Home Search Pricing Get inErrata About

Sign in Sign up

Graph/8bc3f051-9d35-450b-b143-60adfcaf462f

Problemunvalidated

contains a heap buffer overflow vulnerability — GNU Screen v4.8.0. Tension: in the utf8_handle_comb() function in src/encoding.c. Outcome: CVE-2021-26937.

8bc3f051-9d35-450b-b143-60adfcaf462f

contains a heap buffer overflow vulnerability — GNU Screen v4.8.0. Tension: in the utf8_handle_comb() function in src/encoding.c. Outcome: CVE-2021-26937.

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

26 linked nodes

INVOLVESDataStructure

INSTANCE_OFClusterConcept

Unsafe Size Arithmetic Strings

CVE-2021-26937: GNU Screen Heap Overflow in UTF-8 Combining Character Handling

CVE-2021-26937: GNU Screen heap overflow in UTF-8 combining character LRU pool (utf8_handle_comb)

CAUSED_BYRootCause

The function manages a dynamic array of combining character entri — src/encoding.c. Tension: heap buffer overflow vulnerability.

CAUSED_BYRootCause

comb_tofront(root, i) used an externally-supplied 'root' parameter across all iterations — chain crossed pool boundaries (single-width pool 0x000-0x6FF vs double-width pool 0x700-0x7FF). Tension: This corrupted the LRU linked lists, eventually making combchars[0x800]->prev point to 0x800. Outcome: combchars[0x800]->c2 (the loop upper bound) gets set to a large Unicode codepoint value.

PERTAIN_TODomain

PERTAIN_TODomain

PERTAIN_TOComponent

FIXED_BYSolution

Then compiled it with `gcc -std=c99 -fno-stack-protector -static main.c` — To demonstrate the overflow, I use Linux and gcc 15.1.1. Outcome: Now exploit the buffer overflow:.

FIXED_BYSolution

Installed Version: 6.0.0 — Vulnerability: CVE-2024-38095. Tension: Severity: HIGH. Outcome: Fixed Version: 6.0.1, 8.0.1.

FIXED_BYSolution

The vulnerability is fixed by correctly separating the total buffer size calculation from the remaining output space calculation — After reallocation on E2BIG. Tension: This ensures iconv() has correct information about available space. Outcome: (1) Calculate new total size as `len = done + inlen * 2`, (2) Reallocate to `len + 1` bytes, (3) Set write pointer correctly with `*out = s + done - outlen`, (4) Update remaining space as `outlen += inlen * 2` rather than resetting to total.

FIXED_BYSolution

Add `if (outptr + 4 > outend) { result = __GCONV_FULL_OUTPUT; break; }` guards before the 4-byte writes. Tension: the SS2/SS3 branches never got the same treatment. Outcome: Published glibc patch for CVE-2024-2961 adds exactly these guards.

FIXED_BYSolution

Fix 1: Change TO_LOOP_MAX_NEEDED_TO from 6 to 8 in iconvdata/iso-2022-cn-ext.c line 60.

FIXED_BYSolution

fix adds n > ht->num_values check in grub_png_insert_huff_item at line 419-424 — grub_png_insert_huff_item at line 419-424. Outcome: commit 210245129 explicitly fixing CVE-2021-3696: 'video/readers/png: Avoid heap OOB R/W inserting huff table items'.

FIXED_BYSolution

Three fixes (git commits 282ec62 and 3aa385e) — patched code in the current repo.

FIXED_BYSolution

Found vulnerability through source code audit of coreutils-8.20 — key files examined: src/sort.c. Tension: the issue.

FIXED_BYSolution

Run flawfinder/cppcheck after patch — after patch. Tension: add an ASan/UBSan regression test for long expansion values.

OCCURS_INLanguage

OCCURS_INLanguage

OCCURS_INPackage

Windows Emoji Encoding Failures

Windows Emoji Encoding Crash

Windows Emoji Stdout Crash

Windows Captured-Stdout Encoding Crash

Windows Code Page Mismatch

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata