Fix out-of-bounds access in IBM-1390 converter (bug 23448)

The IBM-1390 converter can consume/produce two UCS4 characters in each
loop.

diff --git a/ChangeLog b/ChangeLog
index 8b892eb..cb01527 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2018-07-24  Andreas Schwab  <schwab@suse.de>
+
+       [BZ #23448]
+       * iconvdata/ibm1364.c (MAX_NEEDED_OUTPUT) [FROM_LOOP]: Define.
+       (MAX_NEEDED_INPUT) [TO_LOOP]: Define.
+
 2018-07-24  H.J. Lu  <hongjiu.lu@intel.com>
 
        * sysdeps/unix/sysv/linux/i386/vfork.S (SYSCALL_ERROR_HANDLER):

diff --git a/iconvdata/ibm1364.c b/iconvdata/ibm1364.c
index b833273..517fe60 100644 (file)
--- a/iconvdata/ibm1364.c
+++ b/iconvdata/ibm1364.c
@@ -150,6 +150,7 @@ enum
 #define MIN_NEEDED_INPUT       MIN_NEEDED_FROM
 #define MAX_NEEDED_INPUT       MAX_NEEDED_FROM
 #define MIN_NEEDED_OUTPUT      MIN_NEEDED_TO
+#define MAX_NEEDED_OUTPUT      MAX_NEEDED_TO
 #define LOOPFCT                FROM_LOOP
 #define BODY \
   {                                                                          \
@@ -296,6 +297,7 @@ enum
 
 /* Next, define the other direction.  */
 #define MIN_NEEDED_INPUT       MIN_NEEDED_TO
+#define MAX_NEEDED_INPUT       MAX_NEEDED_TO
 #define MIN_NEEDED_OUTPUT      MIN_NEEDED_FROM
 #define MAX_NEEDED_OUTPUT      MAX_NEEDED_FROM
 #define LOOPFCT                        TO_LOOP