[{"id":3676722,"web_url":"http://patchwork.ozlabs.org/comment/3676722/","msgid":"<55c1821d-d696-42e5-b728-63cde20fd41e@redhat.com>","list_archive_url":null,"date":"2026-04-13T12:59:11","subject":"Re: [PATCH v5] Use pending character state in IBM1390, IBM1399\n character sets (CVE-2026-4046)","submitter":{"id":68478,"url":"http://patchwork.ozlabs.org/api/people/68478/","name":"Carlos O'Donell","email":"codonell@redhat.com"},"content":"On 4/11/26 1:09 PM, Florian Weimer wrote:\n> Follow the example in iso-2022-jp-3.c and use the __count state\n> variable to store the pending character. This avoids restarting\n> the conversion if the output buffer ends between two 4-byte UCS-4\n> code points, so that the assert reported in the bug can no longer\n> happen.\n> \n> Even though the fix is applied to ibm1364.c, the change is only\n> effective for the two HAS_COMBINED codecs for IBM1390, IBM1399.\n> \n> The test case was mostly auto-generated using\n> claude-4.6-opus-high-thinking, and composer-2-fast shows up in the\n> log as well. During review, gpt-5.4-xhigh flagged that the original\n> version of the test case was not exercising the new character\n> flush logic.\n> \n> This fixes bug 33980.\n> \n> Assisted-by: Cursor:claude-4.6-opus-high-thinking\n> Assisted-by: Cursor:composer-2-fast\n> Assisted-by: Cursor:gpt-5.4-xhigh\n\nThat works for me.\n\nThe risk of these changes infringing is vanishing given the use of the\nsupport/ infrastructure, and the test case is simple enough.\n\nThe fix looks correct.\n\nThe test case extends what we have for the IBM1390 and IBM1399 encodings.\n\nReviewed-by: Carlos O'Donell \n\n> \n> ---\n> v5: Add Assisted-by:.\n> iconvdata/Makefile | 4 +-\n> iconvdata/ibm1364.c | 70 +++++++++++++++++-----\n> iconvdata/tst-bug33980.c | 153 +++++++++++++++++++++++++++++++++++++++++++++++\n> 3 files changed, 211 insertions(+), 16 deletions(-)\n> \n> diff --git a/iconvdata/Makefile b/iconvdata/Makefile\n> index 26e888b443..fbb0067302 100644\n> --- a/iconvdata/Makefile\n> +++ b/iconvdata/Makefile\n> @@ -76,7 +76,7 @@ tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \\\n> \ttst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \\\n> \tbug-iconv10 bug-iconv11 bug-iconv12 tst-iconv-big5-hkscs-to-2ucs4 \\\n> \tbug-iconv13 bug-iconv14 bug-iconv15 \\\n> -\ttst-iconv-iso-2022-cn-ext\n> +\ttst-iconv-iso-2022-cn-ext tst-bug33980\n> ifeq ($(have-thread-library),yes)\n> tests += bug-iconv3\n> endif\n> @@ -333,6 +333,8 @@ $(objpfx)bug-iconv15.out: $(addprefix $(objpfx), $(gconv-modules)) \\\n> \t\t\t $(addprefix $(objpfx),$(modules.so))\n> $(objpfx)tst-iconv-iso-2022-cn-ext.out: $(addprefix $(objpfx), $(gconv-modules)) \\\n> \t\t\t\t\t$(addprefix $(objpfx),$(modules.so))\n> +$(objpfx)tst-bug33980.out: $(addprefix $(objpfx), $(gconv-modules)) \\\n> +\t\t\t $(addprefix $(objpfx),$(modules.so))\n> \n> $(objpfx)iconv-test.out: run-iconv-test.sh \\\n> \t\t\t $(addprefix $(objpfx), $(gconv-modules)) \\\n> diff --git a/iconvdata/ibm1364.c b/iconvdata/ibm1364.c\n> index 4f41f22c12..8df66ea048 100644\n> --- a/iconvdata/ibm1364.c\n> +++ b/iconvdata/ibm1364.c\n> @@ -67,12 +67,29 @@\n> \n> /* Since this is a stateful encoding we have to provide code which resets\n> the output state to the initial state. This has to be done during the\n> - flushing. */\n> + flushing. For the to-internal direction (FROM_DIRECTION is true),\n> + there may be a pending character that needs flushing. */\n> #define EMIT_SHIFT_TO_INIT \\\n> if ((data->__statep->__count & ~7) != sb)\t\t\t\t \\\n> {\t\t\t\t\t\t\t\t\t \\\n> if (FROM_DIRECTION)\t\t\t\t\t\t \\\n> -\tdata->__statep->__count &= 7;\t\t\t\t\t \\\n> +\t{\t\t\t\t\t\t\t\t \\\n> +\t uint32_t ch = data->__statep->__count >> 7;\t\t\t \\\n> +\t if (__glibc_unlikely (ch != 0))\t\t\t\t \\\n> +\t {\t\t\t\t\t\t\t\t \\\n> +\t if (__glibc_unlikely (outend - outbuf < 4))\t\t \\\n> +\t\tstatus = __GCONV_FULL_OUTPUT;\t\t\t\t \\\n> +\t else\t\t\t\t\t\t\t \\\n> +\t\t{\t\t\t\t\t\t\t \\\n> +\t\t put32 (outbuf, ch);\t\t\t\t\t \\\n> +\t\t outbuf += 4;\t\t\t\t\t\t \\\n> +\t\t /* Clear character and db bit. */\t\t\t \\\n> +\t\t data->__statep->__count &= 7;\t\t\t\t \\\n> +\t\t}\t\t\t\t\t\t\t \\\n> +\t }\t\t\t\t\t\t\t\t \\\n> +\t else\t\t\t\t\t\t\t\t \\\n> +\t data->__statep->__count &= 7;\t\t\t\t \\\n> +\t}\t\t\t\t\t\t\t\t \\\n> else\t\t\t\t\t\t\t\t \\\n> \t{\t\t\t\t\t\t\t\t \\\n> \t /* We are not in the initial state. To switch back we have\t \\\n> @@ -99,11 +116,13 @@\n> *curcsp = save_curcs\n> \n> \n> -/* Current codeset type. */\n> +/* Current codeset type. The bit is stored in the __count variable of\n> + the conversion state. If the db bit is set, bit 7 and above store\n> + a pending UCS-4 code point if non-zero. */\n> enum\n> {\n> - sb = 0,\n> - db = 64\n> + sb = 0,\t\t\t/* Single byte mode. */\n> + db = 64\t\t\t/* Double byte mode. */\n> };\n> \n> \n> @@ -119,21 +138,29 @@ enum\n> }\t\t\t\t\t\t\t\t\t \\\n> else\t\t\t\t\t\t\t\t \\\n> {\t\t\t\t\t\t\t\t\t \\\n> -\t/* This is a combined character. Make sure we have room. */\t \\\n> -\tif (__glibc_unlikely (outptr + 8 > outend))\t\t\t \\\n> -\t {\t\t\t\t\t\t\t\t \\\n> -\t result = __GCONV_FULL_OUTPUT;\t\t\t\t \\\n> -\t break;\t\t\t\t\t\t\t \\\n> -\t }\t\t\t\t\t\t\t\t \\\n> -\t\t\t\t\t\t\t\t\t \\\n> \tconst struct divide *cmbp\t\t\t\t\t \\\n> \t = &DB_TO_UCS4_COMB[ch - __TO_UCS4_COMBINED_MIN];\t\t \\\n> \tassert (cmbp->res1 != 0 && cmbp->res2 != 0);\t\t\t \\\n> \t\t\t\t\t\t\t\t\t \\\n> \tput32 (outptr, cmbp->res1);\t\t\t\t\t \\\n> \toutptr += 4;\t\t\t\t\t\t\t \\\n> -\tput32 (outptr, cmbp->res2);\t\t\t\t\t \\\n> -\toutptr += 4;\t\t\t\t\t\t\t \\\n> +\t\t\t\t\t\t\t\t\t \\\n> +\t/* See whether we have room for the second character. */\t \\\n> +\tif (outend - outptr >= 4)\t\t\t\t\t \\\n> +\t {\t\t\t\t\t\t\t\t \\\n> +\t put32 (outptr, cmbp->res2);\t\t\t\t\t \\\n> +\t outptr += 4;\t\t\t\t\t\t \\\n> +\t }\t\t\t\t\t\t\t\t \\\n> +\telse\t\t\t\t\t\t\t\t \\\n> +\t {\t\t\t\t\t\t\t\t \\\n> +\t /* Otherwise store only the first character now, and\t \\\n> +\t put the second one into the queue. */\t\t\t \\\n> +\t curcs |= cmbp->res2 << 7;\t\t\t\t\t \\\n> +\t inptr += 2;\t\t\t\t\t\t\t \\\n> +\t /* Tell the caller why we terminate the loop. */\t\t \\\n> +\t result = __GCONV_FULL_OUTPUT;\t\t\t\t \\\n> +\t break;\t\t\t\t\t\t\t \\\n> +\t }\t\t\t\t\t\t\t\t \\\n> }\t\t\t\t\t\t\t\t\t \\\n> }\n> #else\n> @@ -153,7 +180,20 @@ enum\n> #define LOOPFCT \t\tFROM_LOOP\n> #define BODY \\\n> {\t\t\t\t\t\t\t\t\t \\\n> - uint32_t ch = *inptr;\t\t\t\t\t\t \\\n> + uint32_t ch;\t\t\t\t\t\t\t \\\n> +\t\t\t\t\t\t\t\t\t \\\n> + ch = curcs >> 7;\t\t\t\t\t\t\t \\\n> + if (__glibc_unlikely (ch != 0))\t\t\t\t\t \\\n> + {\t\t\t\t\t\t\t\t\t \\\n> +\tput32 (outptr, ch);\t\t\t\t\t\t \\\n> +\toutptr += 4;\t\t\t\t\t\t\t \\\n> +\t/* Remove the pending character, but preserve state bits. */\t \\\n> +\tcurcs &= (1 << 7) - 1;\t\t\t\t\t\t \\\n> +\tcontinue;\t\t\t\t\t\t\t \\\n> + }\t\t\t\t\t\t\t\t\t \\\n> +\t\t\t\t\t\t\t\t\t \\\n> + /* Otherwise read the next input byte. */\t\t\t\t \\\n> + ch = *inptr;\t\t\t\t\t\t\t \\\n> \t\t\t\t\t\t\t\t\t \\\n> if (__builtin_expect (ch, 0) == SO)\t\t\t\t\t \\\n> {\t\t\t\t\t\t\t\t\t \\\n> diff --git a/iconvdata/tst-bug33980.c b/iconvdata/tst-bug33980.c\n> new file mode 100644\n> index 0000000000..c9693e0efe\n> --- /dev/null\n> +++ b/iconvdata/tst-bug33980.c\n> @@ -0,0 +1,153 @@\n> +/* Test for bug 33980: combining characters in IBM1390/IBM1399.\n\nOK.\n\n> + Copyright (C) 2026 Free Software Foundation, Inc.\n\nOK.\n\n> + This file is part of the GNU C Library.\n> +\n> + The GNU C Library is free software; you can redistribute it and/or\n> + modify it under the terms of the GNU Lesser General Public\n> + License as published by the Free Software Foundation; either\n> + version 2.1 of the License, or (at your option) any later version.\n> +\n> + The GNU C Library is distributed in the hope that it will be useful,\n> + but WITHOUT ANY WARRANTY; without even the implied warranty of\n> + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\n> + Lesser General Public License for more details.\n> +\n> + You should have received a copy of the GNU Lesser General Public\n> + License along with the GNU C Library; if not, see\n> + . */\n\nOK.\n\n> +\n> +#include \n> +#include \n> +#include \n> +#include \n> +#include \n> +\n> +#include \n> +#include \n> +#include \n> +\n> +/* Run iconv in a loop with a small output buffer of OUTBUFSIZE bytes\n> + starting at OUTBUF. OUTBUF should be right before an unmapped page\n> + so that writing past the end will fault. Skip SHIFT bytes at the\n> + start of the input and output, to exercise different buffer\n> + alignment. TRUNCATE indicates skipped bytes at the end of\n> + input (0 and 1 a valid). */\n> +static void\n> +test_one (const char *encoding, unsigned int shift, unsigned int truncate,\n> + char *outbuf, size_t outbufsize)\n> +{\n> + /* In IBM1390 and IBM1399, the DBCS code 0xECB5 expands to two\n> + Unicode code points when translated. */\n> + static char input[] =\n> + {\n> + /* 8 letters X. */\n> + 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7,\n> + /* SO, 0xECB5, SI: shift to DBCS, special character, shift back. */\n> + 0x0e, 0xec, 0xb5, 0x0f\n> + };\n> +\n> + /* Expected output after UTF-8 conversion. */\n> + static char expected[] =\n> + {\n> + 'X', 'X', 'X', 'X', 'X', 'X', 'X', 'X',\n> + /* U+304B (HIRAGANA LETTER KA). */\n> + 0xe3, 0x81, 0x8b,\n> + /* U+309A (COMBINING KATAKANA-HIRAGANA SEMI-VOICED SOUND MARK). */\n> + 0xe3, 0x82, 0x9a\n> + };\n> +\n> + iconv_t cd = iconv_open (\"UTF-8\", encoding);\n> + TEST_VERIFY_EXIT (cd != (iconv_t) -1);\n> +\n> + char result_storage[64];\n> + struct alloc_buffer result_buf\n> + = alloc_buffer_create (result_storage, sizeof (result_storage));\n> +\n> + char *inptr = &input[shift];\n> + size_t inleft = sizeof (input) - shift - truncate;\n> +\n> + while (inleft > 0)\n> + {\n> + char *outptr = outbuf;\n> + size_t outleft = outbufsize;\n> + size_t inleft_before = inleft;\n> +\n> + size_t ret = iconv (cd, &inptr, &inleft, &outptr, &outleft);\n> + size_t produced = outptr - outbuf;\n> + alloc_buffer_copy_bytes (&result_buf, outbuf, produced);\n> +\n> + if (ret == (size_t) -1 && errno == E2BIG)\n> + {\n> + if (produced == 0 && inleft == inleft_before)\n> + {\n> + /* Output buffer too small to make progress. This is\n> + expected for very small output buffer sizes. */\n> + TEST_VERIFY_EXIT (outbufsize < 3);\n> + break;\n> + }\n> + continue;\n> + }\n> + if (ret == (size_t) -1)\n> + FAIL_EXIT1 (\"%s (outbufsize %zu): iconv: %m\", encoding, outbufsize);\n> + break;\n> + }\n> +\n> + /* Flush any pending state (e.g. a buffered combined character).\n> + With outbufsize < 3, we could not store the first character, so\n> + the second character did not become pending, and there is nothing\n> + to flush. */\n> + {\n> + char *outptr = outbuf;\n> + size_t outleft = outbufsize;\n> +\n> + size_t ret = iconv (cd, NULL, NULL, &outptr, &outleft);\n> + TEST_VERIFY_EXIT (ret == 0);\n> + size_t produced = outptr - outbuf;\n> + alloc_buffer_copy_bytes (&result_buf, outbuf, produced);\n> +\n> + /* Second flush does not provide more data. */\n> + outptr = outbuf;\n> + outleft = outbufsize;\n> + ret = iconv (cd, NULL, NULL, &outptr, &outleft);\n> + TEST_VERIFY_EXIT (ret == 0);\n> + TEST_VERIFY (outptr == outbuf);\n> + }\n> +\n> + TEST_VERIFY_EXIT (!alloc_buffer_has_failed (&result_buf));\n> + size_t result_used\n> + = sizeof (result_storage) - alloc_buffer_size (&result_buf);\n> +\n> + if (outbufsize >= 3)\n> + {\n> + TEST_COMPARE (inleft, 0);\n> + TEST_COMPARE (result_used, sizeof (expected) - shift);\n> + TEST_COMPARE_BLOB (result_storage, result_used,\n> + &expected[shift], sizeof (expected) - shift);\n> + }\n> + else\n> + /* If the buffer is too small, only the leading X could be converted. */\n> + TEST_COMPARE (result_used, 8 - shift);\n> +\n> + TEST_VERIFY_EXIT (iconv_close (cd) == 0);\n> +}\n> +\n> +static int\n> +do_test (void)\n> +{\n> + struct support_next_to_fault ntf\n> + = support_next_to_fault_allocate (8);\n> +\n> + for (int shift = 0; shift <= 8; ++shift)\n> + for (int truncate = 0; truncate < 2; ++truncate)\n> + for (size_t outbufsize = 1; outbufsize <= 8; outbufsize++)\n> + {\n> + char *outbuf = ntf.buffer + ntf.length - outbufsize;\n> + test_one (\"IBM1390\", shift, truncate, outbuf, outbufsize);\n> + test_one (\"IBM1399\", shift, truncate, outbuf, outbufsize);\n> + }\n> +\n> + support_next_to_fault_free (&ntf);\n> + return 0;\n> +}\n> +\n> +#include \n> \n> base-commit: 1b2f868fb4958fd59875695c1828d9804b116dc2\n>","headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","libc-alpha@sourceware.