/libc/citrus/modules/citrus_hz.c
cvs rdiff -u -r1.1 -r1.2 src/tests/lib/libc/locale/t_iconv.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59019 CVS commit: src
Date: Tue, 30 Jun 2026 23:15:52 +0000
Module Name: src
Committed By: riastradh
Date: Tue Jun 30 23:15:52 UTC 2026
Modified Files:
src/lib/libc/citrus/modules: citrus_utf7.c
src/tests/lib/libc/locale: t_iconv.c
Log Message:
iconv(3): Fix buffer overrun in UTF-7 encoding.
Based on a report by Nick Wellnhofer.
PR 59019: various iconv issues
To generate a diff of this commit:
cvs rdiff -u -r1.7 -r1.8 src/lib/libc/citrus/modules/citrus_utf7.c
cvs rdiff -u -r1.2 -r1.3 src/tests/lib/libc/locale/t_iconv.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59019 CVS commit: src
Date: Tue, 30 Jun 2026 23:16:08 +0000
Module Name: src
Committed By: riastradh
Date: Tue Jun 30 23:16:08 UTC 2026
Modified Files:
src/lib/libc/citrus/modules: citrus_viqr.c
src/tests/lib/libc/locale: t_iconv.c
Log Message:
iconv(3): Fix buffer overrun in VIQR encoding.
Based on a report by Nick Wellnhofer.
PR 59019: various iconv issues
To generate a diff of this commit:
cvs rdiff -u -r1.6 -r1.7 src/lib/libc/citrus/modules/citrus_viqr.c
cvs rdiff -u -r1.3 -r1.4 src/tests/lib/libc/locale/t_iconv.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59019 CVS commit: src
Date: Tue, 30 Jun 2026 23:16:34 +0000
Module Name: src
Committed By: riastradh
Date: Tue Jun 30 23:16:34 UTC 2026
Modified Files:
src/lib/libc/citrus/modules: citrus_zw.c
src/tests/lib/libc/locale: t_iconv.c
Log Message:
iconv(3): Fix buffer overrun in ZW encoding.
Based on a report by Nick Wellnhofer.
PR 59019: various iconv issues
To generate a diff of this commit:
cvs rdiff -u -r1.6 -r1.7 src/lib/libc/citrus/modules/citrus_zw.c
cvs rdiff -u -r1.4 -r1.5 src/tests/lib/libc/locale/t_iconv.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59019 CVS commit: src/tests/lib/libc/locale
Date: Tue, 30 Jun 2026 23:16:53 +0000
Module Name: src
Committed By: riastradh
Date: Tue Jun 30 23:16:53 UTC 2026
Modified Files:
src/tests/lib/libc/locale: t_iconv.c
Log Message:
iconv(3): Add a test case for ISO-2022-CN.
From Mark Johnston of FreeBSD.
PR 59019: various iconv issues
To generate a diff of this commit:
cvs rdiff -u -r1.5 -r1.6 src/tests/lib/libc/locale/t_iconv.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59019 CVS commit: src/tests/lib/libc/locale
Date: Tue, 30 Jun 2026 23:17:14 +0000
Module Name: src
Committed By: riastradh
Date: Tue Jun 30 23:17:14 UTC 2026
Modified Files:
src/tests/lib/libc/locale: t_iconv.c
Log Message:
iconv(3): Expand ISO-2022-CN tests a little.
This one is broken for a partial input case, not yet sure why.
PR 59019: various iconv issues
To generate a diff of this commit:
cvs rdiff -u -r1.6 -r1.7 src/tests/lib/libc/locale/t_iconv.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59019 CVS commit: src/tests/lib/libc/locale
Date: Tue, 30 Jun 2026 23:17:31 +0000
Module Name: src
Committed By: riastradh
Date: Tue Jun 30 23:17:31 UTC 2026
Modified Files:
src/tests/lib/libc/locale: t_iconv.c
Log Message:
iconv(3): Fix printing bytes on test failure.
Don't sign-extend to a 32-bit quantity causing the left to be padded
with f's; just print the 8-bit quantity.
