[{"id":3677331,"web_url":"http://patchwork.ozlabs.org/comment/3677331/","msgid":"","list_archive_url":null,"date":"2026-04-14T17:42:32","subject":"Re: [PATCH v6] Use pending character state in IBM1390, IBM1399\n character sets (CVE-2026-4046)","submitter":{"id":68478,"url":"http://patchwork.ozlabs.org/api/people/68478/","name":"Carlos O'Donell","email":"codonell@redhat.com"},"content":"On 4/14/26 12:30 PM, Florian Weimer wrote:\n> Follow the example in iso-2022-jp-3.c and use the __count state\n> variable to store the pending character. This avoids restarting\n> the conversion if the output buffer ends between two 4-byte UCS-4\n> code points, so that the assert reported in the bug can no longer\n> happen.\n> \n> Even though the fix is applied to ibm1364.c, the change is only\n> effective for the two HAS_COMBINED codecs for IBM1390, IBM1399.\n> \n> The test case was mostly auto-generated using\n> claude-4.6-opus-high-thinking, and composer-2-fast shows up in the\n> log as well. During review, gpt-5.4-xhigh flagged that the original\n> version of the test case was not exercising the new character\n> flush logic.\n> \n> This fixes bug 33980.\n> \n> Assisted-by: LLM\n\nLGTM.\n\nReviewed-by: Carlos O'Donell \n\n> \n> ---\n> v6: Adjust Assisted-by: based on separate thread about AI policy.\n> iconvdata/Makefile | 4 +-\n> iconvdata/ibm1364.c | 70 +++++++++++++++++-----\n> iconvdata/tst-bug33980.c | 153 +++++++++++++++++++++++++++++++++++++++++++++++\n> 3 files changed, 211 insertions(+), 16 deletions(-)\n> \n> diff --git a/iconvdata/Makefile b/iconvdata/Makefile\n> index 26e888b443..fbb0067302 100644\n> --- a/iconvdata/Makefile\n> +++ b/iconvdata/Makefile\n> @@ -76,7 +76,7 @@ tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \\\n> \ttst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \\\n> \tbug-iconv10 bug-iconv11 bug-iconv12 tst-iconv-big5-hkscs-to-2ucs4 \\\n> \tbug-iconv13 bug-iconv14 bug-iconv15 \\\n> -\ttst-iconv-iso-2022-cn-ext\n> +\ttst-iconv-iso-2022-cn-ext tst-bug33980\n> ifeq ($(have-thread-library),yes)\n> tests += bug-iconv3\n> endif\n> @@ -333,6 +333,8 @@ $(objpfx)bug-iconv15.out: $(addprefix $(objpfx), $(gconv-modules)) \\\n> \t\t\t $(addprefix $(objpfx),$(modules.so))\n> $(objpfx)tst-iconv-iso-2022-cn-ext.out: $(addprefix $(objpfx), $(gconv-modules)) \\\n> \t\t\t\t\t$(addprefix $(objpfx),$(modules.so))\n> +$(objpfx)tst-bug33980.out: $(addprefix $(objpfx), $(gconv-modules)) \\\n> +\t\t\t $(addprefix $(objpfx),$(modules.so))\n> \n> $(objpfx)iconv-test.out: run-iconv-test.sh \\\n> \t\t\t $(addprefix $(objpfx), $(gconv-modules)) \\\n> diff --git a/iconvdata/ibm1364.c b/iconvdata/ibm1364.c\n> index 4f41f22c12..8df66ea048 100644\n> --- a/iconvdata/ibm1364.c\n> +++ b/iconvdata/ibm1364.c\n> @@ -67,12 +67,29 @@\n> \n> /* Since this is a stateful encoding we have to provide code which resets\n> the output state to the initial state. This has to be done during the\n> - flushing. */\n> + flushing. For the to-internal direction (FROM_DIRECTION is true),\n> + there may be a pending character