On Tue, Jun 20, 2017 at 08:41:42PM -0400, Rich Felker wrote:
> On Thu, Jun 15, 2017 at 11:30:48PM +0200, Bartosz Brachaczek wrote:
> > commit 97bd6b09dbe7478d5a90a06ecd9e5b59389d8eb9 refactored the table
> > lookup into a function and introduced an error in index computation.
> > the error caused garbage to be read from the table if the given charmap
> > had a non-zero number of elided entries.
> > ---
> >  src/locale/iconv.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/src/locale/iconv.c b/src/locale/iconv.c
> > index 4636307f..fd2f2e01 100644
> > --- a/src/locale/iconv.c
> > +++ b/src/locale/iconv.c
> > @@ -153,7 +153,7 @@ static void put_32(unsigned char *s, unsigned c, int e)
> >  
> >  static unsigned legacy_map(const unsigned char *map, unsigned c)
> >  {
> > -	unsigned x = c - 128 + map[-1];
> > +	unsigned x = c - 128 - map[-1];
> >  	x = legacy_chars[ map[x*5/4]>>2*x%8 |
> >  		map[x*5/4+1]<<8-2*x%8 & 1023 ];
> >  	return x ? x : c;
> > -- 
> > 2.13.0
> 
> Thanks! Applying.

And here's a regression test we could add to libc-test.

Rich