coreutils/coreutils-CVE-2026-56391.patch
Lukáš Zaoral 1aab8da63b
uniq: fix CVE-2026-56391
Resolves: RHEL-216790
2026-07-29 16:34:28 +02:00

48 lines
1.4 KiB
Diff

From d64e35a8a4c0e4608321433e0d84d917e4e36371 Mon Sep 17 00:00:00 2001
From: Paul Eggert <eggert@cs.ucla.edu>
Date: Tue, 28 Apr 2026 11:25:00 -0700
Subject: [PATCH] uniq: fix read overrun with -w
Problem reported by Michał Majchrowicz.
* src/uniq.c (find_field): Fix typo.
* tests/uniq/uniq.pl (add_z_variants): Test for the bug.
(cherry picked from commit d64e35a8a4c0e4608321433e0d84d917e4e36371)
---
src/uniq.c | 4 ++--
tests/uniq/uniq.pl | 3 +++
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/src/uniq.c b/src/uniq.c
index abaf9e0..d46002b 100644
--- a/src/uniq.c
+++ b/src/uniq.c
@@ -267,8 +267,8 @@ find_field (struct linebuffer const *line, idx_t *plen)
else
{
char *ep = lp;
- for (idx_t i = check_chars; 0 < i && lp < lim; i--)
- ep += mcel_scan (lp, lim).len;
+ for (idx_t i = check_chars; 0 < i && ep < lim; i--)
+ ep += mcel_scan (ep, lim).len;
len = ep - lp;
}
diff --git a/tests/uniq/uniq.pl b/tests/uniq/uniq.pl
index a61f264..eba919e 100755
--- a/tests/uniq/uniq.pl
+++ b/tests/uniq/uniq.pl
@@ -234,6 +234,9 @@ my @Tests =
" - 'separate'\n" .
" - 'both'\n" .
"Try '$prog --help' for more information.\n"}],
+ # Test for read buffer overrun.
+ do { my $longline = "\360\237\230\200" . "A" x 255 . "\n";
+ ['146', '-w256', {IN => $longline x 2}, {OUT => $longline}] },
);
# Locale related tests
--
2.55.0