glibc plugs SHIFT_JISX0213 iconv hang (CVE-2026-77117)

The GNU C Library has fixed CVE-2026-77117, a hang in the SHIFT_JISX0213 iconv converter tracked as bug 34556.

Florian Weimer's change clears saved pending-character state once that character has been emitted. Without the reset, a later call that continues on the same conversion descriptor could fail to advance. POSIX requires conversion to resume from the descriptor's current state on subsequent non-flush calls; the module did not fully meet that expectation for combining characters carried across invocations.

Carlos O'Donell reviewed and approved the fix. He noted that the euc-jisx0213 converter has the same class of flaw and will get its own bug and CVE. Both issues are converter hangs.

O'Donell also flagged a separate edge case: a combining character left pending when output space runs out and no further input drives another conversion step can disappear unless the application flushes, which he reads as data loss POSIX does not force callers to paper over after E2BIG. Weimer disagreed, arguing SHIFT_JISX0213 is stateful for these pendings by design, so draining them needs an explicit flush and the behavior is not a defect. They treated that dispute as orthogonal and not a blocker for the hang fixes.

A regression test for combining-character conversion progress ships with the patch.