[Bug 206551] Heap overflow in iconv kernel module

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=206551

--- Comment #3 from CTurt <ecturt at gmail.com> ---
In the disassembly of `libiconv.so`, the check is performed on an `unsigned
int` for some reason:

    unsigned int v24;
    ...
    && v24 <= 0x41000

I'm not sure why this is, considering the type of `ia_data` is `int`, which
should imply `signed` by default.

However, this means that it's not actually triggerable; `EINVAL` is returned
for an `ia_data` of `-1`. I've tested on FreeBSD 9.0, and 10.2

-- 
You are receiving this mail because:
You are the assignee for the bug.