PR 59019: various iconv issues
To generate a diff of this commit:
cvs rdiff -u -r1.7 -r1.8 src/tests/lib/libc/locale/t_iconv.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59019 CVS commit: src/lib
Date: Tue, 30 Jun 2026 23:17:48 +0000
Module Name: src
Committed By: riastradh
Date: Tue Jun 30 23:17:48 UTC 2026
Modified Files:
src/lib/i18n_module: Makefile.inc
src/lib/libc/citrus/modules: citrus_hz.c citrus_iconv_std.c
citrus_viqr.c
Log Message:
i18n_modules: Build with _DIAGNOSTIC.
Fix some bitrot that it turned up here.
PR 59019: various iconv issues
To generate a diff of this commit:
cvs rdiff -u -r1.14 -r1.15 src/lib/i18n_module/Makefile.inc
cvs rdiff -u -r1.5 -r1.6 src/lib/libc/citrus/modules/citrus_hz.c
cvs rdiff -u -r1.16 -r1.17 src/lib/libc/citrus/modules/citrus_iconv_std.c
cvs rdiff -u -r1.7 -r1.8 src/lib/libc/citrus/modules/citrus_viqr.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59019 CVS commit: src/lib/libc/citrus/modules
Date: Tue, 30 Jun 2026 23:18:10 +0000
Module Name: src
Committed By: riastradh
Date: Tue Jun 30 23:18:09 UTC 2026
Modified Files:
src/lib/libc/citrus/modules: citrus_hz.c
Log Message:
citrus/HZ: Be more careful about encoding buffer.
1. Use unsigned char for chlen, since it's never negative and only
needs to be big enough for the ch array.
2. Expand the ch array by space for two escape sequences, each of
which is two characters.
I don't think it is currently possible with the i18n data we ship
for it to emit two escape sequences in a row -- there is a code
path to do this, but I don't think it can be reached without
setting escape sequences for variable 1 and extending this in some
way. Nevertheless, let's err on the side of safety.
3. Sprinkle assertions everywhere.
PR 59019: various iconv issues
To generate a diff of this commit:
cvs rdiff -u -r1.6 -r1.7 src/lib/libc/citrus/modules/citrus_hz.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59019 CVS commit: src/lib/libc/citrus/modules
Date: Tue, 30 Jun 2026 23:18:22 +0000
Module Name: src
Committed By: riastradh
Date: Tue Jun 30 23:18:22 UTC 2026
Modified Files:
src/lib/libc/citrus/modules: citrus_utf7.c
Log Message:
citrus/UTF7: unsigned chlen for simplicity; sprinkle assertions.
PR 59019: various iconv issues
To generate a diff of this commit:
cvs rdiff -u -r1.8 -r1.9 src/lib/libc/citrus/modules/citrus_utf7.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59019 CVS commit: src/lib/libc/citrus/modules
Date: Tue, 30 Jun 2026 23:18:40 +0000
Module Name: src
Committed By: riastradh
Date: Tue Jun 30 23:18:40 UTC 2026
Modified Files:
src/lib/libc/citrus/modules: citrus_viqr.c
Log Message:
citrus/VIQR: unsigned chlen for simplicity; sprinkle assertions.
