rpms/wget
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-58471: buffer overflow in convert_fname()

Browse Source 
Backport upstream commit c2640fe5171c59f87c58dc9fcb195b2d18b010ee
to fix a buffer overflow in the convert_fname() function in
src/url.c (CVE-2026-58471). The patch corrects buffer size
handling during iconv E2BIG reallocation, preventing potential
out-of-bounds writes when converting filenames between character
encodings.

CVE: CVE-2026-58471
Upstream patches:
 - c2640fe517.patch
Resolves: RHEL-194518

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-15 10:34:56 +00:00
parent 68032084e6
commit 008cb44596
2 changed files with 72 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

65
wget-1.24.5-CVE-2026-58471.patch Normal file
View File

@ -0,0 +1,65 @@
From 9f36a9a56921b52d27408a1a0b5e5813d0d6abe4 Mon Sep 17 00:00:00 2001
From: Arkadi Vainbrand <arkadva8@gmail.com>
Date: Tue, 13 Jan 2026 12:22:04 +0200
Subject: [PATCH] Fix buffer size handling in filename conversion
* src/url.c (convert_fname): Fix buffer overflow.
Copyright-paperwork-exempt: Yes
Signed-off-by: Arkadi Vainbrand <arkadva8@gmail.com>
---
src/url.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
diff --git a/src/url.c b/src/url.c
index 07c3bc8..75e3603 100644
--- a/src/url.c
+++ b/src/url.c
@@ -1624,7 +1624,7 @@ convert_fname (char *fname)
const char *from_encoding = opt.encoding_remote;
const char *to_encoding = opt.locale;
iconv_t cd;
- size_t len, done, inlen, outlen;
+ size_t len, inlen, outlen;
char *s;
const char *orig_fname;
@@ -1646,7 +1646,6 @@ convert_fname (char *fname)
inlen = strlen (fname);
len = outlen = inlen * 2;
converted_fname = s = xmalloc (outlen + 1);
- done = 0;
for (;;)
{
@@ -1654,7 +1653,7 @@ convert_fname (char *fname)
if (iconv (cd, (ICONV_CONST char **) &fname, &inlen, &s, &outlen) == 0
&& iconv (cd, NULL, NULL, &s, &outlen) == 0)
{
- *(converted_fname + len - outlen - done) = '\0';
+ *s = '\0';
iconv_close (cd);
DEBUGP (("Converted file name '%s' (%s) -> '%s' (%s)\n",
orig_fname, from_encoding, converted_fname, to_encoding));
@@ -1677,10 +1676,17 @@ convert_fname (char *fname)
}
else if (errno == E2BIG) /* Output buffer full */
{
- done = len;
- len = outlen = done + inlen * 2;
- converted_fname = xrealloc (converted_fname, outlen + 1);
- s = converted_fname + done;
+ size_t used = s - converted_fname;
+ size_t newlen = used + inlen * 2 + 1;
+
+ /* Ensure we actually grow the buffer */
+ if (newlen <= len)
+ newlen = len * 2;
+
+ converted_fname = xrealloc (converted_fname, newlen + 1);
+ len = newlen;
+ s = converted_fname + used;
+ outlen = len - used;
}
else /* Weird, we got an unspecified error */
{

8
wget.spec
View File

@ -1,7 +1,7 @@
Summary: A utility for retrieving files using the HTTP or FTP protocols
Name: wget
Version: 1.24.5
Release: 6%{?dist}
Release: 7%{?dist}
License: GPL-3.0-or-later AND LGPL-2.1-or-later AND GFDL-1.3-or-later
Url: http://www.gnu.org/software/wget/
Source: ftp://ftp.gnu.org/gnu/wget/wget-%{version}.tar.gz
@ -13,6 +13,8 @@ Patch6: wget-1.24.5-no-nettle.patch
# https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812
# https://gitlab.com/gnuwget/wget/-/commit/f76978a51ba9365e7ecaed96c1cfb73197a38ca2
Patch7: wget-1.24.5-CVE-2026-58472.patch
# https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee
Patch8: wget-1.24.5-CVE-2026-58471.patch
Provides: webclient
Provides: bundled(gnulib)
@ -86,6 +88,10 @@ make check
%{_infodir}/*
%changelog
* Wed Jul 15 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.24.5-7
- Fix CVE-2026-58471: buffer overflow in convert_fname()
Resolves: RHEL-194518
* Wed Jul 15 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.24.5-6
- Fix integer and buffer overflow in html_quote_string()
Resolves: RHEL-210625