[Bug 206551] Heap overflow in iconv kernel module

bugzilla-noreply at freebsd.org bugzilla-noreply at freebsd.org
Sun Jan 24 10:34:02 UTC 2016


--- Comment #3 from CTurt <ecturt at gmail.com> ---
In the disassembly of `libiconv.so`, the check is performed on an `unsigned
int` for some reason:

    unsigned int v24;
    && v24 <= 0x41000

I'm not sure why this is, considering the type of `ia_data` is `int`, which
should imply `signed` by default.

However, this means that it's not actually triggerable; `EINVAL` is returned
for an `ia_data` of `-1`. I've tested on FreeBSD 9.0, and 10.2

You are receiving this mail because:
You are the assignee for the bug.

More information about the freebsd-bugs mailing list