PR 59019: various iconv issues
To generate a diff of this commit:
cvs rdiff -u -r1.8 -r1.9 src/lib/libc/citrus/modules/citrus_viqr.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59019 CVS commit: [netbsd-11] src
Date: Fri, 3 Jul 2026 18:02:15 +0000
Module Name: src
Committed By: martin
Date: Fri Jul 3 18:02:14 UTC 2026
Modified Files:
src/distrib/sets/lists/debug [netbsd-11]: mi
src/distrib/sets/lists/tests [netbsd-11]: mi
src/lib/libc/citrus/modules [netbsd-11]: citrus_hz.c citrus_utf7.c
citrus_viqr.c citrus_zw.c
src/tests/lib/libc/locale [netbsd-11]: Makefile
Added Files:
src/tests/lib/libc/locale [netbsd-11]: t_iconv.c
Log Message:
Pull up following revision(s) (requested by riastradh in ticket #361):
lib/libc/citrus/modules/citrus_hz.c: revision 1.5
tests/lib/libc/locale/Makefile: revision 1.19
tests/lib/libc/locale/t_iconv.c: revision 1.1
distrib/sets/lists/tests/mi: revision 1.1423
tests/lib/libc/locale/t_iconv.c: revision 1.2
tests/lib/libc/locale/t_iconv.c: revision 1.3
tests/lib/libc/locale/t_iconv.c: revision 1.4
tests/lib/libc/locale/t_iconv.c: revision 1.5
tests/lib/libc/locale/t_iconv.c: revision 1.6
tests/lib/libc/locale/t_iconv.c: revision 1.7
tests/lib/libc/locale/t_iconv.c: revision 1.8
lib/libc/citrus/modules/citrus_utf7.c: revision 1.8
distrib/sets/lists/debug/mi: revision 1.515
lib/libc/citrus/modules/citrus_zw.c: revision 1.7
lib/libc/citrus/modules/citrus_viqr.c: revision 1.7
iconv(3): Draft some automatic tests.
Based on a report by Nick Wellnhofer.
PR 59019: various iconv issues
iconv(3): Fix null pointer dereference with HZ8 encoding.
Based on a report by Nick Wellnhofer.
PR 59019: various iconv issues
iconv(3): Fix buffer overrun in UTF-7 encoding.
Based on a report by Nick Wellnhofer.
PR 59019: various iconv issues
iconv(3): Fix buffer overrun in VIQR encoding.
Based on a report by Nick Wellnhofer.
PR 59019: various iconv issues
iconv(3): Fix buffer overrun in ZW encoding.
Based on a report by Nick Wellnhofer.
PR 59019: various iconv issues
iconv(3): Add a test case for ISO-2022-CN.
From Mark Johnston of FreeBSD.
PR 59019: various iconv issues
iconv(3): Expand ISO-2022-CN tests a little.
This one is broken for a partial input case, not yet sure why.
PR 59019: various iconv issues
iconv(3): Fix printing bytes on test failure.
Don't sign-extend to a 32-bit quantity causing the left to be padded
with f's; just print the 8-bit quantity.
PR 59019: various iconv issues
To generate a diff of this commit:
cvs rdiff -u -r1.485.2.9 -r1.485.2.10 src/distrib/sets/lists/debug/mi
cvs rdiff -u -r1.1387.2.9 -r1.1387.2.10 src/distrib/sets/lists/tests/mi
cvs rdiff -u -r1.4 -r1.4.38.1 src/lib/libc/citrus/modules/citrus_hz.c
cvs rdiff -u -r1.7 -r1.7.6.1 src/lib/libc/citrus/modules/citrus_utf7.c
cvs rdiff -u -r1.6 -r1.6.42.1 src/lib/libc/citrus/modules/citrus_viqr.c
cvs rdiff -u -r1.6 -r1.6.6.1 src/lib/libc/citrus/modules/citrus_zw.c
cvs rdiff -u -r1.18 -r1.18.2.1 src/tests/lib/libc/locale/Makefile
cvs rdiff -u -r0 -r1.8.2.2 src/tests/lib/libc/locale/t_iconv.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59019 CVS commit: [netbsd-10] src
Date: Fri, 3 Jul 2026 18:06:58 +0000
Module Name: src
Committed By: martin
Date: Fri Jul 3 18:06:58 UTC 2026
Modified Files:
src/distrib/sets/lists/debug [netbsd-10]: mi
src/distrib/sets/lists/tests [netbsd-10]: mi
src/lib/libc/citrus/modules [netbsd-10]: citrus_hz.c citrus_utf7.c
citrus_viqr.c citrus_zw.c
src/tests/lib/libc/locale [netbsd-10]: Makefile
Added Files:
src/tests/lib/libc/locale [netbsd-10]: t_iconv.c
Log Message:
Pull up following revision(s) (requested by riastradh in ticket #1301):
lib/libc/citrus/modules/citrus_hz.c: revision 1.5
tests/lib/libc/locale/Makefile: revision 1.19
tests/lib/libc/locale/t_iconv.c: revision 1.1
distrib/sets/lists/tests/mi: revision 1.1423
tests/lib/libc/locale/t_iconv.c: revision 1.2
tests/lib/libc/locale/t_iconv.c: revision 1.3
tests/lib/libc/locale/t_iconv.c: revision 1.4
tests/lib/libc/locale/t_iconv.c: revision 1.5
tests/lib/libc/locale/t_iconv.c: revision 1.6
tests/lib/libc/locale/t_iconv.c: revision 1.7
tests/lib/libc/locale/t_iconv.c: revision 1.8
lib/libc/citrus/modules/citrus_utf7.c: revision 1.8
distrib/sets/lists/debug/mi: revision 1.515
lib/libc/citrus/modules/citrus_zw.c: revision 1.7
lib/libc/citrus/modules/citrus_viqr.c: revision 1.7
iconv(3): Draft some automatic tests.
