⬢ DragonFlyBSD Kernel Audit
DF-2237 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/libiconv/iconv_xlat16.c b/sys/libiconv/iconv_xlat16.c
index 1a39209..4faeda1 100644
--- a/sys/libiconv/iconv_xlat16.c
+++ b/sys/libiconv/iconv_xlat16.c
@@ -189,6 +189,14 @@ iconv_xlat16_conv(void *d2p, const char **inbuf,
 			}
 		}
 
+		/*
+		 * Case conversion above may have moved c1/c2 into a high
+		 * byte block that is absent (NULL) in a sparse table.
+		 */
+		if (dp->d_table[c1] == NULL) {
+			ret = -1;
+			break;
+		}
 		code = dp->d_table[c1][c2];
 		if (!code) {
 			ret = -1;