[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <E3B21524-35E5-470E-811A-E1083454B56E@aevum.de>
Date: Fri, 14 Feb 2025 11:14:28 +0100
From: Nick Wellnhofer <wellnhofer@...um.de>
To: musl@...ts.openwall.com,
danielgutson@...il.com
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE-2025-26519: musl libc: input-controlled out-of-bounds
write primitive in iconv()
On Feb 13, 2025, at 23:28, Daniel Gutson <danielgutson@...il.com> wrote:
>
> Curious: is there any info about how this was discovered?
The bug was discovered with basic fuzz testing. As libxml2 maintainer, I found more and more issues in various iconv implementations by accident which is a strong indicator that all this code isn't tested enough. The iconv API is also trivial to fuzz, so it seemed like a nice weekend project.
Nick
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