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","libc-alpha@sourceware.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=Ny8unT7k;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org\n (client-ip=2620:52:6:3111::32; helo=vm01.sourceware.org;\n envelope-from=libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org;\n receiver=patchwork.ozlabs.org)","sourceware.org;\n\tdkim=pass (1024-bit key,\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=Ny8unT7k","sourceware.org; dmarc=pass (p=quarantine dis=none)\n header.from=redhat.com","sourceware.org; spf=pass smtp.mailfrom=redhat.com","server2.sourceware.org;\n arc=none smtp.remote-ip=170.10.129.124"],"Received":["from vm01.sourceware.org (vm01.sourceware.org\n [IPv6:2620:52:6:3111::32])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fvSDJ1Gq7z1y2d\n\tfor ; Mon, 13 Apr 2026 22:59:44 +1000 (AEST)","from vm01.sourceware.org (localhost [127.0.0.1])\n\tby sourceware.org (Postfix) with ESMTP id 4B32D4BA2E2F\n\tfor ; Mon, 13 Apr 2026 12:59:42 +0000 (GMT)","from us-smtp-delivery-124.mimecast.com\n (us-smtp-delivery-124.mimecast.com [170.10.129.124])\n by sourceware.org (Postfix) with ESMTP id A03EA4BA2E25\n for ; Mon, 13 Apr 2026 12:59:17 +0000 (GMT)","from mail-qt1-f199.google.com (mail-qt1-f199.google.com\n [209.85.160.199]) by relay.mimecast.com with ESMTP with STARTTLS\n (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id\n us-mta-53-lsIxJuhsNjS10T7YMSrKyQ-1; Mon, 13 Apr 2026 08:59:15 -0400","by mail-qt1-f199.google.com with SMTP id\n d75a77b69052e-50b220c72bbso97166761cf.1\n for ; Mon, 13 Apr 2026 05:59:15 -0700 (PDT)","from [192.168.0.116] ([198.48.244.52])\n by smtp.gmail.com with ESMTPSA id\n d75a77b69052e-50dd53f2d79sm86431291cf.9.2026.04.13.05.59.12\n (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n Mon, 13 Apr 2026 05:59:12 -0700 (PDT)"],"DKIM-Filter":["OpenDKIM Filter v2.11.0 sourceware.org 4B32D4BA2E2F","OpenDKIM Filter v2.11.0 sourceware.org A03EA4BA2E25"],"DMARC-Filter":"OpenDMARC Filter v1.4.2 sourceware.org A03EA4BA2E25","ARC-Filter":"OpenARC Filter v1.0.0 sourceware.org A03EA4BA2E25","ARC-Seal":"i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1776085157; cv=none;\n b=xu5ev5CVd4hVPd7C0L/bHZ2xFJt14CeJiFzNfRmmFPdzSo/B5ycOMTZ3sih30tIIMXSk0uVesx47VXEQc9msWSJJmCPmywWb6skH7I+CkyCJj/iQNfpVs0h+st11/dYIDc6dU30QgbEFgNfbP5nhK8aV6yGtpszPLnLW7Uj42yM=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=sourceware.org; s=key;\n t=1776085157; c=relaxed/simple;\n bh=hyWGaUiCKdDZE4ALOovQcmpHAalT6GaROhtN23Jc1zM=;\n h=DKIM-Signature:Message-ID:Date:MIME-Version:Subject:To:From;\n b=WhN0Izq3N5KHlPy8rRfuT5RBTqXptljlr7z9tzhbVmPznyxnUA2hs+0Tyi7d0w4WaFB0xibhuX96VVumtxnYHznvJybBeIsxDdbY+aTQbMlkaZfW0n+y/L/9cxl/EzXY1ww4SeHeKaHFsSNMwZveqSsnMms38g8MZWsjyiR0rGQ=","ARC-Authentication-Results":"i=1; server2.sourceware.org","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n s=mimecast20190719; t=1776085156;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding:\n