[{"id":3676066,"web_url":"http://patchwork.ozlabs.org/comment/3676066/","msgid":"<9b16408c-7601-48a0-9140-890daff6a5b2@redhat.com>","list_archive_url":null,"date":"2026-04-10T21:54:38","subject":"Re: [PATCH v4] Use pending character state in IBM1390, IBM1399\n character sets (CVE-2026-4046)","submitter":{"id":22438,"url":"http://patchwork.ozlabs.org/api/people/22438/","name":"Carlos O'Donell","email":"carlos@redhat.com"},"content":"On 4/10/26 3:57 PM, Florian Weimer wrote:\n> Follow the example in iso-2022-jp-3.c and use the __count state\n> variable to store the pending character. This avoids restarting\n> the conversion if the output buffer ends between two 4-byte UCS-4\n> code points, so that the assert reported in the bug can no longer\n> happen.\n> \n> Even though the fix is applied to ibm1364.c, the change is only\n> effective for the two HAS_COMBINED codecs for IBM1390, IBM1399.\n> \n> The test case was mostly auto-generated using\n> claude-4.6-opus-high-thinking, and composer-2-fast shows up in the\n> log as well. During review, gpt-5.4-xhigh flagged that the original\n> version of the test case was not exercising the new character\n> flush logic.\n\nI'm fine with your use of looser unstructured text, but I'd like\na tag to find this with deterministic tooling\n\ne.g. \"Assisted-by: Claude\"\n\nWould that work for you?\n\nI don't actually care what we put in the tag so long as it is nominally\nthe tool being used. The intent here is to indicate clearly that some\nof this was machine generated. Likewise in the future I'd like to use\nthis tag to ask questions like \"Did you reduce this from another set of\nproject sources?\" when someone says \"Assisted-by: cvise\" since that\nmay carry license/copyright from the original work.\n\n> \n> This fixes bug 33980.\n> \n> ---\n> v4: Replace flush loop with two flush attempts. Add a comment\n> explaining the behavior of the test with smaller output buffers.\n> \n> iconvdata/Makefile | 4 +-\n> iconvdata/ibm1364.c | 70 +++++++++++++++++-----\n> iconvdata/tst-bug33980.c | 153 +++++++++++++++++++++++++++++++++++++++++++++++\n> 3 files changed, 211 insertions(+), 16 deletions(-)\n> \n> diff --git a/iconvdata/Makefile b/iconvdata/Makefile\n> index 26e888b443..fbb0067302 100644\n> --- a/iconvdata/Makefile\n> +++ b/iconvdata/Makefile\n> @@ -76,7 +76,7 @@ tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \\\n> \ttst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \\\n> \tbug-iconv10 bug-iconv11 bug-iconv12 tst-iconv-big5-hkscs-to-2ucs4 \\\n> \tbug-iconv13 bug-iconv14 bug-iconv15 \\\n> -\ttst-iconv-iso-2022-cn-ext\n> +\ttst-iconv-iso-2022-cn-ext tst-bug33980\n> ifeq ($(have-thread-library),yes)\n> tests += bug-iconv3\n> endif\n> @@ -333,6 +333,8 @@ $(objpfx)bug-iconv15.out: $(addprefix $(objpfx), $(gconv-modules)) \\\n> \t\t\t $(addprefix $(objpfx),$(modules.so))\n> $(objpfx)tst-iconv-iso-2022-cn-ext.out: $(addprefix $(objpfx), $(gconv-modules)) \\\n> \t\t\t\t\t$(addprefix $(objpfx),$(modules.so))\n> +$(objpfx)tst-bug33980.out: $(addprefix $(objpfx), $(gconv-modules)) \\\n> +\t\t\t $(addprefix $(objpfx),$(modules.so))\n> \n> $(objpfx)iconv-test.out: run-iconv-test.sh \\\n> \t\t\t $(addprefix $(objpfx), $(gconv-modules)) \\\n> diff --git a/iconvdata/ibm1364.c b/iconvdata/ibm1364.c\n> index 4f41f22c12..8df66ea048 100644\n> --- a/iconvdata/ibm1364.c\n> +++ b/iconvdata/ibm1364.c\n> @@ -67,12 +67,29 @@\n> \n> /* Since this is a stateful encoding we have to provide code which resets\n> the output state to the initial state. This has to be done during the\n> - flushing. */\n> + flushing. For the to-internal direction (FROM_DIRECTION is true),\n> + there may be a pending character that needs flushing. */\n> #define EMIT_SHIFT_TO_INIT \\\n> if ((data->__statep->__count & ~7) != sb)\t\t\t\t \\\n> {\t\t\t\t\t\t\t\t\t \\\n> if (FROM_DIRECTION)\t\t\t\t\t\t \\\n> -\tdata->__statep->__count &= 7;\t\t\t\t\t \\\n> +\t{\t\t\t\t\t\t\t\t \\\n> +\t uint32_t ch = data->__statep->__count >> 7;\t\t\t \\\n> +\t if (__glibc_unlikely (ch != 0))\t\t\t\t \\\n> +\t {\t\t\t\t\t\t\t\t \\\n> +\t if (__glibc_unlikely (outend - outbuf < 4))\t\t \\\n> +\t\tstatus = __GCONV_FULL_OUTPUT;\t\t\t\t \\\n> +\t else\t\t\t\t\t\t\t \\\n> +\t\t{\t\t\t\t\t\t\t \\\n> +\t\t put32 (outbuf, ch);\t\t\t\t\t \\\n> +\t\t outbuf += 4;\t\t\t\t\t\t \\\n> +\t\t /* Clear character and db bit. */\t\t\t \\\n> +\t\t data->__statep->__count &= 7;\t\t\t\t \\\n> +\t\t}\t\t\t\t\t\t\t \\\n> +\t }\t\t\t\t\t\t\t\t \\\n> +\t else\t\t\t\t\t\t\t\t \\\n> +\t data->__statep->__count &= 7;\t\t\t\t \\\n> +\t}\t\t\t\t\t\t\t\t \\\n> else\t\t\t\t\t\t\t\t \\\n> \t{\t\t\t\t\t\t\t\t \\\n> \t /* We are not in the initial state. To switch back we have\t \\\n> @@ -99,11 +116,13 @@\n> *curcsp = save_curcs\n> \n> \n> -/* Current codeset type. */\n> +/* Current codeset type. The bit is stored in the __count variable of\n> + the conversion state. If the db bit is set, bit 7 and above store\n> + a pending UCS-4 code point if non-zero. */\n> enum\n> {\n> - sb = 0,\n> - db = 64\n> + sb = 0,\t\t\t/* Single byte mode. */\n> + db = 64\t\t\t/* Double byte mode. */\n> };\n> \n> \n> @@ -119,21 +138,29 @@ enum\n> }\t\t\t\t\t\t\t\t\t \\\n> else\t\t\t\t\t\t\t\t \\\n> {\t\t\t\t\t\t\t\t\t \\\n> -\t/* This is a combined character. Make sure we have room. */\t \\\n> -\tif (__glibc_unlikely (outptr + 8 > outend))\t\t\t \\\n> -\t {\t\t\t\t\t\t\t\t \\\n> -\t result = __GCONV_FULL_OUTPUT;\t\t\t\t \\\n> -\t break;\t\t\t\t\t\t\t \\\n> -\t }\t\t\t\t\t\t\t\t \\\n> -\t\t\t\t\t\t\t\t\t \\\n> \tconst struct divide *cmbp\t\t\t\t\t \\\n> \t = &DB_TO_UCS4_COMB[ch - __TO_UCS4_COMBINED_MIN];\t\t \\\n> \tassert (cmbp->res1 != 0 && cmbp->res2 != 0);\t\t\t \\\n> \t\t\t\t\t\t\t\t\t \\\n> \tput32 (outptr, cmbp->res1);\t\t\t\t\t \\\n> \toutptr += 4;\t\t\t\t\t\t\t \\\n> -\tput32 (outptr, cmbp->res2);\t\t\t\t\t \\\n> -\toutptr += 4;\t\t\t\t\t\t\t \\\n> +\t\t\t\t\t\t\t\t\t \\\n> +\t/* See whether we have room for the second character. */\t \\\n> +\tif (outend - outptr >= 4)\t\t\t\t\t \\\n> +\t {\t\t\t\t\t\t\t\t \\\n> +\t put32 (outptr, cmbp->res2);\t\t\t\t\t \\\n> +\t outptr += 4;\t\t\t\t\t\t \\\n> +\t }\t\t\t\t\t\t\t\t \\\n> +\telse\t\t\t\t\t\t\t\t \\\n> +\t {\t\t\t\t\t\t\t\t \\\n> +\t /* Otherwise store only the first character now, and\t \\\n> +\t put the second one into the queue. */\t\t\t \\\n> +\t