Based on a report by Nick Wellnhofer.
PR 59019: various iconv issues
iconv(3): Fix null pointer dereference with HZ8 encoding.
Based on a report by Nick Wellnhofer.
PR 59019: various iconv issues
iconv(3): Fix buffer overrun in UTF-7 encoding.
Based on a report by Nick Wellnhofer.
PR 59019: various iconv issues
iconv(3): Fix buffer overrun in VIQR encoding.
Based on a report by Nick Wellnhofer.
PR 59019: various iconv issues
iconv(3): Fix buffer overrun in ZW encoding.
Based on a report by Nick Wellnhofer.
PR 59019: various iconv issues
iconv(3): Add a test case for ISO-2022-CN.
From Mark Johnston of FreeBSD.
PR 59019: various iconv issues
iconv(3): Expand ISO-2022-CN tests a little.
This one is broken for a partial input case, not yet sure why.
PR 59019: various iconv issues
iconv(3): Fix printing bytes on test failure.
Don't sign-extend to a 32-bit quantity causing the left to be padded
with f's; just print the 8-bit quantity.
PR 59019: various iconv issues
To generate a diff of this commit:
cvs rdiff -u -r1.394.2.19 -r1.394.2.20 src/distrib/sets/lists/debug/mi
cvs rdiff -u -r1.1238.2.23 -r1.1238.2.24 src/distrib/sets/lists/tests/mi
cvs rdiff -u -r1.4 -r1.4.34.1 src/lib/libc/citrus/modules/citrus_hz.c
cvs rdiff -u -r1.7 -r1.7.2.1 src/lib/libc/citrus/modules/citrus_utf7.c
cvs rdiff -u -r1.6 -r1.6.38.1 src/lib/libc/citrus/modules/citrus_viqr.c
cvs rdiff -u -r1.6 -r1.6.2.1 src/lib/libc/citrus/modules/citrus_zw.c
cvs rdiff -u -r1.13.10.1 -r1.13.10.2 src/tests/lib/libc/locale/Makefile
cvs rdiff -u -r0 -r1.8.4.2 src/tests/lib/libc/locale/t_iconv.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59019 CVS commit: [netbsd-9] src
Date: Fri, 3 Jul 2026 18:13:20 +0000
Module Name: src
Committed By: martin
Date: Fri Jul 3 18:13:19 UTC 2026
Modified Files:
src/distrib/sets/lists/debug [netbsd-9]: mi
src/distrib/sets/lists/tests [netbsd-9]: mi
src/lib/libc/citrus/modules [netbsd-9]: citrus_hz.c citrus_utf7.c
citrus_viqr.c citrus_zw.c
src/tests/lib/libc/locale [netbsd-9]: Makefile
Added Files:
src/tests/lib/libc/locale [netbsd-9]: t_iconv.c
Log Message:
Pull up following revision(s) (requested by riastradh in ticket #2030):
lib/libc/citrus/modules/citrus_hz.c: revision 1.5
tests/lib/libc/locale/Makefile: revision 1.19
tests/lib/libc/locale/t_iconv.c: revision 1.1
distrib/sets/lists/tests/mi: revision 1.1423
tests/lib/libc/locale/t_iconv.c: revision 1.2
tests/lib/libc/locale/t_iconv.c: revision 1.3
tests/lib/libc/locale/t_iconv.c: revision 1.4
tests/lib/libc/locale/t_iconv.c: revision 1.5
tests/lib/libc/locale/t_iconv.c: revision 1.6
tests/lib/libc/locale/t_iconv.c: revision 1.7
tests/lib/libc/locale/t_iconv.c: revision 1.8
lib/libc/citrus/modules/citrus_utf7.c: revision 1.8
distrib/sets/lists/debug/mi: revision 1.515
lib/libc/citrus/modules/citrus_zw.c: revision 1.7
lib/libc/citrus/modules/citrus_viqr.c: revision 1.7
(all via patch)
iconv(3): Draft some automatic tests.
