PR# 16939 Possible bug in {ENCODING_IMP}.c_iconv

Problem Report Summary
Submitter: prestoat2000
Category: Other
Priority: Medium
Date: 2010/07/02
Class: Bug
Severity: Serious
Number: 16939
Release: 6.6.83602
Confidential: No
Status: Open
Responsible:
Environment: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.8) Gecko/20100226 Firefox/3.5.8
Synopsis: Possible bug in {ENCODING_IMP}.c_iconv

Description
While looking at {ENCODING_IMP}.c_iconv (Unix version of ENCODING_IMP)
I noticed a possible bug.  The descriptor is reset to its initial state
via

				
	/* Reset the descriptor to intial state. */
	iconv (cd, NULL, 0, NULL, 0);

but this is done *before* the loop.  If the output buffer is not big
enough and the iconv call returns E2BIG, the buffer is reallocated
with a larger size and we go around the loop and call `iconv' again
with a larger buffer.  However, the descriptor is not reset, so it
may not be in its initial state.  This seems possibly wrong to me.
I wonder whether the resetting of the conversion descriptor should
be moved inside the loop, right before the iconv call.

I didn't try to construct an example to see if this really could
cause a problem.  If I'm wrong, feel free to close this bug.
To Reproduce

										
Problem Report Interactions