From eb49e00e285776a333e83e44c9c64eaf3e37d9d9 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Mon, 3 Aug 2026 11:54:09 +0000 Subject: [PATCH] Fix CVE-2026-58471: buffer overflow in convert_fname() Backport upstream commit c2640fe5171c to fix a buffer overflow in src/url.c convert_fname() (CVE-2026-58471). The bug was in incorrect buffer size handling during iconv filename conversion, where the output buffer tracking used wrong offset calculations. The patch corrects the reallocation logic in the E2BIG branch and simplifies the null-termination of the converted string. CVE: CVE-2026-58471 Upstream patches: - https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee.patch Resolves: RHEL-194521 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- wget-1.21-CVE-2026-58471.patch | 65 ++++++++++++++++++++++++++++++++++ wget.spec | 8 ++++- 2 files changed, 72 insertions(+), 1 deletion(-) create mode 100644 wget-1.21-CVE-2026-58471.patch diff --git a/wget-1.21-CVE-2026-58471.patch b/wget-1.21-CVE-2026-58471.patch new file mode 100644 index 0000000..03e7835 --- /dev/null +++ b/wget-1.21-CVE-2026-58471.patch @@ -0,0 +1,65 @@ +From 3752ed91e8aa23b76e1ab9a4fde182bb3865cb6e Mon Sep 17 00:00:00 2001 +From: Arkadi Vainbrand +Date: Tue, 13 Jan 2026 12:22:04 +0200 +Subject: [PATCH] Fix buffer size handling in filename conversion + +* src/url.c (convert_fname): Fix buffer overflow. + +Copyright-paperwork-exempt: Yes +Signed-off-by: Arkadi Vainbrand +--- + src/url.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/src/url.c b/src/url.c +index acdfe2c..e4d2520 100644 +--- a/src/url.c ++++ b/src/url.c +@@ -1599,7 +1599,7 @@ convert_fname (char *fname) + const char *from_encoding = opt.encoding_remote; + const char *to_encoding = opt.locale; + iconv_t cd; +- size_t len, done, inlen, outlen; ++ size_t len, inlen, outlen; + char *s; + const char *orig_fname; + +@@ -1621,7 +1621,6 @@ convert_fname (char *fname) + inlen = strlen (fname); + len = outlen = inlen * 2; + converted_fname = s = xmalloc (outlen + 1); +- done = 0; + + for (;;) + { +@@ -1629,7 +1628,7 @@ convert_fname (char *fname) + if (iconv (cd, (ICONV_CONST char **) &fname, &inlen, &s, &outlen) == 0 + && iconv (cd, NULL, NULL, &s, &outlen) == 0) + { +- *(converted_fname + len - outlen - done) = '\0'; ++ *s = '\0'; + iconv_close (cd); + DEBUGP (("Converted file name '%s' (%s) -> '%s' (%s)\n", + orig_fname, from_encoding, converted_fname, to_encoding)); +@@ -1652,10 +1651,17 @@ convert_fname (char *fname) + } + else if (errno == E2BIG) /* Output buffer full */ + { +- done = len; +- len = outlen = done + inlen * 2; +- converted_fname = xrealloc (converted_fname, outlen + 1); +- s = converted_fname + done; ++ size_t used = s - converted_fname; ++ size_t newlen = used + inlen * 2 + 1; ++ ++ /* Ensure we actually grow the buffer */ ++ if (newlen <= len) ++ newlen = len * 2; ++ ++ converted_fname = xrealloc (converted_fname, newlen + 1); ++ len = newlen; ++ s = converted_fname + used; ++ outlen = len - used; + } + else /* Weird, we got an unspecified error */ + { diff --git a/wget.spec b/wget.spec index 6d53b7b..86057bb 100644 --- a/wget.spec +++ b/wget.spec @@ -1,7 +1,7 @@ Summary: A utility for retrieving files using the HTTP or FTP protocols Name: wget Version: 1.21.1 -Release: 9%{?dist} +Release: 10%{?dist} License: GPLv3+ Url: http://www.gnu.org/software/wget/ Source: ftp://ftp.gnu.org/gnu/wget/wget-%{version}.tar.gz @@ -14,6 +14,8 @@ Patch5: wget-1.21-CVE-2024-38428.patch # https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812 # https://gitlab.com/gnuwget/wget/-/commit/f76978a51ba9365e7ecaed96c1cfb73197a38ca2 Patch6: wget-1.21-CVE-2026-58472.patch +# https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee +Patch7: wget-1.21-CVE-2026-58471.patch Provides: webclient Provides: bundled(gnulib) @@ -73,6 +75,10 @@ make check %{_infodir}/* %changelog +* Mon Aug 03 2026 RHEL Packaging Agent - 1.21.1-10 +- Fix CVE-2026-58471: buffer overflow in convert_fname() +- Resolves: RHEL-194521 + * Wed Jul 15 2026 RHEL Packaging Agent - 1.21.1-9 - Resolves: RHEL-210636 - Fix integer+buffer overflow in html_quote_string()