Skip to content

Fix nullptr pointer arithmetic in charset decoder#670

Merged
swebb2066 merged 1 commit into
apache:masterfrom
metsw24-max:mbsrtowcs-nullptr-offset-ub
May 15, 2026
Merged

Fix nullptr pointer arithmetic in charset decoder#670
swebb2066 merged 1 commit into
apache:masterfrom
metsw24-max:mbsrtowcs-nullptr-offset-ub

Conversation

@metsw24-max
Copy link
Copy Markdown
Contributor

Fix undefined behavior in MbstowcsCharsetDecoder::decode caused by performing pointer arithmetic on a nullptr after a successful mbsrtowcs conversion.

Previously, the code unconditionally computed:

converted = src - cbuf;

However, mbsrtowcs sets src to nullptr after consuming a terminating null character, making the subtraction undefined behavior.

Changes

  • Added explicit handling for the src == nullptr case.
  • Detect whether the terminating null came from the actual input or the temporary sentinel buffer.
  • Preserve normal pointer arithmetic when src is valid.
  • Keep existing loop and guard behavior unchanged.

Additional Fix

This also fixes handling of embedded null bytes where the previous logic could incorrectly skip trailing input bytes.

@swebb2066 swebb2066 merged commit 49361f3 into apache:master May 15, 2026
17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants