We are currently migrating Bugzilla to GitHub issues.
Any changes made to the bug tracker now will be lost, so please do not post new bugs or make changes to them.
When we're done, all bug URLs will redirect to their equivalent location on the new bug tracker.

Bug 5022 - SDL_iconv_string can get stuck in an infinite loop when encountering invalid characters
Summary: SDL_iconv_string can get stuck in an infinite loop when encountering invalid ...
Status: RESOLVED FIXED
Alias: None
Product: SDL
Classification: Unclassified
Component: joystick (show other bugs)
Version: 2.0.10
Hardware: x86_64 macOS 10.15
: P2 critical
Assignee: Sam Lantinga
QA Contact: Sam Lantinga
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-03-10 15:43 UTC by Hampus Liljekvist
Modified: 2020-03-10 23:29 UTC (History)
0 users

See Also:


Attachments
Suggested fix (798 bytes, patch)
2020-03-10 16:13 UTC, Hampus Liljekvist
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Hampus Liljekvist 2020-03-10 15:43:36 UTC
In `SDL_iconv_string` the `while (inbytesleft > 0)` loop can end up in a state where it never terminates because the library `iconv` function called from `SDL_iconv` doesn't consume any bytes.

This happened when a `WCHAR_T` input string was being converted to `UTF-8` but contained invalid characters. It would first It would first skip a few bytes due to `case SDL_ICONV_EILSEQ` but when there were 3 bytes remaining of `inbytesleft` `iconv` just didn't consume anything more (but didn't throw an error either).

It just so happens that the Microsoft Classic IntelliMouse `product_string` contains such invalid characters (`"MicrosoftÆ Classic IntelliMouseÆ"`), meaning the function would get stuck with said mouse plugged in.

A fix for this would be to check if `inbytesleft` was unchanged after an iteration and in that case either decrement the counter like when `SDL_ICONV_EILSEQ` is returned or simply break the loop.
Comment 1 Hampus Liljekvist 2020-03-10 15:49:30 UTC
To clarify the function call to `SDL_iconv_string` stemmed from `HIDAPI_AddDevice`, hence I chose the "joystick" component, but I guess this is a more generic issue than that.
Comment 2 Hampus Liljekvist 2020-03-10 16:13:55 UTC
Created attachment 4246 [details]
Suggested fix
Comment 3 Sam Lantinga 2020-03-10 23:29:49 UTC
This patch is added, thanks!
https://hg.libsdl.org/SDL/rev/3d3649fe086e