Based on a report by Nick Wellnhofer.
PR 59019: various iconv issues
iconv(3): Fix null pointer dereference with HZ8 encoding.
Based on a report by Nick Wellnhofer.
PR 59019: various iconv issues
iconv(3): Fix buffer overrun in UTF-7 encoding.
Based on a report by Nick Wellnhofer.
PR 59019: various iconv issues
iconv(3): Fix buffer overrun in VIQR encoding.
Based on a report by Nick Wellnhofer.
PR 59019: various iconv issues
iconv(3): Fix buffer overrun in ZW encoding.
Based on a report by Nick Wellnhofer.
PR 59019: various iconv issues
iconv(3): Add a test case for ISO-2022-CN.
From Mark Johnston of FreeBSD.
PR 59019: various iconv issues
iconv(3): Expand ISO-2022-CN tests a little.
This one is broken for a partial input case, not yet sure why.
PR 59019: various iconv issues
iconv(3): Fix printing bytes on test failure.
Don't sign-extend to a 32-bit quantity causing the left to be padded
with f's; just print the 8-bit quantity.
PR 59019: various iconv issues
To generate a diff of this commit:
cvs rdiff -u -r1.285.2.13 -r1.285.2.14 src/distrib/sets/lists/debug/mi
cvs rdiff -u -r1.818.2.11 -r1.818.2.12 src/distrib/sets/lists/tests/mi
cvs rdiff -u -r1.4 -r1.4.26.1 src/lib/libc/citrus/modules/citrus_hz.c
cvs rdiff -u -r1.6 -r1.6.30.1 src/lib/libc/citrus/modules/citrus_utf7.c \
src/lib/libc/citrus/modules/citrus_viqr.c
cvs rdiff -u -r1.5 -r1.5.30.1 src/lib/libc/citrus/modules/citrus_zw.c
cvs rdiff -u -r1.13 -r1.13.2.1 src/tests/lib/libc/locale/Makefile
cvs rdiff -u -r0 -r1.8.6.2 src/tests/lib/libc/locale/t_iconv.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
State-Changed-From-To: open->closed
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Fri, 03 Jul 2026 18:23:33 +0000
State-Changed-Why:
fixed in HEAD, pulled up to 11, 10, and 9
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59019 CVS commit: src/lib/libc/citrus/modules
Date: Sun, 5 Jul 2026 20:40:04 +0000
Module Name: src
Committed By: riastradh
Date: Sun Jul 5 20:40:04 UTC 2026
Modified Files:
src/lib/libc/citrus/modules: citrus_viqr.c
Log Message:
iconv VIQR: Fix use-after-free during destruction.
PR lib/59019: various iconv issues
Prompted by investigating:
PR lib/60413: iconv_samples test crashes on sparc*
Fixed in FreeBSD back in 2022, and I confirmed -Wuse-after-free catches
this for us too, but we're not using it -- maybe we should:
commit 8f27c9d14a559f33aa7fc3245f841f7ce52fadd5
Author: John Baldwin <jhb@FreeBSD.org>
Date: Mon Oct 3 16:10:43 2022 -0700
libiconv VIQR: Fix a use after free.
Use TAILQ_FOREACH_SAFE to walk to list of children mnemonics to
free
them instead of TAILQ_FOREACH.
