From: Florian Weimer Date: Fri, 28 Nov 2025 10:46:09 +0000 (+0100) Subject: iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e98bd0c54d5e296ad1be91b6fe35260c6b87e733;p=thirdparty%2Fglibc.git iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module The expression inptr + 1 can technically be invalid: if inptr == inend, inptr may point one element past the end of an array. Reviewed-by: Adhemerval Zanella --- diff --git a/iconvdata/ansi_x3.110.c b/iconvdata/ansi_x3.110.c index c5506b13b8..94e6e6b745 100644 --- a/iconvdata/ansi_x3.110.c +++ b/iconvdata/ansi_x3.110.c @@ -407,7 +407,7 @@ static const char from_ucs4[][2] = is also available. */ \ uint32_t ch2; \ \ - if (inptr + 1 >= inend) \ + if (inend - inptr <= 1) \ { \ /* The second character is not available. */ \ result = __GCONV_INCOMPLETE_INPUT; \