Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.1/patches/2232009/?format=api
{ "id": 2232009, "url": "http://patchwork.ozlabs.org/api/1.1/patches/2232009/?format=api", "web_url": "http://patchwork.ozlabs.org/project/glibc/patch/20260502033908.7722-1-marocketbd@gmail.com/", "project": { "id": 41, "url": "http://patchwork.ozlabs.org/api/1.1/projects/41/?format=api", "name": "GNU C Library", "link_name": "glibc", "list_id": "libc-alpha.sourceware.org", "list_email": "libc-alpha@sourceware.org", "web_url": "", "scm_url": "", "webscm_url": "" }, "msgid": "<20260502033908.7722-1-marocketbd@gmail.com>", "date": "2026-05-02T03:39:07", "name": "[v5] libio: Fix ungetwc operating on byte stream [BZ #33998]", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "2b67254b340d510bc112aa6f29278e07de8351e5", "submitter": { "id": 92898, "url": "http://patchwork.ozlabs.org/api/1.1/people/92898/?format=api", "name": "Rocket Ma", "email": "marocketbd@gmail.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/glibc/patch/20260502033908.7722-1-marocketbd@gmail.com/mbox/", "series": [ { "id": 502512, "url": "http://patchwork.ozlabs.org/api/1.1/series/502512/?format=api", "web_url": "http://patchwork.ozlabs.org/project/glibc/list/?series=502512", "date": "2026-05-02T03:39:07", "name": "[v5] libio: Fix ungetwc operating on byte stream [BZ #33998]", "version": 5, "mbox": "http://patchwork.ozlabs.org/series/502512/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2232009/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2232009/checks/", "tags": {}, "headers": { "Return-Path": "<libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "libc-alpha@sourceware.org" ], "Delivered-To": [ "patchwork-incoming@legolas.ozlabs.org", "libc-alpha@sourceware.org" ], "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256\n header.s=20251104 header.b=mX0iMnXg;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org\n (client-ip=2620:52:6:3111::32; helo=vm01.sourceware.org;\n envelope-from=libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org;\n receiver=patchwork.ozlabs.org)", "sourceware.org;\n\tdkim=pass (2048-bit key,\n unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256\n header.s=20251104 header.b=mX0iMnXg", "sourceware.org;\n dmarc=pass (p=none dis=none) header.from=gmail.com", "sourceware.org; spf=pass smtp.mailfrom=gmail.com", "server2.sourceware.org;\n arc=none smtp.remote-ip=2607:f8b0:4864:20::122d" ], "Received": [ "from vm01.sourceware.org (vm01.sourceware.org\n [IPv6:2620:52:6:3111::32])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g6tvy3zJkz1yJ0\n\tfor <incoming@patchwork.ozlabs.org>; Sat, 02 May 2026 13:39:52 +1000 (AEST)", "from vm01.sourceware.org (localhost [127.0.0.1])\n\tby sourceware.org (Postfix) with ESMTP id 02CFE46A9CC7\n\tfor <incoming@patchwork.ozlabs.org>; Sat, 2 May 2026 03:39:49 +0000 (GMT)", "from mail-dl1-x122d.google.com (mail-dl1-x122d.google.com\n [IPv6:2607:f8b0:4864:20::122d])\n by sourceware.org (Postfix) with ESMTPS id DDFAB4A968F9\n for <libc-alpha@sourceware.org>; Sat, 2 May 2026 03:39:28 +0000 (GMT)", "by mail-dl1-x122d.google.com with SMTP id\n a92af1059eb24-12c726f46baso3816643c88.1\n for <libc-alpha@sourceware.org>; Fri, 01 May 2026 20:39:28 -0700 (PDT)", "from localhost ([23.94.240.252]) by smtp.gmail.com with UTF8SMTPSA\n id\n a92af1059eb24-12df8431037sm5919475c88.12.2026.05.01.20.39.26\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Fri, 01 May 2026 20:39:26 -0700 (PDT)" ], "DKIM-Filter": [ "OpenDKIM Filter v2.11.0 sourceware.org 02CFE46A9CC7", "OpenDKIM Filter v2.11.0 sourceware.org DDFAB4A968F9" ], "DMARC-Filter": "OpenDMARC Filter v1.4.2 sourceware.org DDFAB4A968F9", "ARC-Filter": "OpenARC Filter v1.0.0 sourceware.org DDFAB4A968F9", "ARC-Seal": "i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1777693169; cv=none;\n b=sUrG1Wk8itPbg0cATmORA6QN3R+7ewma36eChdsVr99wOojg/znSwB/C2IGsR3De1jYCvQANePnGtxMbOTcrV02xyNT9AKd9BHEGB+TMq0s0+m1EGiXMHMFYm0P/iTfptWxyhE+Le5m1dtJpiQJOzPdEHFS6TZvAVvsl8hYV4Ng=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=sourceware.org; s=key;\n t=1777693169; c=relaxed/simple;\n bh=9OBxr/o9ITfXDWHQjhxtiYQhlzywxvV02VJRiwtRO1E=;\n h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version;\n b=ukbaTbp7bvxLP584uH5+2AYfkeqda6INcvohEoR7nZCQT25mzZOJSROoXDU8CHA7FP4/zi1qsNJ6CGE9qPLmDdsU8pCUVQbEAPS0R4XtXWqRWamPUseBdgCpZjKYQHI78IrgOENdsWCeB5+5uBlwQW8u8Mxl6sdPCk6ki1tcgZs=", "ARC-Authentication-Results": "i=1; server2.sourceware.org", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=gmail.com; s=20251104; t=1777693168; x=1778297968; darn=sourceware.org;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:from:to:cc:subject:date\n :message-id:reply-to;\n bh=7kmNe6nG0xYaaHCBvxqB08O9ZQVmiSxf1frjRMiNsOs=;\n b=mX0iMnXguApJQgNMsuZQKKcal8IpTCiLSmdLBaiDn9x2kF3zf9mJa2CzWyJJQ2ky0P\n 8wKGq0MwFJMGZdgDkqpGkKlCWIHQkYe6d6uZ/h2um1rAqQcGt4FZoJKvrL4lJXmxzufa\n Mu6P7uKxa36+Bgq3vhGEpBHXY8set9JDPZFU7zDWG6fJXgiaK+3n2orWwCw/k3Ln435C\n e2UFz7LdnrJmOp6ce0zcaNyQ5r8LekVl88htDFYSuJ+9Ns9GgIke3mQN8yu1e20k0KGo\n GjtnZMc8WggNbWCpvtBb/H6CMHKI0/xm3cXuoE75f1CMCHKZiPUKanrx6mgPMc/SmE8z\n z/yQ==", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1777693168; x=1778297968;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from\n :to:cc:subject:date:message-id:reply-to;\n bh=7kmNe6nG0xYaaHCBvxqB08O9ZQVmiSxf1frjRMiNsOs=;\n b=r5RE2QC83PNX7nJB2ulyIyz6ivFQNpYzFNOkpZts49NCNH4XhZvo39P0RzoJyk9aP1\n lubPgadnJNZFDU+mSs4gDuRnYn7iqw781x7GCxfDyuCaA0ExdVjkN5EQgFHpR7JKJzFK\n qoRBqVhurOIjgJOA98X7nlcIhJ4z9nImm5BmXYxCAR2pmi0OfFWdONkr5Xm4F/fTMp3N\n dbKmeGJZumK2zJJc63diKl3bzmlOqvlklGL8dNozRljAQKV1Fc9B1CEB477pYi496iS3\n J/i5a8oVYw3M678cxRqHn6oZwQQ8u/TKbVWqm036LMgNL71PpFgex5ocAvwb4wMIBEPH\n nGQg==", "X-Gm-Message-State": "AOJu0YwmtrGdq1jZqhfToOA7D5PtFRSoR3UCqjO0Fas+JMtxxxC4aQ44\n