curcs |= cmbp->res2 << 7;\t\t\t\t\t \\\n> +\t inptr += 2;\t\t\t\t\t\t\t \\\n> +\t /* Tell the caller why we terminate the loop. */\t\t \\\n> +\t result = __GCONV_FULL_OUTPUT;\t\t\t\t \\\n> +\t break;\t\t\t\t\t\t\t \\\n> +\t }\t\t\t\t\t\t\t\t \\\n> }\t\t\t\t\t\t\t\t\t \\\n> }\n> #else\n> @@ -153,7 +180,20 @@ enum\n> #define LOOPFCT \t\tFROM_LOOP\n> #define BODY \\\n> {\t\t\t\t\t\t\t\t\t \\\n> - uint32_t ch = *inptr;\t\t\t\t\t\t \\\n> + uint32_t ch;\t\t\t\t\t\t\t \\\n> +\t\t\t\t\t\t\t\t\t \\\n> + ch = curcs >> 7;\t\t\t\t\t\t\t \\\n> + if (__glibc_unlikely (ch != 0))\t\t\t\t\t \\\n> + {\t\t\t\t\t\t\t\t\t \\\n> +\tput32 (outptr, ch);\t\t\t\t\t\t \\\n> +\toutptr += 4;\t\t\t\t\t\t\t \\\n> +\t/* Remove the pending character, but preserve state bits. */\t \\\n> +\tcurcs &= (1 << 7) - 1;\t\t\t\t\t\t \\\n> +\tcontinue;\t\t\t\t\t\t\t \\\n> + }\t\t\t\t\t\t\t\t\t \\\n> +\t\t\t\t\t\t\t\t\t \\\n> + /* Otherwise read the next input byte. */\t\t\t\t \\\n> + ch = *inptr;\t\t\t\t\t\t\t \\\n> \t\t\t\t\t\t\t\t\t \\\n> if (__builtin_expect (ch, 0) == SO)\t\t\t\t\t \\\n> {\t\t\t\t\t\t\t\t\t \\\n> diff --git a/iconvdata/tst-bug33980.c b/iconvdata/tst-bug33980.c\n> new file mode 100644\n> index 0000000000..c9693e0efe\n> --- /dev/null\n> +++ b/iconvdata/tst-bug33980.c\n> @@ -0,0 +1,153 @@\n> +/* Test for bug 33980: combining characters in IBM1390/IBM1399.\n> + Copyright (C) 2026 Free Software Foundation, Inc.\n> + This file is part of the GNU C Library.\n> +\n> + The GNU C Library is free software; you can redistribute it and/or\n> + modify it under the terms of the GNU Lesser General Public\n> + License as published by the Free Software Foundation; either\n> + version 2.1 of the License, or (at your option) any later version.\n> +\n> + The GNU C Library is distributed in the hope that it will be useful,\n> + but WITHOUT ANY WARRANTY; without even the implied warranty of\n> + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\n> + Lesser General Public License for more details.\n> +\n> + You should have received a copy of the GNU Lesser General Public\n> + License along with the GNU C Library; if not, see\n> + . */\n> +\n> +#include \n> +#include \n> +#include \n> +#include \n> +#include \n> +\n> +#include \n> +#include \n> +#include \n> +\n> +/* Run iconv in a loop with a small output buffer of OUTBUFSIZE bytes\n> + starting at OUTBUF. OUTBUF should be right before an unmapped page\n> + so that writing past the end will fault. Skip SHIFT bytes at the\n> + start of the input and output, to exercise different buffer\n> + alignment. TRUNCATE indicates skipped bytes at the end of\n> + input (0 and 1 a valid). */\n> +static void\n> +test_one (const char *encoding, unsigned int shift, unsigned int truncate,\n> + char *outbuf, size_t outbufsize)\n> +{\n> + /* In IBM1390 and IBM1399, the DBCS code 0xECB5 expands to two\n> + Unicode code points when translated. */\n> + static char input[] =\n> + {\n> + /* 8 letters X. */\n> + 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7,\n> + /* SO, 0xECB5, SI: shift to DBCS, special character, shift back. */\n> + 0x0e, 0xec, 0xb5, 0x0f\n> + };\n> +\n> + /* Expected output after UTF-8 conversion. */\n> + static