Improve iconvbufs() to do more buffer size checks.

- If iconv() returns EINVAL or EILSEQ and the error is being ignored, make
  sure that there is room in the output buffer to store the erroneous char.
- When accepting an erroneous char, be sure to break if there are no more
  input characters (without calling iconv() with a zero input length).

1 files changed, 7 insertions, 0 deletions

diff --git a/rsync.c b/rsync.c
index 540ccd93..cf210099 100644
--- a/rsync.c
+++ b/rsync.c
@@ -210,11 +210,16 @@ int iconvbufs(iconv_t ic, xbuf *in, xbuf *out, int flags)
 			if (errno == EINVAL) {
 				if (!(flags & ICB_INCLUDE_INCOMPLETE))
 					goto finish;
+				if (!ocnt)
+					goto e2big;
 			} else if (errno == EILSEQ) {
 				if (!(flags & ICB_INCLUDE_BAD))
 					goto finish;
+				if (!ocnt)
+					goto e2big;
 			} else if (errno == E2BIG) {
 				size_t siz;
+			  e2big:
 				opos = obuf - out->buf;
 				if (flags & ICB_CIRCULAR_OUT && out->pos > 1 && opos > out->pos) {
 					/* We are in a divided circular buffer at the physical
@@ -242,6 +247,8 @@ int iconvbufs(iconv_t ic, xbuf *in, xbuf *out, int flags)
 			}
 			*obuf++ = *ibuf++;
 			ocnt--, icnt--;
+			if (!icnt)
+				break;
 		}
 	}