REDHAT-BUG-2550285: Low severity GNU m17n-lib vulnerability
A flaw was found in m17n-lib. The decodecodingiso2022() function in src/coding.c reads uninitialized stack memory when decoding crafted input using the ISO-2022 Compound Text extension. An ESC % G escape sequence activates UTF-8 shifting, after which an invalid UTF-8 lead byte of 0xFE or 0xFF causes CHARBYTESBYHEAD() to return zero. The decoder skips the continuation-byte initialization loop, leaving buf[1] through buf[5] of its local int buf[6] array uninitialized, but still passes the buffer to UTF8CHARSET() and STRINGCHARUTF8(). The resulting character value can incorporate data from uninitialized stack contents and be stored in the decoded text. An attacker able to supply input to an application using this decoding path may cause nondeterministic output and potentially limited information disclosure if the application exposes the decoded values. Reliable disclosure of sensitive process memory has not been demonstrated.
Affected Software
Event History
Frequently Asked Questions
What input and decoding path are required to trigger this issue?
An attacker must be able to supply crafted input to an application that uses m17n-lib's ISO-2022 Compound Text decoding path. The input activates UTF-8 shifting with an ESC % G sequence and then supplies an invalid UTF-8 lead byte of 0xFE or 0xFF.
What is the practical impact?
The decoder may incorporate uninitialized stack data into a decoded character value, producing nondeterministic output. Limited information disclosure is possible only if the application exposes those decoded values; reliable disclosure of sensitive process memory has not been demonstrated.
How can I tell whether an application may be affected?
Identify applications using GNU m17n-lib that decode untrusted or externally supplied ISO-2022 Compound Text. Exposure depends on whether an attacker can provide the required crafted input and whether decoded output is exposed by the application.