uniq: fix read overrun with -w

Problem reported by Michał Majchrowicz.
* src/uniq.c (find_field): Fix typo.
* tests/uniq/uniq.pl (add_z_variants): Test for the bug.

diff --git a/NEWS b/NEWS
index a827cf0d98d42915a9ab6c88e2191450a79c7423..d783176691294f41ff2838d8fec351fe1a823bd3 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,9 @@ GNU coreutils NEWS                                    -*- outline -*-
   mistakenly exit with a nonzero status.
   [This bug was present in "the beginning".]
 
   mistakenly exit with a nonzero status.
   [This bug was present in "the beginning".]
 

+  'uniq -w' no longer overruns the read buffer in multibyte locales.
+  [bug introduced in coreutils-9.5]
+

 
 * Noteworthy changes in release 9.11 (2026-04-20) [stable]
 
 
 * Noteworthy changes in release 9.11 (2026-04-20) [stable]
 

diff --git a/THANKS.in b/THANKS.in
index 35fee752b5940c6a199813c01486b4946cde4346..5a2fd35015634a96a6d36658bf3e6a4ff0bcec15 100644 (file)
--- a/THANKS.in
+++ b/THANKS.in
@@ -459,6 +459,7 @@ Michail Litvak                      mci@owl.openwall.com
 Michal Politowski                   mpol@charybda.icm.edu.pl
 Michal Svec                         msvec@suse.cz
 Michal Trunecka                     mtruneck@redhat.com
 Michal Politowski                   mpol@charybda.icm.edu.pl
 Michal Svec                         msvec@suse.cz
 Michal Trunecka                     mtruneck@redhat.com

+Michał Majchrowicz                  mmajchrowicz@afine.com

 Michel Robitaille                   robitail@IRO.UMontreal.CA
 Michiel Bacchiani                   bacchian@raven.bu.edu
 Mike Castle                         dalgoda@ix.netcom.com
 Michel Robitaille                   robitail@IRO.UMontreal.CA
 Michiel Bacchiani                   bacchian@raven.bu.edu
 Mike Castle                         dalgoda@ix.netcom.com

diff --git a/src/uniq.c b/src/uniq.c
index 30463598a58e3005e4a3b798d4c66371d2eab404..5834596f988185ab2b305135e68e45fd57cca878 100644 (file)
--- a/src/uniq.c
+++ b/src/uniq.c
@@ -285,8 +285,8 @@ find_field (struct linebuffer const *line, idx_t *plen)
   else
     {
       char *ep = lp;
   else
     {
       char *ep = lp;

-      for (idx_t i = check_chars; 0 < i && lp < lim; i--)
-        ep += mcel_scan (lp, lim).len;
+      for (idx_t i = check_chars; 0 < i && ep < lim; i--)
+        ep += mcel_scan (ep, lim).len;

       len = ep - lp;
     }
 
       len = ep - lp;
     }
 

diff --git a/tests/uniq/uniq.pl b/tests/uniq/uniq.pl
index b558fb3ee20385f2e8225c3935e77257cee30085..0df7ec62d7996aa642e3c4a90b40bbd9814e1c88 100755 (executable)
--- a/tests/uniq/uniq.pl
+++ b/tests/uniq/uniq.pl
@@ -234,6 +234,9 @@ my @Tests =
         "  - 'separate'\n" .
         "  - 'both'\n" .
         "Try '$prog --help' for more information.\n"}],
         "  - 'separate'\n" .
         "  - 'both'\n" .
         "Try '$prog --help' for more information.\n"}],

+ # Test for read buffer overrun.
+ do { my $longline = "\360\237\230\200" . "A" x 255 . "\n";
+      ['146', '-w256', {IN  => $longline x 2}, {OUT => $longline}] },

 );
 
 # Locale related tests
 );
 
 # Locale related tests