Stack Smash while performing charset conversions in znc

Description

Covered in-depth at: https://github.com/znc/znc/issues/1459

Stack trace: https://gist.github.com/Bonstra/f38a184d0af66ee71d0dc9f8936db65c

The issue seems to be in icuConv / ucnv_convertEx.

"ZNC appears to crash while translating charsets for the result of a WHO command, for some users whose real name contains non-ASCII characters."

I suspect it happens anywhere where charset conversion would be performed, but depending on which channels the test machine is configured to log into, you'll tend to get different events be the first one to trigger the crash.

Activity

Show:
TracBot
June 30, 2018, 11:55 PM
Trac Comment 1 by —2017-12-06T19:08:18.657Z

We need some more details here, such as which codepage is being used, which parameters, etc.

Ideally, a separable test case that just calls ICU source. You might be able to modify the conversion sample code in http://source.icu-project.org/repos/icu/trunk/icu4c/source/samples/ucnv/

TracBot
June 30, 2018, 11:55 PM
Trac Comment 2 by bonstra@f25148b506137b64—2017-12-08T02:18:11.328Z

I can now reliably reproduce the bug with ICU 60, on Linux armv5 & x86_64 platforms.

ucnv_convertEx() may write beyond the end of the output buffer if the input contains a character whose conversion would result in a multibyte sequence in the output, but the output buffer only contains enough space for a part of the sequence, in which case the whole sequence is written into the output buffer without accounting for its size limit.

(I didn't check the code, it is probably a bit trickier than that)

I'll attach sample code that triggers the issue.

TracBot
June 30, 2018, 11:55 PM
Trac Comment 4 by —2017-12-08T21:55:36.356Z

I am pretty sure I fixed this in . I didn't see the reproduction test case here before I got to work on that one.

TracBot
June 30, 2018, 11:55 PM
Trac Comment 6 by Laszlo Boszormenyi (GCS) <gcs@330d8c1190b494d5—2017-12-30T09:28:03.384Z

Attached poc2.cpp as previously the 'if' was checking uint8_t vs int types and those won't be equal.

Assignee

TracBot

Reporter

TracBot

Components

Labels

None

Reviewer

None

Priority

critical

Time Needed

None

Fix versions

Configure