From 890beb19e6fdb23d7cfeeac212d7fe3a3d98e409 Mon Sep 17 00:00:00 2001 From: Brad King Date: Mon, 15 Jul 2024 15:47:31 -0400 Subject: [PATCH] libuv: backport IDNA input/output hardening fixes Backport libuv commit `0f2d7e78` (fix: always zero-terminate idna output, 2024-01-18, `v1.48.0~4`) and libuv commit `3530bcc3` (fix: reject zero-length idna inputs, 2024-01-18, `v1.48.0~3`). Fixes: #26112 --- Utilities/cmlibuv/src/idna.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/Utilities/cmlibuv/src/idna.c b/Utilities/cmlibuv/src/idna.c index 93d982ca01..858b19d00e 100644 --- a/Utilities/cmlibuv/src/idna.c +++ b/Utilities/cmlibuv/src/idna.c @@ -274,6 +274,9 @@ long uv__idna_toascii(const char* s, const char* se, char* d, char* de) { char* ds; int rc; + if (s == se) + return UV_EINVAL; + ds = d; si = s; @@ -308,8 +311,9 @@ long uv__idna_toascii(const char* s, const char* se, char* d, char* de) { return rc; } - if (d < de) - *d++ = '\0'; + if (d >= de) + return UV_EINVAL; + *d++ = '\0'; return d - ds; /* Number of bytes written. */ }