From: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date: Mon, 21 Apr 2025 20:49:31 +0000 (-0300)
Subject: iconv: Fix UB on find_derivation
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=63c5414e8180480c9443214490215006bf8f87f6;p=thirdparty%2Fglibc.git

iconv: Fix UB on find_derivation

The cost addition might overflow since the default value is
LONG_INT.  Use wrap addition instead.
---

diff --git a/iconv/gconv_db.c b/iconv/gconv_db.c
index 8895c2b2fb..a0416212ee 100644
--- a/iconv/gconv_db.c
+++ b/iconv/gconv_db.c
@@ -28,6 +28,7 @@
 #include <dlfcn.h>
 #include <gconv_int.h>
 #include <pointer_guard.h>
+#include <intprops.h>
 
 
 /* Simple data structure for alias mapping.  We have two names, `from'
@@ -507,8 +508,10 @@ find_derivation (const char *toset, const char *toset_expand,
 		  const char *result_set = (strcmp (runp->to_string, "-") == 0
 					    ? (toset_expand ?: toset)
 					    : runp->to_string);
-		  int cost_hi = runp->cost_hi + current->cost_hi;
-		  int cost_lo = runp->cost_lo + current->cost_lo;
+		  int cost_hi, cost_lo;
+		  INT_ADD_WRAPV (runp->cost_hi, current->cost_hi, &cost_hi);
+		  INT_ADD_WRAPV (runp->cost_lo, current->cost_lo, &cost_lo);
+
 		  struct derivation_step *step;
 
 		  /* We managed to find a derivation.  First see whether