YBy3DAueU+r6wF6LPBVZHWIMxWaa+JxpFeoQi/wyQlHYM7+VKZRmTrVZ", "X-Gm-Gg": "AeBDiev+V9WrH5083cHOcvizY7zdBFYGN2Xb1nBUxx4ekFp2HM/EeOcnQLkjLfsfHGh\n MTf3npehGn+qKA32SNddhmAJ2D/eL4WdP/FpmTqQPeGnNbdXru2YKB1+gktHEDN1RPI5y+TdbST\n YgOhILn5Ta1R3Mq+ux4oQ8HLbOuw82hpe/vUuLfkyVy0CbBlwV7amDUQdE+QsZ5UZQutpWSxg0o\n gb44vYFHXuuWy/60ET1hZAaJ4kcbfbsB4grRUZGZqhb5b67Z9lP0MssNCZ2p1j4f6GBTblNJUb3\n 7XtjnA88L6njZlN2a6XHT184w0sVuzpERfFrl2JzkyjnOD51Lg5PEn78U8QMKXQip1/e+EZC+U8\n lq2Q3p5s/I6dXnYPSlSec284j2latmjgPa6u/XNo5Qle0ZSUyVRQnmPrpgNN3SXzVvfWxMprM/p\n jQEJa1lULgEtD8Ulo86YoP7sNwDTsH2rdQvHt6+LBX+xBA9abu/9p2EfUbmFF8EqgyYEactEJbq\n TDW6B26jk75rQOr77ug4PpPhfatJ0j6nw+ZIvwW7qUFdH2tFTCppjRGvAK2eg0p5CzYeEujWao=", "X-Received": "by 2002:a05:7023:b85:b0:12d:de3e:86bc with SMTP id\n a92af1059eb24-12dfd855bf7mr639780c88.44.1777693167540;\n Fri, 01 May 2026 20:39:27 -0700 (PDT)", "From": "Rocket Ma <marocketbd@gmail.com>", "To": "Florian Weimer <fweimer@redhat.com>", "Cc": "libc-alpha@sourceware.org", "Subject": "[PATCH v5] libio: Fix ungetwc operating on byte stream [BZ #33998]", "Date": "Fri, 1 May 2026 20:39:07 -0700", "Message-ID": "<20260502033908.7722-1-marocketbd@gmail.com>", "X-Mailer": "git-send-email 2.47.3", "In-Reply-To": "<lhuo6j0pgwr.fsf@oldenburg.str.redhat.com>", "References": "", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "X-BeenThere": "libc-alpha@sourceware.org", "X-Mailman-Version": "2.1.30", "Precedence": "list", "List-Id": "Libc-alpha mailing list <libc-alpha.sourceware.org>", "List-Unsubscribe": "<https://sourceware.org/mailman/options/libc-alpha>,\n <mailto:libc-alpha-request@sourceware.org?subject=unsubscribe>", "List-Archive": "<https://sourceware.org/pipermail/libc-alpha/>", "List-Post": "<mailto:libc-alpha@sourceware.org>", "List-Help": "<mailto:libc-alpha-request@sourceware.org?subject=help>", "List-Subscribe": "<https://sourceware.org/mailman/listinfo/libc-alpha>,\n <mailto:libc-alpha-request@sourceware.org?subject=subscribe>", "Errors-To": "libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org" }, "content": "* libio/wgenops.c: When _IO_wdefault_pbackfail attempts to push back one\ncharacter, it accidently compare the wchar to push back with the last\nchar from byte stream, instead of wide stream. Under specific coding,\nattacker may exploit this to leak information. This commit fix bug\n33998, or CVE-2026-5928.\n\nSigned-off-by: Rocket Ma <marocketbd@gmail.com>\n---\nUse more convenient functions from support to reduce usage of TEST_*.\nAdd some comment about the regression test.