Reviewed by: emaste
Reported by: GCC 12 -Wuse-after-free
Differential Revision: https://reviews.freebsd.org/D36821
To generate a diff of this commit:
cvs rdiff -u -r1.9 -r1.10 src/lib/libc/citrus/modules/citrus_viqr.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Stephen Borrill" <sborrill@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59019 CVS commit: [netbsd-10] src/lib/libc/citrus/modules
Date: Tue, 7 Jul 2026 09:39:20 +0000
Module Name: src
Committed By: sborrill
Date: Tue Jul 7 09:39:20 UTC 2026
Modified Files:
src/lib/libc/citrus/modules [netbsd-10]: citrus_iconv_std.c
citrus_viqr.c
Log Message:
Pull up the following revisions(s) (requested by riastradh in ticket #1308):
lib/libc/citrus/modules/citrus_viqr.c: revision 1.10
lib/libc/citrus/modules/citrus_iconv_std.c: revision 1.18
iconv(3): Fix use-after-free in VIQR encoding, and incorrect
mbstate_t allocation alignment in various encodings (triggerable
if the source is VIQR).
Fixes:
- PR lib/59019: various iconv issues
- PR lib/60413: iconv_samples test crashes on sparc*
To generate a diff of this commit:
cvs rdiff -u -r1.16 -r1.16.50.1 \
src/lib/libc/citrus/modules/citrus_iconv_std.c
cvs rdiff -u -r1.6.38.1 -r1.6.38.2 src/lib/libc/citrus/modules/citrus_viqr.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Stephen Borrill" <sborrill@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59019 CVS commit: [netbsd-9] src/lib/libc/citrus/modules
Date: Tue, 7 Jul 2026 09:56:55 +0000
Module Name: src
Committed By: sborrill
Date: Tue Jul 7 09:56:55 UTC 2026
Modified Files:
src/lib/libc/citrus/modules [netbsd-9]: citrus_iconv_std.c
citrus_viqr.c
Log Message:
Pull up the following revisions(s) (requested by riastradh in ticket #2035):
lib/libc/citrus/modules/citrus_viqr.c: revision 1.10
lib/libc/citrus/modules/citrus_iconv_std.c: revision 1.18
iconv(3): Fix use-after-free in VIQR encoding, and incorrect
mbstate_t allocation alignment in various encodings (triggerable
if the source is VIQR).
Fixes:
- PR lib/59019: various iconv issues
- PR lib/60413: iconv_samples test crashes on sparc*
To generate a diff of this commit:
cvs rdiff -u -r1.16 -r1.16.42.1 \
src/lib/libc/citrus/modules/citrus_iconv_std.c
cvs rdiff -u -r1.6.30.1 -r1.6.30.2 src/lib/libc/citrus/modules/citrus_viqr.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Stephen Borrill" <sborrill@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59019 CVS commit: [netbsd-11] src/lib/libc/citrus/modules
Date: Tue, 7 Jul 2026 13:58:41 +0000
Module Name: src
Committed By: sborrill
Date: Tue Jul 7 13:58:41 UTC 2026
Modified Files:
src/lib/libc/citrus/modules [netbsd-11]: citrus_iconv_std.c
citrus_viqr.c
Log Message:
Pull up the following revisions(s) (requested by riastradh in ticket #373):
lib/libc/citrus/modules/citrus_viqr.c: revision 1.10
lib/libc/citrus/modules/citrus_iconv_std.c: revision 1.18
iconv(3): Fix use-after-free in VIQR encoding, and incorrect
mbstate_t allocation alignment in various encodings (triggerable
if the source is VIQR).
Fixes:
- PR lib/59019: various iconv issues
- PR lib/60413: iconv_samples test crashes on sparc*
To generate a diff of this commit:
cvs rdiff -u -r1.16 -r1.16.54.1 \
src/lib/libc/citrus/modules/citrus_iconv_std.c
cvs rdiff -u -r1.6.42.1 -r1.6.42.2 src/lib/libc/citrus/modules/citrus_viqr.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
>Unformatted:
(Contact us)
$NetBSD: query-full-pr,v 1.51 2026/08/10 02:28:17 riastradh Exp $
$NetBSD: gnats_config.sh,v 1.10 2026/05/13 22:00:09 riastradh Exp $
Copyright © 1994-2026
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.
Home