buglibiconv - Bugs: bug #34916, Bad input with //IGNORE triggers...

 
 

bug #34916: Bad input with //IGNORE triggers abort() in unicode_loop_convert()

Submitted by:  None
Submitted on:  Sun 27 Nov 2011 11:47:11 PM UTC  
 
Category: ConvertersSeverity: 4 - Important
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Bruno Haible <haible>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 28 Nov 2011 01:27:40 AM UTC, comment #2:

Thank you very much for this report.

Find attached a patch that fixes the problem.

If you tell your name, you will be honored through a
"Reported by ..." line in the ChangeLog.

(file #24477)

Bruno Haible <haible>
Project AdministratorIn charge of this item.
Mon 28 Nov 2011 12:00:03 AM UTC, comment #1:

Sorry, I forgot savannah interprets text. Here is the gdb info again.

And the test case.

Anonymous
Sun 27 Nov 2011 11:47:11 PM UTC, original submission:

Seen with v1.14. gdb info and a test case follow. //IGNORE triggers an abort() at loop_unicode.h:422, //TRANSLIT (or nothing) does not.

====================

$ gdb -q --args tmp/issue20
Reading symbols from /home/bnoordhuis/src/nodejs/node-iconv/tmp/issue20...done.
(gdb) r
Starting program: /home/bnoordhuis/src/nodejs/node-iconv/tmp/issue20

Program received signal SIGABRT, Aborted.
0x00007ffff7a8da75 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
in ../nptl/sysdeps/unix/sysv/linux/raise.c
(gdb) bt
#0 0x00007ffff7a8da75 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1 0x00007ffff7a915c0 in *__GI_abort () at abort.c:92
#2 0x0000000000420fea in unicode_loop_convert (icd=0x708010, inbuf=0x7fffffffdcb8, inbytesleft=0x7fffffffdca8, outbuf=0x7fffffffdcb0, outbytesleft=0x7fffffffdca0) at ./loop_unicode.h:422
#3 0x00000000004228bf in libiconv (icd=0x708010, inbuf=0x7fffffffdcb8, inbytesleft=0x7fffffffdca8, outbuf=0x7fffffffdcb0, outbytesleft=0x7fffffffdca0) at ./iconv.c:254
#4 0x0000000000400dc2 in main ()
(gdb) f 2
#2 0x0000000000420fea in unicode_loop_convert (icd=0x708010, inbuf=0x7fffffffdcb8, inbytesleft=0x7fffffffdca8, outbuf=0x7fffffffdcb0, outbytesleft=0x7fffffffdca0) at ./loop_unicode.h:422
422 if (!(incount <= inleft)) abort();
(gdb) l
417 #endif
418 if (!(outcount <= outleft)) abort();
419 outptr += outcount; outleft -= outcount;
420 }
421 outcount_zero:
422 if (!(incount <= inleft)) abort();
423 inptr += incount; inleft -= incount;
424 }
425 inbuf = (const char) inptr;
426 *inbytesleft = inleft;

====================

#include <stddef.h>
#include "iconv.h"

static char input[] = "P{\373\000\000\000\000\000\200\321\377\377\377\177\000\000\b\324\377\377\377\177\000\000\360<\367\000\000\000\000\000\b\324\377\377\377\177\000\000l\000\000\000\000\000\000\000\003\000\000\000\000\000\000\000\020\324\377\377\377\177\000\000\351\340w\365\377\177\000\000\240Q\366\000\000\000\000\000\060\363\371\000\000\000\000\000\060\363\371\000\000\000\000\000\000Q\366\000\000\000\000\000\340\321\377\377";

int main(void)
{
char inbuf, outbuf;
size_t insz, outsz;
char output[16];
iconv_t iv;

inbuf = input, insz = sizeof(input) - 1;
outbuf = output, outsz = sizeof(output);

iv = iconv_open("UTF-8//IGNORE", "UTF-32");
iconv(iv, &inbuf, &insz, &outbuf, &outsz); // triggers abort()

return 0;
}

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #24477:  bug34916.diff added by haible (3KiB - text/x-patch - bug fix)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by haible (Updated the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 23 Nov 2016 11:58:16 PM UTChaibleCategoryNone=>Converters
    Mon 28 Nov 2011 01:27:40 AM UTChaibleAttached File-=>Added bug34916.diff, #24477
      Severity3 - Normal=>4 - Important
      StatusNone=>Fixed
      Assigned toNone=>haible
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1