zvbi/CVE-2025-2173.patch
starlet-dx 0253b6413b Fix CVE-2025-2173,CVE-2025-2174,CVE-2025-2176 and CVE-2025-2177
(cherry picked from commit ec38b21d4ac51878e458486634e20295ee780574)
2025-03-18 19:42:38 +08:00

36 lines
1.1 KiB
Diff

From 8def647eea27f7fd7ad33ff79c2d6d3e39948dce Mon Sep 17 00:00:00 2001
From: Ileana Dumitrescu <ileanadumitrescu95@gmail.com>
Date: Mon, 10 Mar 2025 20:36:05 +0200
Subject: [PATCH] src/conv.c: Check src_length to avoid an unitinialized heap
read
---
src/conv.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/src/conv.c b/src/conv.c
index 9a2a418..3099202 100644
--- a/src/conv.c
+++ b/src/conv.c
@@ -578,8 +578,8 @@ strndup_iconv_from_ucs2 (unsigned long * out_size,
* @returns
* A pointer to the allocated buffer. You must free() the buffer
* when it is no longer needed. The function returns @c NULL when
- * the conversion fails, when it runs out of memory or when @a src
- * is @c NULL.
+ * the conversion fails, when it runs out of memory, src_length is
+ * set to zero, or when @a src is @c NULL.
*
* @since 0.2.23
*/
@@ -593,6 +593,9 @@ vbi_strndup_iconv_ucs2 (const char * dst_codeset,
char *result;
unsigned long size;
+ if (0 == src_length)
+ return NULL;
+
buffer = strndup_iconv_from_ucs2 (&size,
dst_codeset,
src, src_length,