Skip to content
Snippets Groups Projects
  1. Dec 02, 2020
  2. Nov 20, 2020
    • Petr Štetiar's avatar
      musl: handle wcsnrtombs destination buffer overflow (CVE-2020-28928) · 4d4ef105
      Petr Štetiar authored
      
      The wcsnrtombs function in all musl libc versions up through 1.2.1 has
      been found to have multiple bugs in handling of destination buffer
      size when limiting the input character count, which can lead to
      infinite loop with no forward progress (no overflow) or writing past
      the end of the destination buffera.
      
      This function is not used internally in musl and is not widely used,
      but does appear in some applications. The non-input-limiting form
      wcsrtombs is not affected.
      
      All users of musl 1.2.1 and prior versions should apply the attached
      patch, which replaces the overly complex and erroneous implementation.
      The upcoming 1.2.2 release will adopt this new implementation.
      
      Signed-off-by: default avatarPetr Štetiar <ynezz@true.cz>
      4d4ef105
Loading