[PATCH] Charset: fixed handling of invalid UTF-8 characters

[Maxim Dounin]

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1781821809 -10800
#      Fri Jun 19 01:30:09 2026 +0300
# Node ID a779d9d41aaa5ff1091f052d59beb9fb368f55cd
# Parent  ec34a87ad20c74ac8ed95ddff647fb03aaf48beb
Charset: fixed handling of invalid UTF-8 characters.

Previously, if an invalid UTF-8 character was split between buffers,
ngx_decode_utf8() might return an error and a position within the bytes
saved from the first buffer, but the following code did not expect this
and might end up reading a byte before the second buffer
(CVE-2026-48142).

The fix is to copy bytes from ctx->saved directly, and only adjust src
for the bytes which are from the second buffer.

See also:
https://github.com/nginx/nginx/commit/319a0bff157b15d9061f4712b2edbe6fdd2dee66

diff --git a/src/http/modules/ngx_http_charset_filter_module.c b/src/http/modules/ngx_http_charset_filter_module.c
--- a/src/http/modules/ngx_http_charset_filter_module.c
+++ b/src/http/modules/ngx_http_charset_filter_module.c
@@ -865,6 +865,10 @@ ngx_http_charset_recode_from_utf8(ngx_po
         ngx_log_debug0(NGX_LOG_DEBUG_HTTP, pool->log, 0,
                        "http charset invalid utf 1");
 
+        while (saved < ctx->saved + ctx->saved_len) {
+            *dst++ = *saved++;
+        }
+
     } else {
         dst = ngx_sprintf(dst, "&#%uD;", n);
     }