The iconv plugin ISO-2022-CN-EXT, when converting from UCS4, might trigger a OOB write. The encoding requires to add escape sequence to indicate where it changes the character set (as described by RFC 1922) and while the bounds check is done by the SOdesignation designation, it is missing for SS2designation and SS3designation. This leads to an overflow of 1, 2, or 3 bytes with fixed values: `$+I`, `$+J`, `$+K`, `$+L`, `$+M`, or , `$*H`.
Created glibc tracking bugs for this issue: Affects: fedora-all [bug 2275855]
Created glibc tracking bugs for this issue: Affects: fedora-rawhide [bug 2275933]