lsm/mdbtools
1
0
Fork 0
mirror of https://github.com/mdbtools/mdbtools.git synced 2025-04-05 20:31:00 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix buffer overrun (oss-fuzz/28832+28807)

Browse Source 
len_out was wrapping to a large number when bad input was encountered.
Ensure it's non-zero before proceeding with iconv.
This commit is contained in:
Evan Miller 2021-01-15 07:44:50 -05:00
parent 0e3a627ee6
commit 89e2361582
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/libmdb/iconv.c
View File

@ -53,7 +53,7 @@ static size_t decompressed_to_utf8_with_iconv(MdbHandle *mdb, const char *in_ptr
char *out_ptr = dest;
size_t len_out = dlen - 1;
while (1) {
while (len_out) {
iconv(mdb->iconv_in, (ICONV_CONST char **)&in_ptr, &len_in, &out_ptr, &len_out);
/*
* Have seen database with odd number of bytes in UCS-2, shouldn't happen but protect against it