iconv_open: Fix heap corruption on gconv_init failure [BZ #22026]

Also mangle the __end_fct function pointer on the error handling
path.

1 files changed, 7 insertions, 2 deletions

diff --git a/iconv/gconv_db.c b/iconv/gconv_db.c
index 7a95aeaeac..96f087192e 100644
--- a/iconv/gconv_db.c
+++ b/iconv/gconv_db.c
@@ -318,9 +318,14 @@ gen_steps (struct derivation_step *best, const char *toset,
 		  if (__builtin_expect (status, __GCONV_OK) != __GCONV_OK)
 		    {
 		      failed = 1;
-		      /* Make sure we unload this modules.  */
-		      --step_cnt;
+		      /* Do not call the end function because the init
+			 function has failed.  */
 		      result[step_cnt].__end_fct = NULL;
+# ifdef PTR_MANGLE
+		      PTR_MANGLE (result[step_cnt].__end_fct);
+# endif
+		      /* Make sure we unload this module.  */
+		      --step_cnt;
 		      break;
 		    }
 		}