Fix CVE-2026-58471: buffer overflow in convert_fname()

Backport upstream commit c2640fe5171c to fix a buffer overflow
in src/url.c convert_fname() (CVE-2026-58471). The bug was in
incorrect buffer size handling during iconv filename conversion,
where the output buffer tracking used wrong offset calculations.
The patch corrects the reallocation logic in the E2BIG branch
and simplifies the null-termination of the converted string.

CVE: CVE-2026-58471
Upstream patches:
 - c2640fe517.patch
Resolves: RHEL-194521

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir

wget-1.21-CVE-2026-58471.patch

@@ -0,0 +1,65 @@
+From 3752ed91e8aa23b76e1ab9a4fde182bb3865cb6e Mon Sep 17 00:00:00 2001
+From: Arkadi Vainbrand <arkadva8@gmail.com>
+Date: Tue, 13 Jan 2026 12:22:04 +0200
+Subject: [PATCH] Fix buffer size handling in filename conversion
+
+* src/url.c (convert_fname): Fix buffer overflow.
+
+Copyright-paperwork-exempt: Yes
+Signed-off-by: Arkadi Vainbrand <arkadva8@gmail.com>
+---
+ src/url.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/src/url.c b/src/url.c
+index acdfe2c..e4d2520 100644
+--- a/src/url.c
++++ b/src/url.c
+@@ -1599,7 +1599,7 @@ convert_fname (char *fname)
+   const char *from_encoding = opt.encoding_remote;
+   const char *to_encoding = opt.locale;
+   iconv_t cd;
+-  size_t len, done, inlen, outlen;
++  size_t len, inlen, outlen;
+   char *s;
+   const char *orig_fname;
+ 
+@@ -1621,7 +1621,6 @@ convert_fname (char *fname)
+   inlen = strlen (fname);
+   len = outlen = inlen * 2;
+   converted_fname = s = xmalloc (outlen + 1);
+-  done = 0;
+ 
+   for (;;)
+     {
+@@ -1629,7 +1628,7 @@ convert_fname (char *fname)
+       if (iconv (cd, (ICONV_CONST char **) &fname, &inlen, &s, &outlen) == 0
+           && iconv (cd, NULL, NULL, &s, &outlen) == 0)
+         {
+-          *(converted_fname + len - outlen - done) = '\0';
++          *s = '\0';
+           iconv_close (cd);
+           DEBUGP (("Converted file name '%s' (%s) -> '%s' (%s)\n",
+                    orig_fname, from_encoding, converted_fname, to_encoding));
+@@ -1652,10 +1651,17 @@ convert_fname (char *fname)
+         }
+       else if (errno == E2BIG) /* Output buffer full */
+         {
+-          done = len;
+-          len = outlen = done + inlen * 2;
+-          converted_fname = xrealloc (converted_fname, outlen + 1);
+-          s = converted_fname + done;
++          size_t used = s - converted_fname;
++          size_t newlen = used + inlen * 2 + 1;
++
++          /* Ensure we actually grow the buffer */
++          if (newlen <= len)
++            newlen = len * 2;
++
++          converted_fname = xrealloc (converted_fname, newlen + 1);
++          len = newlen;
++          s = converted_fname + used;
++          outlen = len - used;
+         }
+       else /* Weird, we got an unspecified error */
+         {

wget.spec

@@ -1,7 +1,7 @@
 Summary: A utility for retrieving files using the HTTP or FTP protocols
 Name: wget
 Version: 1.21.1
-Release: 9%{?dist}
+Release: 10%{?dist}
 License: GPLv3+
 Url: http://www.gnu.org/software/wget/
 Source: ftp://ftp.gnu.org/gnu/wget/wget-%{version}.tar.gz
@@ -14,6 +14,8 @@ Patch5: wget-1.21-CVE-2024-38428.patch
 # https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812
 # https://gitlab.com/gnuwget/wget/-/commit/f76978a51ba9365e7ecaed96c1cfb73197a38ca2
 Patch6: wget-1.21-CVE-2026-58472.patch
+# https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee
+Patch7: wget-1.21-CVE-2026-58471.patch
 
 Provides: webclient
 Provides: bundled(gnulib) 
@@ -73,6 +75,10 @@ make check
 %{_infodir}/*
 
 %changelog
+* Mon Aug 03 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.21.1-10
+- Fix CVE-2026-58471: buffer overflow in convert_fname()
+- Resolves: RHEL-194521
+
 * Wed Jul 15 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.21.1-9
 - Resolves: RHEL-210636 - Fix integer+buffer overflow in html_quote_string()