encounter
/
SDL
mirror of https://github.com/encounter/SDL.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fixed bug 5022 - SDL_iconv_string can get stuck in an infinite loop when encountering invalid characters 

ciremo6483

In `SDL_iconv_string` the `while (inbytesleft > 0)` loop can end up in a state where it never terminates because the library `iconv` function called from `SDL_iconv` doesn't consume any bytes.

This happened when a `WCHAR_T` input string was being converted to `UTF-8` but contained invalid characters. It would first It would first skip a few bytes due to `case SDL_ICONV_EILSEQ` but when there were 3 bytes remaining of `inbytesleft` `iconv` just didn't consume anything more (but didn't throw an error either).

It just so happens that the Microsoft Classic IntelliMouse `product_string` contains such invalid characters (`"Microsoft? Classic IntelliMouse?"`), meaning the function would get stuck with said mouse plugged in.

A fix for this would be to check if `inbytesleft` was unchanged after an iteration and in that case either decrement the counter like when `SDL_ICONV_EILSEQ` is returned or simply break the loop.
This commit is contained in:
Sam Lantinga 2020-03-10 16:29:28 -07:00
parent 1f4965c8c4
commit 342f62ca69
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/stdlib/SDL_iconv.c
View File

@ -898,6 +898,7 @@ SDL_iconv_string(const char *tocode, const char *fromcode, const char *inbuf,
SDL_memset(outbuf, 0, 4); SDL_memset(outbuf, 0, 4);
while (inbytesleft > 0) { while (inbytesleft > 0) {
const size_t oldinbytesleft = inbytesleft;
retCode = SDL_iconv(cd, &inbuf, &inbytesleft, &outbuf, &outbytesleft); retCode = SDL_iconv(cd, &inbuf, &inbytesleft, &outbuf, &outbytesleft);
switch (retCode) { switch (retCode) {
case SDL_ICONV_E2BIG: case SDL_ICONV_E2BIG:
@ -925,6 +926,11 @@ SDL_iconv_string(const char *tocode, const char *fromcode, const char *inbuf,
inbytesleft = 0; inbytesleft = 0;
break; break;
} }
/* Avoid infinite loops when nothing gets converted */
if (oldinbytesleft == inbytesleft)
{
break;
}
} }
SDL_iconv_close(cd); SDL_iconv_close(cd);