local-CVE-2026-4046

local-CVE-2026-4046

Origin: upstream, https://sourceware.org/git/?p=glibc.git;a=commit;h=7abd383d439dc348419a9fd526d42ea4591e8aaf

From 7abd383d439dc348419a9fd526d42ea4591e8aaf Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Thu, 16 Apr 2026 19:13:43 +0200
Subject: [PATCH] Use pending character state in IBM1390, IBM1399 character
 sets (CVE-2026-4046)

Follow the example in iso-2022-jp-3.c and use the __count state
variable to store the pending character.  This avoids restarting
the conversion if the output buffer ends between two 4-byte UCS-4
code points, so that the assert reported in the bug can no longer
happen.

Even though the fix is applied to ibm1364.c, the change is only
effective for the two HAS_COMBINED codecs for IBM1390, IBM1399.

The test case was mostly auto-generated using
claude-4.6-opus-high-thinking, and composer-2-fast shows up in the
log as well.  During review, gpt-5.4-xhigh flagged that the original
version of the test case was not exercising the new character
flush logic.

This fixes bug 33980.

Assisted-by: LLM
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
(cherry picked from commit d6f08d1cf027f4eb2ba289a6cc66853722d4badc)

Gbp-Pq: Topic any
Gbp-Pq: Name local-CVE-2026-4046.diff