char expected[] =\n> + {\n> + 'X', 'X', 'X', 'X', 'X', 'X', 'X', 'X',\n> + /* U+304B (HIRAGANA LETTER KA). */\n> + 0xe3, 0x81, 0x8b,\n> + /* U+309A (COMBINING KATAKANA-HIRAGANA SEMI-VOICED SOUND MARK). */\n> + 0xe3, 0x82, 0x9a\n> + };\n> +\n> + iconv_t cd = iconv_open (\"UTF-8\", encoding);\n> + TEST_VERIFY_EXIT (cd != (iconv_t) -1);\n> +\n> + char result_storage[64];\n> + struct alloc_buffer result_buf\n> + = alloc_buffer_create (result_storage, sizeof (result_storage));\n> +\n> + char *inptr = &input[shift];\n> + size_t inleft = sizeof (input) - shift - truncate;\n> +\n> + while (inleft > 0)\n> + {\n> + char *outptr = outbuf;\n> + size_t outleft = outbufsize;\n> + size_t inleft_before = inleft;\n> +\n> + size_t ret = iconv (cd, &inptr, &inleft, &outptr, &outleft);\n> + size_t produced = outptr - outbuf;\n> + alloc_buffer_copy_bytes (&result_buf, outbuf, produced);\n> +\n> + if (ret == (size_t) -1 && errno == E2BIG)\n> + {\n> + if (produced == 0 && inleft == inleft_before)\n> + {\n> + /* Output buffer too small to make progress. This is\n> + expected for very small output buffer sizes. */\n> + TEST_VERIFY_EXIT (outbufsize < 3);\n> + break;\n\nOK. Thanks, this covers produced == 0 case, and iconv hasn't moved pointers.\n\n> + }\n> + continue;\n> + }\n> + if (ret == (size_t) -1)\n> + FAIL_EXIT1 (\"%s (outbufsize %zu): iconv: %m\", encoding, outbufsize);\n> + break;\n> + }\n> +\n> + /* Flush any pending state (e.g. a buffered combined character).\n> + With outbufsize < 3, we could not store the first character, so\n> + the second character did not become pending, and there is nothing\n> + to flush. */\n> + {\n> + char *outptr = outbuf;\n> + size_t outleft = outbufsize;\n> +\n> + size_t ret = iconv (cd, NULL, NULL, &outptr, &outleft);\n> + TEST_VERIFY_EXIT (ret == 0);\n> + size_t produced = outptr - outbuf;\n> + alloc_buffer_copy_bytes (&result_buf, outbuf, produced);\n> +\n> + /* Second flush does not provide more data. */\n> + outptr = outbuf;\n> + outleft = outbufsize;\n> + ret = iconv (cd, NULL, NULL, &outptr, &outleft);\n> + TEST_VERIFY_EXIT (ret == 0);\n> + TEST_VERIFY (outptr == outbuf);\n> + }\n> +\n> + TEST_VERIFY_EXIT (!alloc_buffer_has_failed (&result_buf));\n> + size_t result_used\n> + = sizeof (result_storage) - alloc_buffer_size (&result_buf);\n> +\n> + if (outbufsize >= 3)\n> + {\n> + TEST_COMPARE (inleft, 0);\n> + TEST_COMPARE (result_used, sizeof (expected) - shift);\n> + TEST_COMPARE_BLOB (result_storage, result_used,\n> + &expected[shift], sizeof (expected) - shift);\n> + }\n> + else\n> + /* If the buffer is too small, only the leading X could be converted. */\n> + TEST_COMPARE (result_used, 8 - shift);\n> +\n> + TEST_VERIFY_EXIT (iconv_close (cd) == 0);\n> +}\n> +\n> +static int\n> +do_test (void)\n> +{\n> + struct support_next_to_fault ntf\n> + = support_next_to_fault_allocate (8);\n> +\n> + for (int shift = 0; shift <= 8; ++shift)\n> + for (int truncate = 0; truncate < 2; ++truncate)\n> + for (size_t outbufsize = 1; outbufsize <= 8; outbufsize++)\n> + {\n> + char *outbuf = ntf.buffer + ntf.length - outbufsize;\n> + test_one (\"IBM1390\", shift, truncate, outbuf, outbufsize);\n> + test_one (\"IBM1399\", shift, truncate, outbuf, outbufsize);\n> + }\n> +\n> + support_next_to_fault_free (&ntf);\n> + return 0;\n> +}\n> +\n> +#include \n> \n> base-commit: 1b2f868fb4958fd59875695c1828d9804b116dc2\n>","headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","libc-alpha@sourceware.