that needs flushing. */\n> #define EMIT_SHIFT_TO_INIT \\\n> if ((data->__statep->__count & ~7) != sb)\t\t\t\t \\\n> {\t\t\t\t\t\t\t\t\t \\\n> if (FROM_DIRECTION)\t\t\t\t\t\t \\\n> -\tdata->__statep->__count &= 7;\t\t\t\t\t \\\n> +\t{\t\t\t\t\t\t\t\t \\\n> +\t uint32_t ch = data->__statep->__count >> 7;\t\t\t \\\n> +\t if (__glibc_unlikely (ch != 0))\t\t\t\t \\\n> +\t {\t\t\t\t\t\t\t\t \\\n> +\t if (__glibc_unlikely (outend - outbuf < 4))\t\t \\\n> +\t\tstatus = __GCONV_FULL_OUTPUT;\t\t\t\t \\\n> +\t else\t\t\t\t\t\t\t \\\n> +\t\t{\t\t\t\t\t\t\t \\\n> +\t\t put32 (outbuf, ch);\t\t\t\t\t \\\n> +\t\t outbuf += 4;\t\t\t\t\t\t \\\n> +\t\t /* Clear character and db bit. */\t\t\t \\\n> +\t\t data->__statep->__count &= 7;\t\t\t\t \\\n> +\t\t}\t\t\t\t\t\t\t \\\n> +\t }\t\t\t\t\t\t\t\t \\\n> +\t else\t\t\t\t\t\t\t\t \\\n> +\t data->__statep->__count &= 7;\t\t\t\t \\\n> +\t}\t\t\t\t\t\t\t\t \\\n> else\t\t\t\t\t\t\t\t \\\n> \t{\t\t\t\t\t\t\t\t \\\n> \t /* We are not in the initial state. To switch back we have\t \\\n> @@ -99,11 +116,13 @@\n> *curcsp = save_curcs\n> \n> \n> -/* Current codeset type. */\n> +/* Current codeset type. The bit is stored in the __count variable of\n> + the conversion state. If the db bit is set, bit 7 and above store\n> + a pending UCS-4 code point if non-zero. */\n> enum\n> {\n> - sb = 0,\n> - db = 64\n> + sb = 0,\t\t\t/* Single byte mode. */\n> + db = 64\t\t\t/* Double byte mode. */\n> };\n> \n> \n> @@ -119,21 +138,29 @@ enum\n> }\t\t\t\t\t\t\t\t\t \\\n> else\t\t\t\t\t\t\t\t \\\n> {\t\t\t\t\t\t\t\t\t \\\n> -\t/* This is a combined character. Make sure we have room. */\t \\\n> -\tif (__glibc_unlikely (outptr + 8 > outend))\t\t\t \\\n> -\t {\t\t\t\t\t\t\t\t \\\n> -\t result = __GCONV_FULL_OUTPUT;\t\t\t\t \\\n> -\t break;\t\t\t\t\t\t\t \\\n> -\t }\t\t\t\t\t\t\t\t \\\n> -\t\t\t\t\t\t\t\t\t \\\n> \tconst struct divide *cmbp\t\t\t\t\t \\\n> \t = &DB_TO_UCS4_COMB[ch - __TO_UCS4_COMBINED_MIN];\t\t \\\n> \tassert (cmbp->res1 != 0 && cmbp->res2 != 0);\t\t\t \\\n> \t\t\t\t\t\t\t\t\t \\\n> \tput32 (outptr, cmbp->res1);\t\t\t\t\t \\\n> \toutptr += 4;\t\t\t\t\t\t\t \\\n> -\tput32 (outptr, cmbp->res2);\t\t\t\t\t \\\n> -\toutptr += 4;\t\t\t\t\t\t\t \\\n> +\t\t\t\t\t\t\t\t\t \\\n> +\t/* See whether we have room for the second character. */\t \\\n> +\tif (outend - outptr >= 4)\t\t\t\t\t \\\n> +\t {\t\t\t\t\t\t\t\t \\\n> +\t put32 (outptr, cmbp->res2);\t\t\t\t\t \\\n> +\t outptr += 4;\t\t\t\t\t\t \\\n> +\t }\t\t\t\t\t\t\t\t \\\n> +\telse\t\t\t\t\t\t\t\t \\\n> +\t {\t\t\t\t\t\t\t\t \\\n> +\t /* Otherwise store only the first character now, and\t \\\n> +\t put the second one into the queue. */\t\t\t \\\n> +\t curcs |= cmbp->res2 << 7;\t\t\t\t\t \\\n> +\t inptr += 2;\t\t\t\t\t\t\t \\\n> +\t /* Tell the caller why we terminate the loop. */\t\t \\\n> +\t result = __GCONV_FULL_OUTPUT;\t\t\t\t \\\n> +\t break;\t\t\t\t\t\t\t \\\n> +\t }\t\t\t\t\t\t\t\t \\\n> }\t\t\t\t\t\t\t\t\t \\\n> }\n> #else\n> @@ -153,7 +180,20 @@ enum\n> #define LOOPFCT \t\tFROM_LOOP\n> #define BODY \\\n> {\t\t\t\t\t\t\t\t\t \\\n> - uint32_t ch = *inptr;\t\t\t\t\t\t \\\n> + uint32_t ch;\t\t\t\t\t\t\t \\\n> +\t\t\t\t\t\t\t\t\t \\\n> + ch = curcs >> 7;\t\t\t\t\t\t\t \\\n> + if (__glibc_unlikely (ch != 0))\t\t\t\t\t \\\n> + {\t\t\t\t\t\t\t\t\t \\\n> +\tput32 (outptr, ch);\t\t\t\t\t\t \\\n> +\toutptr += 4;\t\t\t\t\t\t\t \\\n> +\t/* Remove the pending character, but preserve state bits. */\t \\\n> +\tcurcs &= (1 << 7) - 1;\t\t\t\t\t\t \\\n> +\tcontinue;\t\t\t\t\t\t\t \\\n> + }\t\t\t\t\t\t\t\t\t \\\n> +\t\t\t\t\t\t\t\t\t \\\n> + /* Otherwise read the next input byte. */\t\t\t\t \\\n> + ch = *inptr;\t\t\t\t\t\t\t \\\n> \t\t\t\t\t\t\t\t\t \\\n> if (__builtin_expect (ch, 0) == SO)\t\t\t\t\t \\\n> {\t\t\t\t\t\t\t\t\t \\\n> diff --git a/iconvdata/tst-bug33980.c b/iconvdata/tst-bug33980.c\n> new file mode 100644\n> index 0000000000..c9693e0efe\n> --- /dev/null\n> +++ b/iconvdata/tst-bug33980.c\n> @@ -0,0 +1,153 @@\n> +/* Test for bug 33980: combining characters in IBM1390/IBM1399.\n> + Copyright (C) 2026 Free Software Foundation, Inc.\n> + This file is part of the GNU C Library.\n> +\n> + The GNU C Library is free software; you can redistribute it and/or\n> + modify it under the terms of the GNU Lesser General Public\n> + License as published by the Free Software Foundation; either\n> + version 2.1 of the License, or (at your option) any later version.\n> +\n> + The GNU C Library is distributed in the hope that it will be useful,\n> + but WITHOUT ANY WARRANTY; without even the implied warranty of\n> + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\n> + Lesser General Public License for more details.\n> +\n> + You should have received a copy of the GNU Lesser General Public\n> + License along with the GNU C Library; if not, see\n> + . */\n> +\n> +#include \n> +#include \n> +#include \n> +#include \n> +#include \n> +\n> +#include \n> +#include \n> +#include \n> +\n> +/* Run iconv in a loop with a small output buffer of OUTBUFSIZE bytes\n> + starting at OUTBUF. OUTBUF should be right before an unmapped page\n> + so that writing past the end will fault. Skip SHIFT bytes at the\n> + start of the input and output, to exercise different buffer\n> + alignment. TRUNCATE indicates skipped bytes at the end of\n> + input (0 and 1 a valid). */\n> +static void\n> +test_one (const char *encoding, unsigned int shift, unsigned int truncate,\n> + char *outbuf, size_t outbufsize)\n> +{\n> + /* In IBM1390 and IBM1399, the DBCS code 0xECB5 expands to two\n> + Unicode code points when translated. */\n> + static char input[] =\n> + {\n> + /* 8 letters X. */\n> + 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7,\n> + /* SO, 0xECB5, SI: shift to DBCS, special character, shift back. */\n> + 0x0e, 0xec, 0xb5, 0x0f\n> + };\n> +\n> + /* Expected output after UTF-8 conversion. */\n> + static char expected[] =\n> + {\n> + 'X', 'X', 'X', 'X', 'X', 'X', 'X', 'X',\n> + /* U+304B (HIRAGANA LETTER KA). */\n> + 0xe3, 0x81, 0x8b,\n> + /* U+309A (COMBINING KATAKANA-HIRAGANA SEMI-VOICED SOUND MARK). */\n> + 0xe3, 0x82, 0x9a\n> + };\n> +\n> + iconv_t cd = iconv_open (\"UTF-8\", encoding);\n> + TEST_VERIFY_EXIT (cd != (iconv_t) -1);\n> +\n> + char result_storage[64];\n> + struct alloc_buffer result_buf\n> + = alloc_buffer_create (result_storage, sizeof (result_storage));\n> +\n> + char *inptr = &input[shift];\n> + size_t inleft = sizeof (input) - shift - truncate;\n> +\n> + while (inleft > 0)\n> + {\n> + char *outptr = outbuf;\n> + size_t outleft = outbufsize;\n> + size_t inleft_before = inleft;\n> +\n> + size_t ret = iconv (cd, &inptr, &inleft, &outptr, &outleft);\n> + size_t produced = outptr - outbuf;\n> + alloc_buffer_copy_bytes (&result_buf, outbuf, produced);\n> +\n> + if (ret == (size_t) -1 && errno == E2BIG)\n> + {\n> + if (produced == 0 && inleft == inleft_before)\n> + {\n> + /* Output buffer too small to make progress. This is\n> + expected for very small output buffer sizes. */\n> + TEST_VERIFY_EXIT (outbufsize < 3);\n> + break;\n> + }\n> + continue;\n> + }\n> + if (ret == (size_t) -1)\n> + FAIL_EXIT1 (\"%s (outbufsize %zu): iconv: %m\", encoding, outbufsize);\n> + break;\n> + }\n> +\n> + /* Flush any pending state (e.g. a buffered combined character).\n> + With outbufsize < 3, we could not store the first character, so\n> + the second character did not become pending, and there is nothing\n> + to flush. */\n> + {\n> + char *outptr = outbuf;\n> + size_t outleft = outbufsize;\n> +\n> + size_t ret = iconv (cd, NULL, NULL, &outptr, &outleft);\n> + TEST_VERIFY_EXIT (ret == 0);\n> + size_t produced = outptr - outbuf;\n> + alloc_buffer_copy_bytes (&result_buf, outbuf, produced);\n> +\n> + /* Second flush does not provide more data. */\n> + outptr = outbuf;\n> + outleft = outbufsize;\n> + ret = iconv (cd, NULL, NULL, &outptr, &outleft);\n> + TEST_VERIFY_EXIT (ret == 0);\n> + TEST_VERIFY (outptr == outbuf);\n> + }\n> +\n> + TEST_VERIFY_EXIT (!alloc_buffer_has_failed (&result_buf));\n> + size_t result_used\n> + = sizeof (result_storage) - alloc_buffer_size (&result_buf);\n> +\n> + if (outbufsize >= 3)\n> + {\n> + TEST_COMPARE (inleft, 0);\n> + TEST_COMPARE (result_used, sizeof (expected) - shift);\n> + TEST_COMPARE_BLOB (result_storage, result_used,\n> + &expected[shift], sizeof (expected) - shift);\n> + }\n> + else\n> + /* If the buffer is too small, only the leading X could be converted. */\n> + TEST_COMPARE (result_used, 8 - shift);\n> +\n> + TEST_VERIFY_EXIT (iconv_close (cd) == 0);\n> +}\n> +\n> +static int\n> +do_test (void)\n> +{\n> + struct support_next_to_fault ntf\n> + = support_next_to_fault_allocate (8);\n> +\n> + for (int shift = 0; shift <= 8; ++shift)\n> + for (int truncate = 0; truncate < 2; ++truncate)\n> + for (size_t outbufsize = 1; outbufsize <= 8; outbufsize++)\n> + {\n> + char *outbuf = ntf.buffer + ntf.length - outbufsize;\n> + test_one (\"IBM1390\", shift, truncate, outbuf, outbufsize);\n> + test_one (\"IBM1399\", shift, truncate, outbuf, outbufsize);\n> + }\n> +\n> + support_next_to_fault_free (&ntf);\n> + return 0;\n> +}\n> +\n> +#include \n> \n> base-commit: d8997716a1ca22cf038eac86ed286830ba9818cc\n>","headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","libc-alpha@sourceware.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","libc-alpha@sourceware.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=DoDYPoML;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org\n (client-ip=2620:52:6:3111::32; helo=vm01.sourceware.org;\n envelope-from=libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org;\n receiver=patchwork.ozlabs.org)","sourceware.org;\n\tdkim=pass (1024-bit key,\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=DoDYPoML","sourceware.org; dmarc=pass (p=quarantine dis=none)\n header.from=redhat.com","sourceware.org; spf=pass smtp.mailfrom=redhat.com","server2.sourceware.org;\n arc=none smtp.remote-ip=170.10.129.124"],"Received":["from vm01.sourceware.org (vm01.sourceware.org\n [IPv6:2620:52:6:3111::32])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fwBSk5VQfz1xtJ\n\tfor ; Wed, 15 Apr 2026 03:43:02 +1000 (AEST)","from vm01.sourceware.org (localhost [127.0.0.1])\n\tby sourceware.org (Postfix) with ESMTP id E866D4BA2E32\n\tfor ; Tue, 14 Apr 2026 17:43:00 +0000 (GMT)","from us-smtp-delivery-124.mimecast.com\n (us-smtp-delivery-124.mimecast.com [170.10.129.124])\n by sourceware.org (Postfix) with ESMTP id EEF8C4BA2E08\n for ; Tue, 14 Apr 2026 17:42:37 +0000 (GMT)","from mail-qt1-f197.google.com (mail-qt1-f197.google.com\n [209.85.160.197]) by relay.mimecast.com with ESMTP with STARTTLS\n (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id\n us-mta-633-rz7hWiUaO3Oh3E-cJ5bwZQ-1; Tue, 14 Apr 2026 13:42:34 -0400","by mail-qt1-f197.google.com with SMTP id\n d75a77b69052e-50b4076dc16so147349501cf.2\n for ; Tue, 14 Apr 2026 10:42:34 -0700 (PDT)","from [192.168.0.116] ([198.48.244.52])\n by smtp.gmail.com with ESMTPSA id\n d75a77b69052e-50dd563d284sm109345541cf.29.2026.04.14.10.42.32\n (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n Tue, 14 Apr 2026 10:42:32 -0700 (PDT)"],"DKIM-Filter":["OpenDKIM Filter v2.11.0 sourceware.org E866D4BA2E32","OpenDKIM Filter v2.11.0 sourceware.org EEF8C4BA2E08"],"DMARC-Filter":"OpenDMARC Filter v1.4.2 sourceware.org EEF8C4BA2E08","ARC-Filter":"OpenARC Filter v1.0.0 sourceware.org EEF8C4BA2E08","ARC-Seal":"i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1776188558; cv=none;\n b=HacltNy8CWl0laPxTIhM+owD0Ob9n0w8j5usIO/AwESKouW1O6ZbLYm9SzmXy+h48xxNyanpRa7Yewg1O+lc6N10b98zI0JWue17doVnxgI8fLYoa/S0gyp0frefKQD53F5LsT3jfq8d9NMoKg2rBuiaqs0tEU58K2j3b3weUgU=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=sourceware.org; s=key;\n t=1776188558; c=relaxed/simple;\n bh=ddwpl4YspmnRLo4FQyl1woAUwMxWVIoio+ssmS+E74g=;\n h=DKIM-Signature:Message-ID:Date:MIME-Version:Subject:To:From;\n b=pyqxIdNTY0ck4fM1r4V19u6SndENihYlKsO/HsYZYz6m4L5Lrfkn+o4lziK4p07DAqamen+nbDa8ouUR1Z2R/0VMaS6aq9vm1DNa/zVhEMLU3mFrwFEkSgbTgpcct0BNKE4LXHUpWlbf/sx3cZVTdttYHUiM0PeGqv9V88aeEfI=","ARC-Authentication-Results":"i=1; server2.sourceware.org","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n s=mimecast20190719; t=1776188557;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding:\n