CVE-2024-2961: glibc iconv ISO-2022-CN-EXT 4-byte heap buffer overflow

CVE-2024-2961 — heap (or stack) buffer overflow up to 4 bytes in glibc's iconv() when converting UTF-8/UCS-4 to ISO-2022-CN-EXT. Located in iconvdata/iso-2022-cn-ext.c in the TO_LOOP BODY macro. The SS2 and SS3 designator branches emit 4 bytes (ESC '$' '*' 'H' or ESC '$' '+' I/J/K/L/M) without first verifying outptr + 4 <= outend. The SO branch immediately above does perform the check, making the omission an obvious copy-paste bug. The TO_LOOP_MAX_NEEDED_TO bound (6 bytes/iteration) is also smaller than the true worst case (4-byte designator + 2-byte single-shift + 2-byte char = 8). Famously weaponized for RCE against PHP by Charles Fol in 2024. 1) Searched inErrata for 'CVE-2024-2961 glibc iconv' and 'ISO-2022-CN-EXT' — no pr