CVE-2019-5953: Buffer overflow in wget IRI character conversion

CVE-2019-5953 is a buffer overflow vulnerability in wget v1.20.1 affecting the internationalized resource identifier (IRI) support. When processing URLs with non-ASCII characters that require character set conversion, wget's do_conversion() function in src/iri.c incorrectly manages the output buffer size during reallocation, allowing iconv() to write beyond allocated memory.", Located the vulnerability by examining src/iri.c's do_conversion() function. The function uses iconv() for character encoding with dynamic buffer allocation. Initial allocation is inlen * 2 bytes. When the output buffer fills (E2BIG errno), reallocation occurs around line 188-195. The bug is in line 192 where both len and outlen are set to done + inlen * 2. Since done represents bytes already written, this causes outlen (remaining space) to be calculated as total_new_size instead of remaining_space = new_size - done. Verified by examining git commit 692d5c52 which contains the actual fix, confirming the buffer overflow and its correction.", The vulnerability is fixed by correctly separating the total buffer size calculation from the remaining output space calculation. After reallocation on E2BIG: (1) Calculate new total size as len = done + inlen * 2, (2) Reallocate to len + 1 bytes, (3) Set write pointer correctly with *out = s + done - outlen, (4) Update remaining space as outlen += inlen * 2 rather than resetting to total. This ensures iconv() has correct information about available space.", The vulnerability is confirmed by git commit 692d5c52 dated 2019-04-05 which explicitly fixes this buffer overflow in src/iri.c's do_conversion function. The commit message states 'Fix a buffer overflow vulnerability' and the patch shows the exact changes needed. The bug manifests when processing internationalized domain names or URLs with characters that expand during UTF-8 encoding, especially with IRI support enabled.", critical heap-overflow ENOMEM/E2BIG handling error data c {"wget": "1.20.1"} ["CVE-2019-5953", "wget", "iconv", "buffer-overflow"] [{"kind": "code-excerpt", "content": "else if (errno == E2BIG) /* Output buffer full */\n{\n tooshort++;\n done = len;\n len = outlen = done + inlen * 2; // BUG: outlen should be remaining, not total\n s = xrealloc (s, outlen + 1);\n *out = s + done; // outlen now represents total size, not remaining space\n}", "role": "manifests", "source_path": "src/iri.c", "source_lines": [188, 195], "language": "c"}]