REDHAT-BUG-2547411: Low severity GNU m17n-lib vulnerability
A flaw was found in m17n-lib. A partial failure during m17ninit() can leave the internal minputdriver pointer NULL. A subsequent call to minputopenim() can dereference this NULL pointer instead of returning an initialization error, resulting in a crash. No reproducer was supplied for this claim, and attempts to force the specific precondition (an early module-init failure inside m17ninit(), e.g. via a bogus M17NDIR) did not trigger it directly -- the library tolerates a missing or invalid database path gracefully in the tested configuration. Source review of src/m17n.c confirms the claimed code path is real: m17ninit() calls a chain of module initializers (mcharsetinit, mcodinginit, mcharsetloadfromdatabase, mcodingloadfromdatabase, mlanginit, mlocaleinit) and jumps to an err: label on the first failure, which skips the subsequent minputinit() call entirely. minputinit() is the only place the global minputdriver pointer is assigned; it is NULL otherwise. src/input.c:4786 then does driver = minputdriver; and src/input.c:4799 dereferences it unconditionally via im->driver = driver; with no NULL check. The crash is real but requires one of the six earlier module initializers to fail first (e.g. under memory pressure or a corrupted system m17n database), a narrower precondition than the other three issues reported alongside this one. No live reproduction was achieved; this assessment is based on code review alone.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for the crash to occur?
One of the early module initializers called by m17n_init() must fail, causing initialization to exit before minput__init() assigns the internal minput_driver pointer. The application must then call minput_open_im(), which dereferences that still-NULL pointer.
Are deployments using an invalid or missing M17NDIR necessarily exposed?
Not based on the available testing. Attempts to trigger the condition with a bogus M17NDIR did not reproduce the crash because the tested library configuration tolerated a missing or invalid database path gracefully.
What can be done if an update is not immediately available?
Ensure callers do not proceed to minput_open_im() after m17n_init() reports a failure. Investigate and correct failures in the initialization chain so that m17n_init() completes before input methods are opened.
How can an application be identified as potentially affected?
An application is potentially affected if it can continue execution after a partial m17n_init() failure and later invokes minput_open_im(). The expected result is a crash from an unconditional dereference of the uninitialized input-driver pointer.