in-reply-to:in-reply-to:references:references;\n bh=V0/I3TK8iA1mXJDdHMMj42GCFqsxUNpZBC5+bQZ08l0=;\n b=Ny8unT7kS0cFo6Rf73I7ag+i1XH9shPSmtW/wvkzqtdhWRg0HNgC87tXf3fsdBpC01JCvy\n N2mtRBZzyc/8ApYZ9xHIHbs24zOehY0DGrhckd8Y3XEZ/WEy2qvA16++6K369eDy4r7K0z\n s1A3gXhuwwHLslvOd2Vs6nmnVXKMwWE=","X-MC-Unique":"lsIxJuhsNjS10T7YMSrKyQ-1","X-Mimecast-MFC-AGG-ID":"lsIxJuhsNjS10T7YMSrKyQ_1776085155","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776085154; x=1776689954;\n h=content-transfer-encoding:in-reply-to:from:content-language\n :references:to:subject:user-agent:mime-version:date:message-id\n :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id\n :reply-to;\n bh=V0/I3TK8iA1mXJDdHMMj42GCFqsxUNpZBC5+bQZ08l0=;\n b=ilrVD5bmt7647wNZqBR4V7A3iK60xF7rES0vefSPo/SsnegOJ2/2FgHCt40X+a/R1r\n 3vq+qiaJkFUitlNEEzhbODSc9/VE9ea1nX8kI8iigPuSlRDseL8lA6W4oABSeix4SUt6\n s7PTY5RnZWZSzbdU6U/Kc339oLpZorJN/fGoxcKckwOXwoabzKY8exvSIuH8v6ga+mPD\n VY9bLKphSJ1iTo5w61C0aLm+jQ+JiRLlOv2l2t3agHt4JlbnoccK+f3UZsbBvzG66tIm\n TwZGATIEdhPFU5IjlcUWlpwURuF8PFboMfFs7DSr8CdyINnBqGvCCVwOl8ON67kc+LTQ\n 9cvg==","X-Forwarded-Encrypted":"i=1;\n AFNElJ/DVcJ9O1OU7r20wH426u/iSfQ8ajGCFvM578EmBWWetohvUen02pAqVhb/D5cqSXPFfkprfdeVBgq6@sourceware.org","X-Gm-Message-State":"AOJu0YyTvdHOO3YuiC/OwsTIsE0FpThTDMOvS9Be2ffAEi+GUIO/+fr5\n 0IabK/hORZM627rPe6uXGm8uIHqNR5FlVyyHvNsjaAHfdC274OSHGlAC0aGv9YuxOL8R2pHLvpl\n tig6NdWOFgKiosm6vgLXlA90o3jjhIgz5484+WBjwdhM3VTZ1dFJfnOCNBaOBPFBknw4GRA==","X-Gm-Gg":"AeBDies+qb4hs2qEzOimCsQ/ppg0SyFFyCNA1/j3bxGalhZRSBvdDgXTLYR/HqTmXNi\n ZeOKLzOr5E1FswNdHtpAH4YiNAYsRe2rkyJNWhNmIHmj0pc4Q4G+qf4aCzwAozp5MLiqDcajmNd\n jxHl7RPKWBJ/h11xVvUyEhF77J9iPbbUBXjei2DWvHngcMJ34CHwR/rZqhysd147gbhQvDbIthi\n A4s/ONaDISpl9/LOIAnnTTRT7Dd1JdanPCJk7B49hNPd+c5PfYhvQdr5OGbkkNa+pli7cll/RPT\n xIqj10ntHabmGB1TkZyO7UhfF0MP6722Dl4098keGJYPnfepLcGnwZUhYyCG9To0TjEj8HRaNsK\n i72iTZbrmdmtdaw4HnqySIkSuAO2fXJaFuEdA8mteBesOQQrWsVAa2uxbrhs5HcXzDOlqwnlcRB\n YoOXlOipTB/h/I1SlEs+rykf0J","X-Received":["by 2002:a05:622a:4898:b0:50d:b33d:bc6b with SMTP id\n d75a77b69052e-50dd5b54b43mr203948111cf.20.1776085154034;\n Mon, 13 Apr 2026 05:59:14 -0700 (PDT)","by 2002:a05:622a:4898:b0:50d:b33d:bc6b with SMTP id\n d75a77b69052e-50dd5b54b43mr203947271cf.20.1776085153230;\n Mon, 13 Apr 2026 05:59:13 -0700 (PDT)"],"Message-ID":"<55c1821d-d696-42e5-b728-63cde20fd41e@redhat.com>","Date":"Mon, 13 Apr 2026 08:59:11 -0400","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","Subject":"Re: [PATCH v5] Use pending character state in IBM1390, IBM1399\n character sets (CVE-2026-4046)","To":"Florian Weimer , libc-alpha@sourceware.org","References":"","From":"Carlos O'Donell ","In-Reply-To":"","X-Mimecast-Spam-Score":"0","X-Mimecast-MFC-PROC-ID":"qm1EChPGNFtDLksVISuzUmc7d8C9qCFYIOIBi4paeYI_1776085155","X-Mimecast-Originator":"redhat.com","Content-Language":"en-US","Content-Type":"text/plain; charset=UTF-8; format=flowed","Content-Transfer-Encoding":"7bit","X-BeenThere":"libc-alpha@sourceware.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"Libc-alpha mailing list ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org"}}]