The branch, master has been updated
       via  f91df3191bc iconv: fixed coverity issue CID1609382
      from  16201d54151 s3:lib: Fix CID 1497484 use-after-free.

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit f91df3191bca58215bb3d2d76b21e49be39fab3c
Author: Xavi Hernandez <xhernan...@gmail.com>
Date:   Tue Jul 29 10:31:45 2025 +0200

    iconv: fixed coverity issue CID1609382
    
    The issue is not a real bug as it is implemented, but it's better to not
    mix signed and unsigned types to avoid potential future issues.
    
    Signed-off-by: Xavi Hernandez <xhernan...@gmail.com>
    Reviewed-by: Anoop C S <anoo...@samba.org>
    Reviewed-by: Gary Lockyer <g...@catalyst.net.nz>
    
    Autobuild-User(master): Douglas Bagnall <dbagn...@samba.org>
    Autobuild-Date(master): Wed Jul 30 00:44:28 UTC 2025 on atb-devel-224

-----------------------------------------------------------------------

Summary of changes:
 lib/util/charset/tests/iconv.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)


Changeset truncated at 500 lines:

diff --git a/lib/util/charset/tests/iconv.c b/lib/util/charset/tests/iconv.c
index 2139795d0a8..3851aaf4f76 100644
--- a/lib/util/charset/tests/iconv.c
+++ b/lib/util/charset/tests/iconv.c
@@ -349,14 +349,18 @@ static bool test_buffer(struct torture_context *test,
 static bool test_codepoint(struct torture_context *tctx, unsigned int 
codepoint)
 {
        uint8_t buf[10];
-       size_t size, size2;
+       ssize_t size;
+       size_t size2;
        codepoint_t c;
 
        size = push_codepoint_handle(lpcfg_iconv_handle(tctx->lp_ctx), (char 
*)buf, codepoint);
-       torture_assert(tctx, size != -1 || (codepoint >= 0xd800 && codepoint <= 
0x10000), 
+       torture_assert(tctx,
+                      size >= 0 ||
+                              (codepoint >= 0xd800 && codepoint <= 0x10000),
                       "Invalid Codepoint range");
 
-       if (size == -1) return true;
+       if (size < 0)
+               return true;
 
        buf[size] = random();
        buf[size+1] = random();


-- 
Samba Shared Repository

Reply via email to