It was reported that iconv_open mishandles // transliteration specifiers [1]:

http://www.openwall.com/lists/oss-security/2014/07/14/1

The cause is in __gconv_translit_find:

	      cp = __mempcpy (__stpcpy ((char *) newp->fname, runp->name),
			      trans->name, name_len);
	      if (need_so)
		memcpy (cp, ".so", sizeof (".so"));

cp points *after* the NUL terminator, so the memcpy call does not actually append ".so", but copies four bytes starting after the terminating NUL character, not changing the string at all—and writing a single NUL byte after the end of the buffer.

[1]: https://sourceware.org/bugzilla/show_bug.cgi?id=17187