PR# 16939 Possible bug in {ENCODING_IMP}.c_iconv
Problem Report Summary
Submitter: prestoat2000
Category: Other
Priority: Medium
Date: 2010/07/02
Class: Bug
Severity: Serious
Number: 16939
Release: 6.6.83602
Confidential: No
Status: Open
Responsible:
Environment: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.8) Gecko/20100226 Firefox/3.5.8
Synopsis: Possible bug in {ENCODING_IMP}.c_iconv
Description
While looking at {ENCODING_IMP}.c_iconv (Unix version of ENCODING_IMP)
I noticed a possible bug. The descriptor is reset to its initial state
via
/* Reset the descriptor to intial state. */
iconv (cd, NULL, 0, NULL, 0);
but this is done *before* the loop. If the output buffer is not big
enough and the iconv call returns E2BIG, the buffer is reallocated
with a larger size and we go around the loop and call `iconv' again
with a larger buffer. However, the descriptor is not reset, so it
may not be in its initial state. This seems possibly wrong to me.
I wonder whether the resetting of the conversion descriptor should
be moved inside the loop, right before the iconv call.
I didn't try to construct an example to see if this really could
cause a problem. If I'm wrong, feel free to close this bug.
To Reproduce
Problem Report Interactions