[email protected] writes: > I found a use of uninitialized memory in Libidn's ToUnicode round-trip > verification while fuzzing the project with DMSAN, my sanitizer tool > for detecting uses of uninitialized memory. The issue is in the > `lib/idna.c` library code; I use `idna_to_unicode_8z8z()` below > because it is a small public API path that reaches the affected code. > > The root cause is in `idna_to_unicode_internal()`. It removes the > `xn--` prefix, decodes the remaining Punycode suffix, calls > `idna_to_ascii_4i()` into a local stack buffer, and then compares > against `tmpout + strlen(IDNA_ACE_PREFIX)`:
Thank you for analysis and report! Indeed, I was able to reproduce your finding with valgrind and clang MSAN on one of our existing fuzz test vectors. I adopted your simplest suggested fix, and have released version 1.44 with this change. I hope your or someone else can help us assign a CVE identifier. /Simon
signature.asc
Description: PGP signature