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","libc-alpha@sourceware.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=OpbqCN+h;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org\n (client-ip=2620:52:6:3111::32; helo=vm01.sourceware.org;\n envelope-from=libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org;\n receiver=patchwork.ozlabs.org)","sourceware.org;\n\tdkim=pass (1024-bit key,\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=OpbqCN+h","sourceware.org; dmarc=pass (p=quarantine dis=none)\n header.from=redhat.com","sourceware.org; spf=pass smtp.mailfrom=redhat.com","server2.sourceware.org;\n arc=none smtp.remote-ip=170.10.129.124"],"Received":["from vm01.sourceware.org (vm01.sourceware.org\n [IPv6:2620:52:6:3111::32])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fsrFT6STvz1yCv\n\tfor ; Sat, 11 Apr 2026 07:55:09 +1000 (AEST)","from vm01.sourceware.org (localhost [127.0.0.1])\n\tby sourceware.org (Postfix) with ESMTP id 9D9094BA2E3D\n\tfor ; Fri, 10 Apr 2026 21:55:07 +0000 (GMT)","from us-smtp-delivery-124.mimecast.com\n (us-smtp-delivery-124.mimecast.com [170.10.129.124])\n by sourceware.org (Postfix) with ESMTP id 17A434BA2E10\n for ; Fri, 10 Apr 2026 21:54:44 +0000 (GMT)","from mail-qk1-f197.google.com (mail-qk1-f197.google.com\n [209.85.222.197]) by relay.mimecast.com with ESMTP with STARTTLS\n (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id\n us-mta-263-q1DcCWx3M3CSWVIRRsJomg-1; Fri, 10 Apr 2026 17:54:42 -0400","by mail-qk1-f197.google.com with SMTP id\n af79cd13be357-8d5107ec672so697421485a.0\n for ; Fri, 10 Apr 2026 14:54:42 -0700 (PDT)","from [192.168.0.116] ([198.48.244.52])\n by smtp.gmail.com with ESMTPSA id\n af79cd13be357-8ddb934d8e9sm318810185a.35.2026.04.10.14.54.39\n (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n Fri, 10 Apr 2026 14:54:39 -0700 (PDT)"],"DKIM-Filter":["OpenDKIM Filter v2.11.0 sourceware.org 9D9094BA2E3D","OpenDKIM Filter v2.11.0 sourceware.org 17A434BA2E10"],"DMARC-Filter":"OpenDMARC Filter v1.4.2 sourceware.org 17A434BA2E10","ARC-Filter":"OpenARC Filter v1.0.0 sourceware.org 17A434BA2E10","ARC-Seal":"i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1775858084; cv=none;\n b=ABpaKY5y4ek3LG8qt5EnKKHpPr/YwARZwbarJHAmBr3znEqFPkcv7iAdUIGkNmEmLRU4Z6qG54PUUUGgdmxe6uqscGAr9f/AHH+89Fr2mYtXl0UPSE1HnyMzK+4jPpWC5RWhgmGOTiFd/+l8ozZTrQAuGVFRXVwVQ1BtSfivQws=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=sourceware.org; s=key;\n t=1775858084; c=relaxed/simple;\n bh=DwoDs1BUpVCYywErrHb+SZ/XQYnggtGfRU9jJb25llo=;\n h=DKIM-Signature:Message-ID:Date:MIME-Version:Subject:To:From;\n b=ZQbwrSmlyMDBPEOFikFkOHVhB+URPlJ/sRGSidTKCiuUjWgndsHIxSMde/r/j3nmRfmC4Z3gvH40pRrTTKnxENBslf8qttw1D2Rj1hSmzlvqMwqB5G7/SdgbIGWuak7qR+V2l9SxDD5hhz4kHQ641xM34WddsindK6qs0UdYIVM=","ARC-Authentication-Results":"i=1; server2.sourceware.org","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n