Fix CVE-2026-58471: buffer overflow in convert_fname()

Backport upstream fix for CVE-2026-58471, a buffer overflow in
convert_fname() in src/url.c. The patch (from upstream commit
c2640fe5171c59f87c58dc9fcb195b2d18b010ee) fixes incorrect buffer
size tracking during iconv filename conversion by removing the
flawed `done` variable and replacing the E2BIG reallocation logic
with a correct implementation that properly tracks used bytes,
ensures buffer growth, and updates all size/pointer variables
after reallocation.

CVE: CVE-2026-58471
Upstream patches:
 - c2640fe517.patch
Resolves: RHEL-194519

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir

wget-1.19.5-CVE-2026-58471.patch

@@ -0,0 +1,65 @@
+From 3514c0f2ad4e3d8a2e9ad0893accdb7a21cae729 Mon Sep 17 00:00:00 2001
+From: Arkadi Vainbrand <arkadva8@gmail.com>
+Date: Tue, 13 Jan 2026 12:22:04 +0200
+Subject: [PATCH] Fix buffer size handling in filename conversion
+
+* src/url.c (convert_fname): Fix buffer overflow.
+
+Copyright-paperwork-exempt: Yes
+Signed-off-by: Arkadi Vainbrand <arkadva8@gmail.com>
+---
+ src/url.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/src/url.c b/src/url.c
+index ebe0536..848b88f 100644
+--- a/src/url.c
++++ b/src/url.c
+@@ -1583,7 +1583,7 @@ convert_fname (char *fname)
+   const char *from_encoding = opt.encoding_remote;
+   const char *to_encoding = opt.locale;
+   iconv_t cd;
+-  size_t len, done, inlen, outlen;
++  size_t len, inlen, outlen;
+   char *s;
+   const char *orig_fname;
+ 
+@@ -1605,7 +1605,6 @@ convert_fname (char *fname)
+   inlen = strlen (fname);
+   len = outlen = inlen * 2;
+   converted_fname = s = xmalloc (outlen + 1);
+-  done = 0;
+ 
+   for (;;)
+     {
+@@ -1613,7 +1612,7 @@ convert_fname (char *fname)
+       if (iconv (cd, (ICONV_CONST char **) &fname, &inlen, &s, &outlen) == 0
+           && iconv (cd, NULL, NULL, &s, &outlen) == 0)
+         {
+-          *(converted_fname + len - outlen - done) = '\0';
++          *s = '\0';
+           iconv_close (cd);
+           DEBUGP (("Converted file name '%s' (%s) -> '%s' (%s)\n",
+                    orig_fname, from_encoding, converted_fname, to_encoding));
+@@ -1636,10 +1635,17 @@ convert_fname (char *fname)
+         }
+       else if (errno == E2BIG) /* Output buffer full */
+         {
+-          done = len;
+-          len = outlen = done + inlen * 2;
+-          converted_fname = xrealloc (converted_fname, outlen + 1);
+-          s = converted_fname + done;
++          size_t used = s - converted_fname;
++          size_t newlen = used + inlen * 2 + 1;
++
++          /* Ensure we actually grow the buffer */
++          if (newlen <= len)
++            newlen = len * 2;
++
++          converted_fname = xrealloc (converted_fname, newlen + 1);
++          len = newlen;
++          s = converted_fname + used;
++          outlen = len - used;
+         }
+       else /* Weird, we got an unspecified error */
+         {

wget.spec

@@ -1,7 +1,7 @@
 Summary: A utility for retrieving files using the HTTP or FTP protocols
 Name: wget
 Version: 1.19.5
-Release: 13%{?dist}
+Release: 14%{?dist}
 License: GPLv3+
 Group: Applications/Internet
 Url: http://www.gnu.org/software/wget/
@@ -27,6 +27,8 @@ Patch13: wget-1.19.5-CVE-2024-38428.patch
 # https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812
 # https://gitlab.com/gnuwget/wget/-/commit/f76978a51ba9365e7ecaed96c1cfb73197a38ca2
 Patch14: wget-1.19.5-CVE-2026-58472.patch
+# https://gitlab.com/gnuwget/wget/-/commit/3514c0f2ad4e3d8a2e9ad0893accdb7a21cae729
+Patch15: wget-1.19.5-CVE-2026-58471.patch
 
 Provides: webclient
 Provides: bundled(gnulib) 
@@ -66,6 +68,7 @@ grep "PACKAGE_STRING='wget .* (Red Hat modified)'" configure || exit 1
 %patch12 -p1 -b .no-log-quiet
 %patch13 -p1 -b .CVE-2024-38428
 %patch14 -p1 -b .CVE-2026-58472
+%patch15 -p1 -b .CVE-2026-58471
 
 %build
 %configure \
@@ -112,6 +115,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_infodir}/*
 
 %changelog
+* Wed Jul 15 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.19.5-14
+- Fix CVE-2026-58471: buffer overflow in convert_fname()
+- Resolves: RHEL-194519
+
 * Wed Jul 15 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.19.5-13
 - Fix CVE-2026-58472: integer and buffer overflow in html_quote_string()
 - Resolves: RHEL-210627