about summary refs log tree commit diff
path: root/iconvdata/ibm1364.c
diff options
context:
space:
mode:
authorFlorian Weimer <fweimer@redhat.com>2014-09-03 19:45:43 +0200
committerFlorian Weimer <fweimer@redhat.com>2014-09-03 19:46:42 +0200
commit41488498b6d9440ee66ab033808cce8323bba7ac (patch)
treec71261df9fe5e8fbd7193181e7a1ca8160cfa6bb /iconvdata/ibm1364.c
parenta78b712d405b55405b425e9b1453745615483003 (diff)
downloadglibc-41488498b6d9440ee66ab033808cce8323bba7ac.tar.gz
glibc-41488498b6d9440ee66ab033808cce8323bba7ac.tar.xz
glibc-41488498b6d9440ee66ab033808cce8323bba7ac.zip
CVE-2014-6040: Crashes on invalid input in IBM gconv modules [BZ #17325]
These changes are based on the fix for BZ #14134 in commit
6e230d11837f3ae7b375ea69d7905f0d18eb79e5.
Diffstat (limited to 'iconvdata/ibm1364.c')
-rw-r--r--iconvdata/ibm1364.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/iconvdata/ibm1364.c b/iconvdata/ibm1364.c
index 0b5484fc20..cf8099351d 100644
--- a/iconvdata/ibm1364.c
+++ b/iconvdata/ibm1364.c
@@ -221,7 +221,8 @@ enum
 	  ++rp2;							      \
 									      \
 	uint32_t res;							      \
-	if (__builtin_expect (ch < rp2->start, 0)			      \
+	if (__builtin_expect (rp2->start == 0xffff, 0)			      \
+	    || __builtin_expect (ch < rp2->start, 0)			      \
 	    || (res = DB_TO_UCS4[ch + rp2->idx],			      \
 		__builtin_expect (res, L'\1') == L'\0' && ch != '\0'))	      \
 	  {								      \