Package: libcxxtools6
Version: 1.4.8-3
Severity: important
Tags: patch

SIGSEG happends when invalid character during conversion found, because unsigned size_t is never less than 0 and nputs() calls overflow() which calls npus() recursively.

-- System Information:
Debian Release: 6.0.2
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.32-bpo.4edois1-openvz-amd64 (SMP w/16 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages libcxxtools6 depends on:
ii libc6 2.11.2-10 Embedded GNU C Library: Shared lib
ii  libgcc1                       1:4.4.5-8  GCC support library
ii  libstdc++6                    4.4.5-8    The GNU Standard C++ Library v3

libcxxtools6 recommends no packages.

libcxxtools6 suggests no packages.

-- no debconf information

From 36cd86df9d2ee614846141ecaa916c7e87ceb3c7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ji=C5=99=C3=AD=20Pinkava?= <jiri.pink...@firma.seznam.cz>
Date: Wed, 3 Aug 2011 19:23:01 +0200
Subject: [PATCH] fix: invalid result comparsion from iconv.

size_t is never less than 0 because is unsigned.
---
 src/iconvstream.cpp |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/src/iconvstream.cpp b/src/iconvstream.cpp
index 1dccf5e..c263232 100644
--- a/src/iconvstream.cpp
+++ b/src/iconvstream.cpp
@@ -122,7 +122,7 @@ iconvstreambuf::int_type iconvstreambuf::overflow(int_type 
c)
           &inbufptr, &inbytesleft,
           &outbufptr, &outbytesleft);
 
-    if (s < 0 && errno != 0 && errno != EINVAL && errno != E2BIG)
+    if (s == size_t(-1) && errno != 0 && errno != EINVAL && errno != E2BIG)
     {
       log_warn("convert failed");
       return traits_type::eof();
-- 
1.7.2.5

Reply via email to