From: Paul Eggert <eggert@cs.ucla.edu>
Date: Tue, 28 Apr 2026 18:25:00 +0000 (-0700)
Subject: uniq: fix read overrun with -w
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;p=thirdparty%2Fcoreutils.git

uniq: fix read overrun with -w

Problem reported by Michał Majchrowicz.
* src/uniq.c (find_field): Fix typo.
* tests/uniq/uniq.pl (add_z_variants): Test for the bug.
---

diff --git a/NEWS b/NEWS
index a827cf0d98..d783176691 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,9 @@ GNU coreutils NEWS                                    -*- outline -*-
   mistakenly exit with a nonzero status.
   [This bug was present in "the beginning".]
 
+  'uniq -w' no longer overruns the read buffer in multibyte locales.
+  [bug introduced in coreutils-9.5]
+
 
 * Noteworthy changes in release 9.11 (2026-04-20) [stable]
 
diff --git a/THANKS.in b/THANKS.in
index 35fee752b5..5a2fd35015 100644
--- a/THANKS.in
+++ b/THANKS.in
@@ -459,6 +459,7 @@ Michail Litvak                      mci@owl.openwall.com
 Michal Politowski                   mpol@charybda.icm.edu.pl
 Michal Svec                         msvec@suse.cz
 Michal Trunecka                     mtruneck@redhat.com
+Michał Majchrowicz                  mmajchrowicz@afine.com
 Michel Robitaille                   robitail@IRO.UMontreal.CA
 Michiel Bacchiani                   bacchian@raven.bu.edu
 Mike Castle                         dalgoda@ix.netcom.com
diff --git a/src/uniq.c b/src/uniq.c
index 30463598a5..5834596f98 100644
--- a/src/uniq.c
+++ b/src/uniq.c
@@ -285,8 +285,8 @@ find_field (struct linebuffer const *line, idx_t *plen)
   else
     {
       char *ep = lp;
-      for (idx_t i = check_chars; 0 < i && lp < lim; i--)
-        ep += mcel_scan (lp, lim).len;
+      for (idx_t i = check_chars; 0 < i && ep < lim; i--)
+        ep += mcel_scan (ep, lim).len;
       len = ep - lp;
     }
 
diff --git a/tests/uniq/uniq.pl b/tests/uniq/uniq.pl
index b558fb3ee2..0df7ec62d7 100755
--- a/tests/uniq/uniq.pl
+++ b/tests/uniq/uniq.pl
@@ -234,6 +234,9 @@ my @Tests =
         "  - 'separate'\n" .
         "  - 'both'\n" .
         "Try '$prog --help' for more information.\n"}],
+ # Test for read buffer overrun.
+ do { my $longline = "\360\237\230\200" . "A" x 255 . "\n";
+      ['146', '-w256', {IN  => $longline x 2}, {OUT => $longline}] },
 );
 
 # Locale related tests