s=mimecast20190719; t=1775858083;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding:\n in-reply-to:in-reply-to:references:references;\n bh=Nnw2T0OtpFn5EuAmTqpKDMTaRer6FTle2p8IgyUGJiE=;\n b=OpbqCN+hNRrtgPc/boWyb4fOuoE7MOtF9NNBNAn9rDiugWwyQTJzehnCcs+PY9fiQDN7EU\n uCQpcGVTldhNmYv2V+7Spq+1Ik7NPzEwcsbLDSwYrCbhuGC8TKOgVM734RTwFbhsxL+Zab\n Kwcdh4Z1x9u87ofKQ7NTAa6KCum3E88=","X-MC-Unique":"q1DcCWx3M3CSWVIRRsJomg-1","X-Mimecast-MFC-AGG-ID":"q1DcCWx3M3CSWVIRRsJomg_1775858082","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1775858081; x=1776462881;\n h=content-transfer-encoding:in-reply-to:organization:from\n :content-language:references:to:subject:user-agent:mime-version:date\n :message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=Nnw2T0OtpFn5EuAmTqpKDMTaRer6FTle2p8IgyUGJiE=;\n b=ZioZHnwsK+bFHII+40LVBLmAyfz837yW9TSU3aWSO8rV8lnHiNTswnp+Rtrt90aZah\n FpYQLcJXlN7h/tz19NWwvo6UXX1Y65UKAlkd/vWBE3b39sr0Lx4762qQrQMKStvbppFZ\n nvq7z7BuaAFgATUhFTdxnYTRkDVJ9PA6sXKMMbLMcxEPhHrVbm7Oxem4bGbnQwp2U27G\n i7wEXnEJHFJaLKq2gHuGp8k+L23bSZrxnPVNb0auX581Zk4YwJy48gjJKpn1+o6dCqf8\n fHYbfRaFQq3V+uhoz8utTUF8ScY5hx5YUQaU52vxKnqjBsN86i+CrdIRi8g7BaRpqtu+\n 1Qhw==","X-Forwarded-Encrypted":"i=1;\n AJvYcCW5AeScoiYFEqR0cAXY3qfvJw8HPC9quWIU2UiF8ANZOmSfVP7xtgMVRFSEQbhHjXpDyy+qUyiOmM+2@sourceware.org","X-Gm-Message-State":"AOJu0YzaF7EKLMsRgoyCv7wFos8eJMp7sxCC2MTmvhKaTLBW6OCWoaym\n b6eLkgKLxM7hqp+cq6I2OmRbwhXnejxyrgyILetwu0yTi46+HaQnrj3ZK4+4jRFyyFWPoIlSPxK\n I4lRDM/gxEGgsX0Dr/ouN7KYfFHebc15txgS4jSC+AQ0zS6C5H/c2/vdNH/9KNkVUKcAb/A==","X-Gm-Gg":"AeBDietX0HlqiMGWt2WLJ/tgKuh2ll3p8DPcKZY9SuLO6Cn0CiMB3JHHsR8zh/7QBl+\n nBlpb7G+Cxy0iSCqsfl5LQz3xtV45f9tQvXxgwQaC6GmSq5BoQi8iIyAN+MnbVZ4xwmonfAo/FR\n WjFX4DjespvHe+cOiIX632oDOmDBQWlSGxkw1jrmdgoP3WYkH4vxh8/x5mDHEu5a89/MG//adC5\n GoMIHTHrg6zfZtFH1RfyjKDQEUCnz9N3PPEArUDDyTN1Rx+bhmAsxmtRj7BVkEJxBxXpvLMOh93\n /xciQMxHEaT+dIS8/LC7cDky/HNzAhMad+jOdym+mkJ4qmlmJ4rvJMRbMLAQZTnUJP0+M0Q1aQb\n AjT/P/1bf/VQiPnpAJg9JA3HxBC45E9LPyzwwtPKmyvmTNPed+/E4xENNDHHRBEoUY8nJv9evOK\n HQzSpjuvl8QNhLYa9LaSckVA==","X-Received":["by 2002:a05:620a:7103:b0:8cd:af31:b421 with SMTP id\n af79cd13be357-8ddcecbcb59mr703139485a.34.1775858080980;\n Fri, 10 Apr 2026 14:54:40 -0700 (PDT)","by 2002:a05:620a:7103:b0:8cd:af31:b421 with SMTP id\n af79cd13be357-8ddcecbcb59mr703136785a.34.1775858080398;\n Fri, 10 Apr 2026 14:54:40 -0700 (PDT)"],"Message-ID":"<9b16408c-7601-48a0-9140-890daff6a5b2@redhat.com>","Date":"Fri, 10 Apr 2026 17:54:38 -0400","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","Subject":"Re: [PATCH v4] Use pending character state in IBM1390, IBM1399\n character sets (CVE-2026-4046)","To":"Florian Weimer , libc-alpha@sourceware.org","References":"","From":"Carlos O'Donell ","Organization":"Red Hat, LLC.","In-Reply-To":"","X-Mimecast-Spam-Score":"0","X-Mimecast-MFC-PROC-ID":"-eSAQ64pB6DpCkHiMz5YmO4gIa8IORrBLrzo3M_XFMc_1775858082","X-Mimecast-Originator":"redhat.com","Content-Language":"en-US","Content-Type":"text/plain; charset=UTF-8; format=flowed","Content-Transfer-Encoding":"7bit","X-BeenThere":"libc-alpha@sourceware.