diff options
| author | Florian Weimer <fweimer@redhat.com> | 2014-09-03 19:45:43 +0200 |
|---|---|---|
| committer | Florian Weimer <fweimer@redhat.com> | 2014-09-03 19:46:42 +0200 |
| commit | 41488498b6d9440ee66ab033808cce8323bba7ac (patch) | |
| tree | c71261df9fe5e8fbd7193181e7a1ca8160cfa6bb /iconvdata/ibm1364.c | |
| parent | a78b712d405b55405b425e9b1453745615483003 (diff) | |
| download | glibc-41488498b6d9440ee66ab033808cce8323bba7ac.tar.gz glibc-41488498b6d9440ee66ab033808cce8323bba7ac.tar.xz glibc-41488498b6d9440ee66ab033808cce8323bba7ac.zip | |
CVE-2014-6040: Crashes on invalid input in IBM gconv modules [BZ #17325]
These changes are based on the fix for BZ #14134 in commit 6e230d11837f3ae7b375ea69d7905f0d18eb79e5.
Diffstat (limited to 'iconvdata/ibm1364.c')
| -rw-r--r-- | iconvdata/ibm1364.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/iconvdata/ibm1364.c b/iconvdata/ibm1364.c index 0b5484fc20..cf8099351d 100644 --- a/iconvdata/ibm1364.c +++ b/iconvdata/ibm1364.c @@ -221,7 +221,8 @@ enum ++rp2; \ \ uint32_t res; \ - if (__builtin_expect (ch < rp2->start, 0) \ + if (__builtin_expect (rp2->start == 0xffff, 0) \ + || __builtin_expect (ch < rp2->start, 0) \ || (res = DB_TO_UCS4[ch + rp2->idx], \ __builtin_expect (res, L'\1') == L'\0' && ch != '\0')) \ { \ |