libiconv-darwin: fix ISO-2022 with escape sequences crash

This appears to be fixed in macOS 14.5, but the source release is not yet available.

pkgs/by-name/li/libiconv-darwin/0002-Fix-ISO-2022-out-of-bounds-write-with-encoded-charac.patch

@@ -0,0 +1,43 @@
+From 6a2c81d23558d19a68d5494f8f8618bd55c89405 Mon Sep 17 00:00:00 2001
+From: Randy Eckenrode <randy@largeandhighquality.com>
+Date: Mon, 27 May 2024 13:43:43 -0400
+Subject: [PATCH 2/2] Fix ISO-2022 out-of-bounds write with encoded characters
+
+---
+ libiconv_modules/ISO2022/citrus_iso2022.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/libiconv_modules/ISO2022/citrus_iso2022.c b/libiconv_modules/ISO2022/citrus_iso2022.c
+index 46da1d6..c2eeaa8 100644
+--- a/libiconv_modules/ISO2022/citrus_iso2022.c
++++ b/libiconv_modules/ISO2022/citrus_iso2022.c
+@@ -1031,7 +1031,7 @@ _ISO2022_sputwchar(_ISO2022EncodingInfo * __restrict ei, wchar_t wc,
+ {
+ 	_ISO2022Charset cs;
+ 	char *p;
+-	char tmp[MB_LEN_MAX];
++	char tmp[MB_LEN_MAX + 4];
+ 	size_t len;
+ 	int bit8, i = 0, target;
+ 	unsigned char mask;
+@@ -1196,7 +1196,7 @@ _citrus_ISO2022_put_state_reset(_ISO2022EncodingInfo * __restrict ei,
+     size_t * __restrict nresult)
+ {
+ 	char *result;
+-	char buf[MB_LEN_MAX];
++	char buf[MB_LEN_MAX + 4];
+ 	size_t len;
+ 	int ret;
+ 
+@@ -1225,7 +1225,7 @@ _citrus_ISO2022_wcrtomb_priv(_ISO2022EncodingInfo * __restrict ei,
+     _ISO2022State * __restrict psenc, size_t * __restrict nresult)
+ {
+ 	char *result;
+-	char buf[MB_LEN_MAX];
++	char buf[MB_LEN_MAX + 4];
+ 	size_t len;
+ 	int ret;
+ 
+-- 
+2.44.1
+

pkgs/by-name/li/libiconv-darwin/nixpkgs_test.c

@@ -73,10 +73,44 @@ ATF_TC_BODY(test_cp932_cp932, tc)
     ATF_CHECK_STREQ(expected, output);
 }
 
+ATF_TC(test_iso2022_crash);
+ATF_TC_HEAD(test_iso2022_crash, tc)
+{
+    atf_tc_set_md_var(tc, "descr", "regression test for converting to ISO-2022 with escape sequences");
+}
+ATF_TC_BODY(test_iso2022_crash, tc)
+{
+    char expected[] = "";
+    size_t expected_length = sizeof(expected) - 1;
+
+    char input[] = "\x41\x41\x41\x41\x41\xe5\x8a\x84";
+    size_t input_length = sizeof(input) - 1;
+
+    size_t output_available = sizeof(expected) - 1 ;
+    char output[sizeof(expected)] = { 0 };
+
+    iconv_t cd = iconv_open("ISO-2022-CN-EXT", "UTF-8");
+    ATF_REQUIRE((size_t)cd != -1);
+
+    char* input_buf = input;
+    char* output_buf = output;
+
+    size_t res = iconv(cd, &input_buf, &input_length, &output_buf, &output_available);
+    iconv_close(cd);
+
+    ATF_CHECK(res == -1);
+
+    size_t output_length = sizeof(output) - output_available - 1;
+
+    ATF_CHECK_INTEQ(expected_length, output_length);
+    ATF_CHECK_STREQ(expected, output);
+}
+
 ATF_TP_ADD_TCS(tp)
 {
     ATF_TP_ADD_TC(tp, test_cp932_eucjp);
     ATF_TP_ADD_TC(tp, test_cp932_cp932);
+    ATF_TP_ADD_TC(tp, test_iso2022_crash);
 
     return atf_no_error();
 }

pkgs/by-name/li/libiconv-darwin/package.nix

@@ -37,7 +37,9 @@ stdenv.mkDerivation (finalAttrs: {
     libiconvReal.setupHooks
     ++ lib.optionals hostPlatform.isStatic [ ./static-setup-hook.sh ];
 
-  patches = lib.optionals hostPlatform.isStatic [ ./0001-Support-static-module-loading.patch ];
+  patches = lib.optionals hostPlatform.isStatic [ ./0001-Support-static-module-loading.patch ] ++ [
+    ./0002-Fix-ISO-2022-out-of-bounds-write-with-encoded-charac.patch
+  ];
 
   postPatch =
     ''