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"Libc-alpha mailing list ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org"}},{"id":3676189,"web_url":"http://patchwork.ozlabs.org/comment/3676189/","msgid":"","list_archive_url":null,"date":"2026-04-11T16:56:41","subject":"Re: [PATCH v4] Use pending character state in IBM1390, IBM1399\n character sets (CVE-2026-4046)","submitter":{"id":14312,"url":"http://patchwork.ozlabs.org/api/people/14312/","name":"Florian Weimer","email":"fweimer@redhat.com"},"content":"* Carlos O'Donell:\n\n> On 4/10/26 3:57 PM, Florian Weimer wrote:\n>> Follow the example in iso-2022-jp-3.c and use the __count state\n>> variable to store the pending character. This avoids restarting\n>> the conversion if the output buffer ends between two 4-byte UCS-4\n>> code points, so that the assert reported in the bug can no longer\n>> happen.\n>> Even though the fix is applied to ibm1364.c, the change is only\n>> effective for the two HAS_COMBINED codecs for IBM1390, IBM1399.\n>> The test case was mostly auto-generated using\n>> claude-4.6-opus-high-thinking, and composer-2-fast shows up in the\n>> log as well. During review, gpt-5.4-xhigh flagged that the original\n>> version of the test case was not exercising the new character\n>> flush logic.\n>\n> I'm fine with your use of looser unstructured text, but I'd like\n> a tag to find this with deterministic tooling\n>\n> e.g. \"Assisted-by: Claude\"\n>\n> Would that work for you?\n>\n> I don't actually care what we put in the tag so long as it is nominally\n> the tool being used. The intent here is to indicate clearly that some\n> of this was machine generated. Likewise in the future I'd like to use\n> this tag to ask questions like \"Did you reduce this from another set of\n> project sources?\" when someone says \"Assisted-by: cvise\" since that\n> may carry license/copyright from the original work.\n\nI'm going to send a v5 with Assisted-by:.\n\nThanks,\nFlorian","headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","libc-alpha@sourceware.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","libc-alpha@sourceware.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=iMhfeYMI;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org\n (client-ip=2620:52:6:3111::32; helo=vm01.sourceware.org;\n envelope-from=libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org;\n receiver=patchwork.ozlabs.org)","sourceware.org;\n\tdkim=pass (1024-bit key,\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=iMhfeYMI","sourceware.org; dmarc=pass (p=quarantine dis=none)\n header.from=redhat.com","sourceware.org; spf=pass smtp.mailfrom=redhat.com","server2.sourceware.org;\n arc=none smtp.remote-ip=170.10.129.124"],"Received":["from vm01.sourceware.org (vm01.sourceware.org\n [IPv6:2620:52:6:3111::32])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4ftKbB5KYBz1yGb\n\tfor ; Sun, 12 Apr 2026 02:57:10 +1000 (AEST)","from vm01.sourceware.org (localhost [127.0.0.1])\n\tby sourceware.org (Postfix) with ESMTP id B47084BA23F2\n\tfor ; Sat, 11 Apr 2026 16:57:08 +0000 (GMT)","from us-smtp-delivery-124.mimecast.com\n (us-smtp-delivery-124.mimecast.com [170.10.129.124])\n by sourceware.org (Postfix) with ESMTP id 84F174BA23E6\n for ; Sat, 11 Apr 