Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-180800)

Resolves: RHEL-180800
2026-07-08 17:55:56 +02:00 · 2026-07-08 17:55:56 +02:00 · cd23993cfa
commit cd23993cfa
parent e86eb84eea
3 changed files with 516 additions and 0 deletions
--- a/glibc-RHEL-180800-1.patch
+++ b/glibc-RHEL-180800-1.patch
@ -0,0 +1,261 @@
+commit 0981c03c2752b5f12ede24e6e696d5a29f7c6396
+Author: Frédéric Bérat <fberat@redhat.com>
+Date:   Wed Apr 29 15:53:51 2026 +0200
+
+    libio: Fix gconv module reference counter overflow in swscanf
+    
+    The swscanf family of functions creates a wide-oriented FILE stream
+    on the stack. Initialization of this stream invokes `_IO_fwide`, which
+    clones the global locale's gconv transformation steps via
+    `__wcsmbs_clone_conv`. This increments the reference counter (`__counter`)
+    of the gconv module.
+    
+    Because the FILE stream is stack-allocated, `fclose` cannot be called,
+    and so `__gconv_release_step` is never invoked. The counter leaks,
+    eventually hitting the 32-bit integer overflow limit and aborting the
+    process.
+    
+    To resolve this, we introduce `_IO_wstrfile_fclose_stack`, a dedicated
+    cleanup function for stack-allocated FILE streams. This function invokes
+    `_IO_FINISH` and correctly releases the gconv steps via
+    `__gconv_release_step` without attempting to `free` the FILE pointer.
+    This cleanup function is then hooked into all variants of swscanf right
+    before they return.
+    
+    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
+
+diff --git a/libio/iofwide.c b/libio/iofwide.c
+index 393dbed296457350..a2e000bde910fcf8 100644
+--- a/libio/iofwide.c
+++ b/libio/iofwide.c
+@@ -251,3 +251,18 @@ __libio_codecvt_length (struct _IO_codecvt *codecvt, __mbstate_t *statep,
+ 
+   return result;
+ }
+
+void
+_IO_wstrfile_fclose_stack (FILE *fp)
+{
+  _IO_FINISH (fp);
+  if (fp->_mode > 0)
+    {
+      struct _IO_codecvt *cc = fp->_codecvt;
+
+      __libc_lock_lock (__gconv_lock);
+      __gconv_release_step (cc->__cd_in.step);
+      __gconv_release_step (cc->__cd_out.step);
+      __libc_lock_unlock (__gconv_lock);
+    }
+}
+diff --git a/libio/iovswscanf.c b/libio/iovswscanf.c
+index 8f576c975c2b533d..e877eaed1db2895f 100644
+--- a/libio/iovswscanf.c
+++ b/libio/iovswscanf.c
+@@ -38,6 +38,8 @@ __vswscanf (const wchar_t *string, const wchar_t *format, va_list args)
+   _IO_strfile sf;
+   struct _IO_wide_data wd;
+   FILE *f = _IO_strfile_readw (&sf, &wd, string);
+-  return __vfwscanf_internal (f, format, args, 0);
+  int done = __vfwscanf_internal (f, format, args, 0);
+  _IO_wstrfile_fclose_stack (f);
+  return done;
+ }
+ ldbl_weak_alias (__vswscanf, vswscanf)
+diff --git a/libio/libioP.h b/libio/libioP.h
+index 714abbd549500b58..3d5f970947bcae0a 100644
+--- a/libio/libioP.h
+++ b/libio/libioP.h
+@@ -643,6 +643,7 @@ extern FILE* _IO_new_file_fopen (FILE *, const char *, const char *,
+ 				     int);
+ extern void _IO_no_init (FILE *, int, int, struct _IO_wide_data *,
+ 			 const struct _IO_jump_t *) __THROW;
+extern void _IO_wstrfile_fclose_stack (FILE *) attribute_hidden;
+ extern void _IO_new_file_init_internal (struct _IO_FILE_plus *)
+   __THROW attribute_hidden;
+ extern FILE* _IO_new_file_setbuf (FILE *, char *, ssize_t);
+diff --git a/libio/swscanf.c b/libio/swscanf.c
+index 23eb93421c21a008..b596884ed0e50f7e 100644
+--- a/libio/swscanf.c
+++ b/libio/swscanf.c
+@@ -37,7 +37,7 @@ __swscanf (const wchar_t *s, const wchar_t *format, ...)
+   va_start (arg, format);
+   done = __vfwscanf_internal (f, format, arg, 0);
+   va_end (arg);
+-
+  _IO_wstrfile_fclose_stack (f);
+   return done;
+ }
+ ldbl_strong_alias (__swscanf, swscanf)
+diff --git a/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-isoc23_swscanf.c b/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-isoc23_swscanf.c
+index 54ffd734a9f19df1..1218e1eba93bafe4 100644
+--- a/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-isoc23_swscanf.c
+++ b/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-isoc23_swscanf.c
+@@ -35,7 +35,7 @@ ___ieee128_isoc23_swscanf (const wchar_t *string, const wchar_t *format, ...)
