From: logical-misha <220645577+logical-misha@users.noreply.github.com>
Date: Tue, 21 Jul 2026 04:55:43 +0000 (+0000)
Subject: more: fix out-of-bounds write in get_line() on invalid multibyte input
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=e63ab5126a41c9709d975d29dadf49fde0eefd35;p=thirdparty%2Futil-linux.git

more: fix out-of-bounds write in get_line() on invalid multibyte input

In get_line(), the invalid-multibyte switch arm (case (size_t)-1) writes
*p++ = mbc[0] without the bounds check that its sibling write paths use,
and the "goto process_mbc" back-edge lets it re-run within one loop
iteration, bypassing the loop-head guard. A line that first fills line_buf
with zero-width combining characters (which advance p but not column) and
then supplies an invalid multibyte sequence can step p past the
num_columns*4 + 2 byte allocation -- a heap out-of-bounds write.

Guard the write the same way the sibling path does.

Closes #4494

Signed-off-by: logical-misha <220645577+logical-misha@users.noreply.github.com>
---

diff --git a/text-utils/more.c b/text-utils/more.c
index 9cea37356..6f7140e71 100644
--- a/text-utils/more.c
+++ b/text-utils/more.c
@@ -551,6 +551,8 @@ static int get_line(struct more_control *ctl, int *length)
 				break;
 
 			case (size_t)-1:	/* Invalid as a multibyte character. */
+				if (p >= &ctl->line_buf[ctl->line_sz - 1])
+					break;
 				*p++ = mbc[0];
 				state = state_bak;
 				column++;