Fix out-of-bounds access in IBM-1390 converter (bug 23448)

The IBM-1390 converter can consume/produce two UCS4 characters in each loop.
lattera · Jul 24, 2018 · 21526a5 · 21526a5
1 parent 3650e1d
commit 21526a5
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/ChangeLog b/ChangeLog
@@ -1,3 +1,9 @@
+2018-07-24  Andreas Schwab  <[email protected]>
+
+	[BZ #23448]
+	* iconvdata/ibm1364.c (MAX_NEEDED_OUTPUT) [FROM_LOOP]: Define.
+	(MAX_NEEDED_INPUT) [TO_LOOP]: Define.
+
 2018-07-24  H.J. Lu  <[email protected]>
 
 	* sysdeps/unix/sysv/linux/i386/vfork.S (SYSCALL_ERROR_HANDLER):

diff --git a/iconvdata/ibm1364.c b/iconvdata/ibm1364.c
@@ -150,6 +150,7 @@ enum
 #define MIN_NEEDED_INPUT  	MIN_NEEDED_FROM
 #define MAX_NEEDED_INPUT  	MAX_NEEDED_FROM
 #define MIN_NEEDED_OUTPUT 	MIN_NEEDED_TO
+#define MAX_NEEDED_OUTPUT 	MAX_NEEDED_TO
 #define LOOPFCT 		FROM_LOOP
 #define BODY \
   {									      \
@@ -296,6 +297,7 @@ enum
 
 /* Next, define the other direction.  */
 #define MIN_NEEDED_INPUT	MIN_NEEDED_TO
+#define MAX_NEEDED_INPUT  	MAX_NEEDED_TO
 #define MIN_NEEDED_OUTPUT	MIN_NEEDED_FROM
 #define MAX_NEEDED_OUTPUT	MAX_NEEDED_FROM
 #define LOOPFCT			TO_LOOP