\n---\n libio/Makefile | 1 +\n libio/bug-wgenops-bz33998.c | 54 +++++++++++++++++++++++++++++++++++++\n libio/wgenops.c | 4 +--\n 3 files changed, 57 insertions(+), 2 deletions(-)\n create mode 100644 libio/bug-wgenops-bz33998.c", "diff": "diff --git a/libio/Makefile b/libio/Makefile\nindex 93656466df..6e0627bb88 100644\n--- a/libio/Makefile\n+++ b/libio/Makefile\n@@ -84,6 +84,7 @@ tests = \\\n bug-ungetwc1 \\\n bug-ungetwc2 \\\n bug-wfflush \\\n+ bug-wgenops-bz33998 \\\n bug-wmemstream1 \\\n bug-wsetpos \\\n test-fmemopen \\\ndiff --git a/libio/bug-wgenops-bz33998.c b/libio/bug-wgenops-bz33998.c\nnew file mode 100644\nindex 0000000000..cc4067da99\n--- /dev/null\n+++ b/libio/bug-wgenops-bz33998.c\n@@ -0,0 +1,54 @@\n+/* Regression test for ungetwc operating on byte stream (BZ #33998)\n+ Copyright (C) 2026 The GNU Toolchain Authors.\n+ This file is part of the GNU C Library.\n+\n+ The GNU C Library is free software; you can redistribute it and/or\n+ modify it under the terms of the GNU Lesser General Public\n+ License as published by the Free Software Foundation; either\n+ version 2.1 of the License, or (at your option) any later version.\n+\n+ The GNU C Library is distributed in the hope that it will be useful,\n+ but WITHOUT ANY WARRANTY; without even the implied warranty of\n+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\n+ Lesser General Public License for more details.\n+\n+ You should have received a copy of the GNU Lesser General Public\n+ License along with the GNU C Library; if not, see\n+ <https://www.gnu.org/licenses/>. */\n+\n+#include \"support/temp_file.h\"\n+#include \"support/xstdio.h\"\n+#include \"support/xunistd.h\"\n+#include <stdlib.h>\n+#include <unistd.h>\n+#include <sys/mman.h>\n+#include <stdio.h>\n+#include <wchar.h>\n+#include <support/check.h>\n+\n+static int\n+do_test (void)\n+{\n+ char *filename;\n+ int fd = create_temp_file (\"tst-bz33998-\", &filename);\n+ TEST_VERIFY (fd != -1);\n+ xwrite (fd, \"A\", sizeof (\"A\")); // write \"A\\0\" by design\n+ xclose (fd);\n+\n+ FILE *fp = xfopen (filename, \"r+\");\n+ TEST_COMPARE (getwc (fp), L'A');\n+ /* If the bug is fixed, then ungetwc should not touch byte stream.\n+ If the bug is not fixed, ungetwc firstly match last read char, L'A',\n+ failed, then the pbackfail branch, matching last read char in byte\n+ stream, that is, '\\0' (initialized when setup wide stream). */\n+ char *old_read_ptr = fp->_IO_read_ptr;\n+ TEST_COMPARE (ungetwc (L'\\0', fp), L'\\0');\n+ TEST_VERIFY (fp->_IO_read_ptr == old_read_ptr);\n+\n+ xfclose (fp);\n+ free (filename);\n+\n+ return 0;\n+}\n+\n+#include <support/test-driver.c>\ndiff --git a/libio/wgenops.c b/libio/wgenops.c\nindex 6829477e0c..5f36bc49a1 100644\n--- a/libio/wgenops.c\n+++ b/libio/wgenops.c\n@@ -110,8 +110,8 @@ _IO_wdefault_pbackfail (FILE *fp, wint_t c)\n {\n if (fp->_wide_data->_IO_read_ptr > fp->_wide_data->_IO_read_base\n && !_IO_in_backup (fp)\n- && (wint_t) fp->_IO_read_ptr[-1] == c)\n- --fp->_IO_read_ptr;\n+ && (wint_t) fp->_wide_data->_IO_read_ptr[-1] == c)\n+ --fp->_wide_data->_IO_read_ptr;\n else\n {\n /* Need to handle a filebuf in write mode (switch to read mode). FIXME!*/\n", "prefixes": [ "v5" ] }