in-reply-to:in-reply-to:references:references;\n bh=R1FZrp7ur439n0ZXk8lATFYSg1hbXL8PxT9WeR7V2P8=;\n b=DoDYPoMLQxkUEac1f3vGTKm8k2v9EBnIPPBrTiRy/UDVhNc/x70wuB45zXIbV4QifMKDeb\n sutTYXEpfJt576oSZkyYh+Aqtla3PcKVYwDLlUgGh0DQ+3nPOeNVeQkwQik6RhSKaaQHRM\n E6nFEJggmQe5c/q2daO+958cGjDBBIE=","X-MC-Unique":"rz7hWiUaO3Oh3E-cJ5bwZQ-1","X-Mimecast-MFC-AGG-ID":"rz7hWiUaO3Oh3E-cJ5bwZQ_1776188554","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776188554; x=1776793354;\n h=content-transfer-encoding:in-reply-to:from:content-language\n :references:to:subject:user-agent:mime-version:date:message-id\n :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id\n :reply-to;\n bh=R1FZrp7ur439n0ZXk8lATFYSg1hbXL8PxT9WeR7V2P8=;\n b=U8U7jpIhr3WEnaGV6lGvgSxouYoKQ/yzo1QzLva3wfnFf+kQOxcdYx+hFdgmt7Pwwu\n 3PAtjN15YskU4YxlBTQkOSwRiFSwZRnUv8GBFumHm+8Erf8uKFitW/pEV+hahzERpcoG\n uBMEmxRGnLoAVdlgj+9Z5W0bzTlp63ndREYCpzvsHbsrDQUJnfcih4JR56h08Iu3Wedm\n yaYOUIajoHFG158r549RGfc2Hl0VtzVKaM06fSeGSQ6t1fiiPtEw15w+B5yGc3mjcUYZ\n 2PLRRJqqYwCSbV83POJ95nypTwy3gkm8pLlGNthUitNfoc4hI73At2YwuvdCxCY41WN/\n ZErg==","X-Forwarded-Encrypted":"i=1;\n AFNElJ/K/Kr4m5BGkHmtOKNBmCVRhQgovMZd0gKJj98vlpxqqp3bAj1vmwSk9ApSPrLj6B+QDvdbjPKbzloR@sourceware.org","X-Gm-Message-State":"AOJu0YzwcD9eyuRhnlBWHRE3EGfMRx5Y4IO5nyJrMysmArlGD+U5m1YS\n LiY2ANw7VUnZXhL1LTRQxVqu4NHqpPoud0ZYmp/ga/vpihlHB75I0DU80kR6q5oJ1ADBQ2pX2RY\n fiLiwuWVwSHPKZLRf8Xv9RwqvmpOOZ9p3y+EISraozzIY/xGd3PtejpuF6mfLuQ==","X-Gm-Gg":"AeBDieul5RD1bEyLL9O98GvCW4mNZAuDz05ayz5LUAgKk1nv6Kim4Vhf8gDkZaHjSSo\n z9JT0lRhdMOtnpu6PXuW+1IteH/0fKOT/+eLUSk1Km1vDGm/L+bdNL/LxeTqUN28Z75etdAnETI\n N1y3gU+BzksXIlYxDips/lSb+EJxw2+ypuY77HjPHojC4fvhO14JorI/GDS+AvXq6gz3hwcEWTR\n i/YacTcVpeXJsId6Godbq2NrpttCNPKIYN+ndC8uVJuTvRhHhKTeIv1wh52wwhx0IfecxVacLxc\n zwEEy2f8bgTXqh7edDyB3roNIIPjmPT3eUG3XML+hzVDGDUQyPNm+9EEsCx8lX1jhZ6bCTAzE27\n /VN2BQJwOoqJnmKAvGxKlGnye0n7Q8Zw35Wi3uwn9p4ffL4GtIGe4+/SHr5lma12dx1Yl8JEV2V\n r1qxMavyi6eG85RYB2i0d2oylngZuhussKIJY=","X-Received":["by 2002:ac8:7dc7:0:b0:4f1:ab79:fb18 with SMTP id\n d75a77b69052e-50dd5bf81femr285734341cf.25.1776188554180;\n Tue, 14 Apr 2026 10:42:34 -0700 (PDT)","by 2002:ac8:7dc7:0:b0:4f1:ab79:fb18 with SMTP id\n d75a77b69052e-50dd5bf81femr285733721cf.25.1776188553484;\n Tue, 14 Apr 2026 10:42:33 -0700 (PDT)"],"Message-ID":"","Date":"Tue, 14 Apr 2026 13:42:32 -0400","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","Subject":"Re: [PATCH v6] Use pending character state in IBM1390, IBM1399\n character sets (CVE-2026-4046)","To":"Florian Weimer , libc-alpha@sourceware.org","References":"","From":"Carlos O'Donell ","In-Reply-To":"","X-Mimecast-Spam-Score":"0","X-Mimecast-MFC-PROC-ID":"o5rR733DxgJ0I2uMgnS4GAG1NBWLt0g4Q09Fr9V_g4k_1776188554","X-Mimecast-Originator":"redhat.com","Content-Language":"en-US","Content-Type":"text/plain; charset=UTF-8; format=flowed","Content-Transfer-Encoding":"7bit","X-BeenThere":"libc-alpha@sourceware.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"Libc-alpha mailing list ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org"}}]