2026 16:56:47 +0000 (GMT)","from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com\n (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by\n relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3,\n cipher=TLS_AES_256_GCM_SHA384) id us-mta-329-dhSRlFBqPJSNbkq--tpbng-1; Sat,\n 11 Apr 2026 12:56:45 -0400","from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com\n (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS\n id 18CD4195608B\n for ; Sat, 11 Apr 2026 16:56:45 +0000 (UTC)","from fweimer-oldenburg.csb.redhat.com (unknown [10.44.48.29])\n by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with\n ESMTPS\n id 06EAE1801ACB; Sat, 11 Apr 2026 16:56:43 +0000 (UTC)"],"DKIM-Filter":["OpenDKIM Filter v2.11.0 sourceware.org B47084BA23F2","OpenDKIM Filter v2.11.0 sourceware.org 84F174BA23E6"],"DMARC-Filter":"OpenDMARC Filter v1.4.2 sourceware.org 84F174BA23E6","ARC-Filter":"OpenARC Filter v1.0.0 sourceware.org 84F174BA23E6","ARC-Seal":"i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1775926607; cv=none;\n b=deyfPC6se+1C2ZWGO+ZpP7LOgsIz2Lv9yDsshWrgOM764yhJe16ooVDg9y2ZQLjBY9odsZGhJhf8NkaELj26MmN/Ffe054veZY1gY9EFyOQ3c9RNdFN5c02SqUXcxloPTzS9iVdJ/qBxu51D6qN4H75SE4iEZm5XleiiLDH5R7A=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=sourceware.org; s=key;\n t=1775926607; c=relaxed/simple;\n bh=BONQ6oahGjA97+TTupTfntnRT5fN/PFjKayTzwyTXN8=;\n h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version;\n b=kG2KEVeab18LFz3LI7YRAPmrzruTZ4/ad+BS1T7NojbAQAiqeJ4jKm3S8dxBXmQa7M/qWHzfa3wf+XtKWgtpd/0xwCdJFb3xPv8kBjBjPPNex+gMTiL4RVeIOcMceAM7hUY90fY210AXjZ9cyi1KRaBGYg8i4sfFEQk8er39a7U=","ARC-Authentication-Results":"i=1; server2.sourceware.org","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n s=mimecast20190719; t=1775926607;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:cc:mime-version:mime-version:content-type:content-type:\n in-reply-to:in-reply-to:references:references;\n bh=pl5tGsC4Z53KPOVvQ6GuvcV2t6biHhBb9TjXjcp6E5Q=;\n b=iMhfeYMILCupYYoTLWLr4E+UT0FyJnysLZ0NePB6su4XKRSLwgckawK9CurQp7wBi94lHt\n 1XQ0odANvvdnpJHC/tnQx2zk5JwGg39P38eEUlIioy82EX7J8xrOZ3MxoDdBCaCaZKHQWZ\n 0Il8TP0RDQPFAISmkxQI5BqQpGa84rY=","X-MC-Unique":"dhSRlFBqPJSNbkq--tpbng-1","X-Mimecast-MFC-AGG-ID":"dhSRlFBqPJSNbkq--tpbng_1775926605","From":"Florian Weimer ","To":"Carlos O'Donell ","Cc":"libc-alpha@sourceware.org","Subject":"Re: [PATCH v4] Use pending character state in IBM1390, IBM1399\n character sets (CVE-2026-4046)","In-Reply-To":"<9b16408c-7601-48a0-9140-890daff6a5b2@redhat.com> (Carlos\n O'Donell's message of \"Fri, 10 Apr 2026 17:54:38 -0400\")","References":"\n <9b16408c-7601-48a0-9140-890daff6a5b2@redhat.com>","Date":"Sat, 11 Apr 2026 18:56:41 +0200","Message-ID":"","User-Agent":"Gnus/5.13 (Gnus v5.13)","MIME-Version":"1.0","X-Scanned-By":"MIMEDefang 3.4.1 on 10.30.177.111","X-Mimecast-Spam-Score":"0","X-Mimecast-MFC-PROC-ID":"yUYUUGOPnvK3ETULQ24ossxKAjMqt28e2kMYrxkVAKo_1775926605","X-Mimecast-Originator":"redhat.com","Content-Type":"text/plain","X-BeenThere":"libc-alpha@sourceware.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"Libc-alpha mailing list ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org"}}]