commit 92e3a59

musl: Fix CVE-2025-26519

 1@@ -0,0 +1,38 @@
 2+From 68480ab0b8c0477929f92387a8880d941917df49 Mon Sep 17 00:00:00 2001
 3+From: Rich Felker <dalias@aerifal.cx>
 4+Date: Sun, 9 Feb 2025 10:07:19 -0500
 5+Subject: [PATCH] iconv: fix erroneous input validation in EUC-KR decoder
 6+
 7+as a result of incorrect bounds checking on the lead byte being
 8+decoded, certain invalid inputs which should produce an encoding
 9+error, such as "\xc8\x41", instead produced out-of-bounds loads from
10+the ksc table.
11+
12+in a worst case, the loaded value may not be a valid unicode scalar
13+value, in which case, if the output encoding was UTF-8, wctomb would
14+return (size_t)-1, causing an overflow in the output pointer and
15+remaining buffer size which could clobber memory outside of the output
16+buffer.
17+
18+bug report was submitted in private by Nick Wellnhofer on account of
19+potential security implications.
20+---
21+ src/locale/iconv.c | 2 +-
22+ 1 file changed, 1 insertion(+), 1 deletion(-)
23+
24+diff --git a/src/locale/iconv.c b/src/locale/iconv.c
25+index 175def1c..25743a20 100644
26+--- a/src/locale/iconv.c
27++++ b/src/locale/iconv.c
28+@@ -495,7 +495,7 @@ size_t iconv(iconv_t cd, char **restrict in, size_t *restrict inb, char **restri
29+ 			if (c >= 93 || d >= 94) {
30+ 				c += (0xa1-0x81);
31+ 				d += 0xa1;
32+-				if (c >= 93 || c>=0xc6-0x81 && d>0x52)
33++				if (c > 0xc6-0x81 || c==0xc6-0x81 && d>0x52)
34+ 					goto ilseq;
35+ 				if (d-'A'<26) d = d-'A';
36+ 				else if (d-'a'<26) d = d-'a'+26;
37+-- 
38+2.45.2
39+

 1@@ -0,0 +1,37 @@
 2+From aa8be5038707f4b1a79612d16f7117445dbd5a12 Mon Sep 17 00:00:00 2001
 3+From: Rich Felker <dalias@aerifal.cx>
 4+Date: Wed, 12 Feb 2025 17:06:30 -0500
 5+Subject: [PATCH] iconv: harden UTF-8 output code path against input decoder
 6+ bugs
 7+
 8+the UTF-8 output code was written assuming an invariant that iconv's
 9+decoders only emit valid Unicode Scalar Values which wctomb can encode
10+successfully, thereby always returning a value between 1 and 4.
11+
12+if this invariant is not satisfied, wctomb returns (size_t)-1, and the
13+subsequent adjustments to the output buffer pointer and remaining
14+output byte count overflow, moving the output position backwards,
15+potentially past the beginning of the buffer, without storing any
16+bytes.
17+---
18+ src/locale/iconv.c | 4 ++++
19+ 1 file changed, 4 insertions(+)
20+
21+diff --git a/src/locale/iconv.c b/src/locale/iconv.c
22+index 25743a20..3dd9fd90 100644
23+--- a/src/locale/iconv.c
24++++ b/src/locale/iconv.c
25+@@ -538,6 +538,10 @@ size_t iconv(iconv_t cd, char **restrict in, size_t *restrict inb, char **restri
26+ 				if (*outb < k) goto toobig;
27+ 				memcpy(*out, tmp, k);
28+ 			} else k = wctomb_utf8(*out, c);
29++			/* This failure condition should be unreachable, but
30++			 * is included to prevent decoder bugs from translating
31++			 * into advancement outside the output buffer range. */
32++			if (k>4) goto ilseq;
33+ 			*out += k;
34+ 			*outb -= k;
35+ 			break;
36+-- 
37+2.45.2
38+

1@@ -1 +1 @@
2-1.2.5 r0
3+1.2.5 r1