Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 521930 (CVE-2012-6656) - <sys-libs/glibc-2.17: iconv() segfaults if the invalid multibyte character 0xffff is input when converting from IBM930
Summary: <sys-libs/glibc-2.17: iconv() segfaults if the invalid multibyte character 0x...
Status: RESOLVED FIXED
Alias: CVE-2012-6656
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Gentoo Security
URL: https://sourceware.org/bugzilla/show_...
Whiteboard: A3 [glsa cleanup]
Keywords:
Depends on:
Blocks:
 
Reported: 2014-09-02 08:13 UTC by Agostino Sarubbo
Modified: 2015-03-08 14:54 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-09-02 08:13:11 UTC 
From ${URL} :

When converting IBM930 code with iconv(), if IBM930 code which includes invalid multibyte character "0xffff" is specified, then iconv() segfaults.

Version-Release number of selected component (if applicable):
glibc-2.5-81.el5_8.2

How reproducible:
Always

Steps to Reproduce:
Run the following command:

echo '0x0e 0x43 0x8c 0xff 0xff 0x43 0xbd 0x43 0xbd' | xxd -r | iconv -f IBM930 -t UTF-8
  
Actual results:
Segfault

Expected results:
サiconv: illegal input sequence at position 3


@maintainer(s): since the fixed version is already stable, please remove the affected versions from the tree.
Comment 1 Kristian Fiskerstrand (RETIRED) gentoo-dev 2014-09-02 08:18:51 UTC 
New GLSA request filed
Comment 2 Yury German Gentoo Infrastructure gentoo-dev 2015-03-03 02:38:15 UTC 
Maintainer(s), please drop the vulnerable version(s).
Comment 3 Yury German Gentoo Infrastructure gentoo-dev 2015-03-03 03:06:17 UTC 
Florian Weimer 2014-08-29 09:59:27 UTC
Fixed in commit 6e230d11837f3ae7b375ea69d7905f0d18eb79e5, which went into glibc 2.16.
Comment 4 GLSAMaker/CVETool Bot gentoo-dev 2015-03-08 14:54:48 UTC 
This issue was resolved and addressed in
 GLSA 201503-04 at http://security.gentoo.org/glsa/glsa-201503-04.xml
by GLSA coordinator Kristian Fiskerstrand (K_F).