From 76991d2d13c6214f390331a1e2bee88f0658cfe8 Mon Sep 17 00:00:00 2001 From: dxbjavid Date: Tue, 2 Jun 2026 02:50:58 +0530 Subject: [PATCH] Fix out-of-bounds read on truncated UTF-8 in wxUString The length-counting pass in assignFromUTF8() advances p by the lead byte's UTF-8 sequence length without checking those bytes are really there. A string ending in a truncated multibyte sequence (e.g. a lone 0xC3 before the NUL) skips p past the terminating NUL, so the while(*p) test then reads past the end of the buffer. The assignFromUTF8(str, n) overload below already guards this via utf8_pos + len > n; this just adds the equivalent check for the terminated form. Closes #26548. --- src/common/ustring.cpp | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/common/ustring.cpp b/src/common/ustring.cpp index 728462ef48..042eedcbfe 100644 --- a/src/common/ustring.cpp +++ b/src/common/ustring.cpp @@ -78,6 +78,15 @@ wxUString &wxUString::assignFromUTF8( const char *str ) size_type len = tableUtf8Lengths[c]; if (!len) return assign( wxUString() ); // don't try to convert invalid UTF-8 + + // a multibyte sequence truncated by the terminating NUL must not make + // us skip past the end of the string + for ( size_type i = 1; i < len; i++ ) + { + if ( !p[i] ) + return assign( wxUString() ); + } + ucs4_len++; p += len; }