From 19edc769bba2ea9775015a917c09be2de1559722 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Wed, 15 Jul 2026 10:48:25 +0000 Subject: [PATCH] Fix CVE-2026-58471: buffer overflow in convert_fname() Backport upstream fix for CVE-2026-58471, a buffer overflow in convert_fname() in src/url.c. The patch (from upstream commit c2640fe5171c59f87c58dc9fcb195b2d18b010ee) fixes incorrect buffer size tracking during iconv filename conversion by removing the flawed `done` variable and replacing the E2BIG reallocation logic with a correct implementation that properly tracks used bytes, ensures buffer growth, and updates all size/pointer variables after reallocation. CVE: CVE-2026-58471 Upstream patches: - https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee.patch Resolves: RHEL-194519 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- wget-1.19.5-CVE-2026-58471.patch | 65 ++++++++++++++++++++++++++++++++ wget.spec | 9 ++++- 2 files changed, 73 insertions(+), 1 deletion(-) create mode 100644 wget-1.19.5-CVE-2026-58471.patch diff --git a/wget-1.19.5-CVE-2026-58471.patch b/wget-1.19.5-CVE-2026-58471.patch new file mode 100644 index 0000000..419307f --- /dev/null +++ b/wget-1.19.5-CVE-2026-58471.patch @@ -0,0 +1,65 @@ +From 3514c0f2ad4e3d8a2e9ad0893accdb7a21cae729 Mon Sep 17 00:00:00 2001 +From: Arkadi Vainbrand +Date: Tue, 13 Jan 2026 12:22:04 +0200 +Subject: [PATCH] Fix buffer size handling in filename conversion + +* src/url.c (convert_fname): Fix buffer overflow. + +Copyright-paperwork-exempt: Yes +Signed-off-by: Arkadi Vainbrand +--- + src/url.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/src/url.c b/src/url.c +index ebe0536..848b88f 100644 +--- a/src/url.c ++++ b/src/url.c +@@ -1583,7 +1583,7 @@ convert_fname (char *fname) + const char *from_encoding = opt.encoding_remote; + const char *to_encoding = opt.locale; + iconv_t cd; +- size_t len, done, inlen, outlen; ++ size_t len, inlen, outlen; + char *s; + const char *orig_fname; + +@@ -1605,7 +1605,6 @@ convert_fname (char *fname) + inlen = strlen (fname); + len = outlen = inlen * 2; + converted_fname = s = xmalloc (outlen + 1); +- done = 0; + + for (;;) + { +@@ -1613,7 +1612,7 @@ convert_fname (char *fname) + if (iconv (cd, (ICONV_CONST char **) &fname, &inlen, &s, &outlen) == 0 + && iconv (cd, NULL, NULL, &s, &outlen) == 0) + { +- *(converted_fname + len - outlen - done) = '\0'; ++ *s = '\0'; + iconv_close (cd); + DEBUGP (("Converted file name '%s' (%s) -> '%s' (%s)\n", + orig_fname, from_encoding, converted_fname, to_encoding)); +@@ -1636,10 +1635,17 @@ convert_fname (char *fname) + } + else if (errno == E2BIG) /* Output buffer full */ + { +- done = len; +- len = outlen = done + inlen * 2; +- converted_fname = xrealloc (converted_fname, outlen + 1); +- s = converted_fname + done; ++ size_t used = s - converted_fname; ++ size_t newlen = used + inlen * 2 + 1; ++ ++ /* Ensure we actually grow the buffer */ ++ if (newlen <= len) ++ newlen = len * 2; ++ ++ converted_fname = xrealloc (converted_fname, newlen + 1); ++ len = newlen; ++ s = converted_fname + used; ++ outlen = len - used; + } + else /* Weird, we got an unspecified error */ + { diff --git a/wget.spec b/wget.spec index f2e5b77..981e3d7 100644 --- a/wget.spec +++ b/wget.spec @@ -1,7 +1,7 @@ Summary: A utility for retrieving files using the HTTP or FTP protocols Name: wget Version: 1.19.5 -Release: 13%{?dist} +Release: 14%{?dist} License: GPLv3+ Group: Applications/Internet Url: http://www.gnu.org/software/wget/ @@ -27,6 +27,8 @@ Patch13: wget-1.19.5-CVE-2024-38428.patch # https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812 # https://gitlab.com/gnuwget/wget/-/commit/f76978a51ba9365e7ecaed96c1cfb73197a38ca2 Patch14: wget-1.19.5-CVE-2026-58472.patch +# https://gitlab.com/gnuwget/wget/-/commit/3514c0f2ad4e3d8a2e9ad0893accdb7a21cae729 +Patch15: wget-1.19.5-CVE-2026-58471.patch Provides: webclient Provides: bundled(gnulib) @@ -66,6 +68,7 @@ grep "PACKAGE_STRING='wget .* (Red Hat modified)'" configure || exit 1 %patch12 -p1 -b .no-log-quiet %patch13 -p1 -b .CVE-2024-38428 %patch14 -p1 -b .CVE-2026-58472 +%patch15 -p1 -b .CVE-2026-58471 %build %configure \ @@ -112,6 +115,10 @@ rm -rf $RPM_BUILD_ROOT %{_infodir}/* %changelog +* Wed Jul 15 2026 RHEL Packaging Agent - 1.19.5-14 +- Fix CVE-2026-58471: buffer overflow in convert_fname() +- Resolves: RHEL-194519 + * Wed Jul 15 2026 RHEL Packaging Agent - 1.19.5-13 - Fix CVE-2026-58472: integer and buffer overflow in html_quote_string() - Resolves: RHEL-210627