+   va_start (ap, format);
+   done = __vfwscanf_internal (fp, format, ap, mode_flags);
+   va_end (ap);
+-
+  _IO_wstrfile_fclose_stack (fp);
+   return done;
+ }
+ strong_alias (___ieee128_isoc23_swscanf, __isoc23_swscanfieee128)
+diff --git a/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-isoc23_vswscanf.c b/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-isoc23_vswscanf.c
+index 8c4ae1db50b258d9..1bdd4bd5a5a5fb34 100644
+--- a/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-isoc23_vswscanf.c
+++ b/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-isoc23_vswscanf.c
+@@ -28,6 +28,8 @@ ___ieee128_isoc23_vswscanf (wchar_t *string, const wchar_t *format, va_list ap)
+   FILE *fp = _IO_strfile_readw (&sf, &wd, string);
+   int mode_flags =
+     SCANF_ISOC99_A | SCANF_ISOC23_BIN_CST | SCANF_LDBL_USES_FLOAT128;
+-  return __vfwscanf_internal (fp, format, ap, mode_flags);
+  int done = __vfwscanf_internal (fp, format, ap, mode_flags);
+  _IO_wstrfile_fclose_stack (fp);
+  return done;
+ }
+ strong_alias (___ieee128_isoc23_vswscanf, __isoc23_vswscanfieee128)
+diff --git a/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-isoc99_swscanf.c b/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-isoc99_swscanf.c
+index 9d539997a23f9e13..d664e2caf34f85fe 100644
+--- a/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-isoc99_swscanf.c
+++ b/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-isoc99_swscanf.c
+@@ -34,7 +34,7 @@ ___ieee128_isoc99_swscanf (const wchar_t *string, const wchar_t *format, ...)
+   va_start (ap, format);
+   done = __vfwscanf_internal (fp, format, ap, mode_flags);
+   va_end (ap);
+-
+  _IO_wstrfile_fclose_stack (fp);
+   return done;
+ }
+ strong_alias (___ieee128_isoc99_swscanf, __isoc99_swscanfieee128)
+diff --git a/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-isoc99_vswscanf.c b/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-isoc99_vswscanf.c
+index f6f8aa5e0945b21d..ca69e84cd76a0c91 100644
+--- a/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-isoc99_vswscanf.c
+++ b/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-isoc99_vswscanf.c
+@@ -27,6 +27,8 @@ ___ieee128_isoc99_vswscanf (wchar_t *string, const wchar_t *format, va_list ap)
+   struct _IO_wide_data wd;
+   FILE *fp = _IO_strfile_readw (&sf, &wd, string);
+   int mode_flags = SCANF_ISOC99_A | SCANF_LDBL_USES_FLOAT128;
+-  return __vfwscanf_internal (fp, format, ap, mode_flags);
+  int done = __vfwscanf_internal (fp, format, ap, mode_flags);
+  _IO_wstrfile_fclose_stack (fp);
+  return done;
+ }
+ strong_alias (___ieee128_isoc99_vswscanf, __isoc99_vswscanfieee128)
+diff --git a/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-swscanf.c b/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-swscanf.c
+index a659623fd6ac1359..3a964629fdf21fa7 100644
+--- a/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-swscanf.c
+++ b/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-swscanf.c
+@@ -34,7 +34,7 @@ ___ieee128_swscanf (const wchar_t *string, const wchar_t *format, ...)
+   done = __vfwscanf_internal (fp, format, ap,
+ 			      SCANF_LDBL_USES_FLOAT128);
+   va_end (ap);
+-
+  _IO_wstrfile_fclose_stack (fp);
+   return done;
+ }
+ strong_alias (___ieee128_swscanf, __swscanfieee128)
+diff --git a/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-vswscanf.c b/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-vswscanf.c
+index b3b19078b2f7ba16..70823af4ca714177 100644
+--- a/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-vswscanf.c
+++ b/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-vswscanf.c
+@@ -27,6 +27,8 @@ ___ieee128_vswscanf (const wchar_t *string, const wchar_t *format,
+   _IO_strfile sf;
+   struct _IO_wide_data wd;
+   FILE *fp = _IO_strfile_readw (&sf, &wd, string);
+-  return __vfwscanf_internal (fp, format, ap, SCANF_LDBL_USES_FLOAT128);
+  int done = __vfwscanf_internal (fp, format, ap, SCANF_LDBL_USES_FLOAT128);
+  _IO_wstrfile_fclose_stack (fp);
+  return done;
+ }
+ strong_alias (___ieee128_vswscanf, __vswscanfieee128)
+diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-compat.c b/sysdeps/ieee754/ldbl-opt/nldbl-compat.c
+index f0bfb1e8a1432df1..05a4b03cf3f4c10d 100644
+--- a/sysdeps/ieee754/ldbl-opt/nldbl-compat.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-compat.c
+@@ -391,7 +391,9 @@ __nldbl_vswscanf (const wchar_t *s, const wchar_t *fmt, va_list ap)
+   struct _IO_wide_data wd;
+   FILE *f = _IO_strfile_readw (&sf, &wd, s);
+ 
+-  return __vfwscanf_internal (f, fmt, ap, SCANF_LDBL_IS_DBL);
+  int ret = __vfwscanf_internal (f, fmt, ap, SCANF_LDBL_IS_DBL);
+  _IO_wstrfile_fclose_stack (f);
+  return ret;
+ }
+ libc_hidden_def (__nldbl_vswscanf)
+ 
+@@ -955,7 +957,9 @@ __nldbl___isoc99_vswscanf (const wchar_t *s, const wchar_t *fmt, va_list ap)
+   struct _IO_wide_data wd;
+   FILE *f = _IO_strfile_readw (&sf, &wd, s);
+ 
+-  return __vfwscanf_internal (f, fmt, ap, SCANF_LDBL_IS_DBL | SCANF_ISOC99_A);
+  int ret = __vfwscanf_internal (f, fmt, ap, SCANF_LDBL_IS_DBL | SCANF_ISOC99_A);
+  _IO_wstrfile_fclose_stack (f);
+  return ret;
+ }
+ libc_hidden_def (__nldbl___isoc99_vswscanf)
+ 
+@@ -1115,9 +1119,11 @@ __nldbl___isoc23_vswscanf (const wchar_t *s, const wchar_t *fmt, va_list ap)
+   struct _IO_wide_data wd;
+   FILE *f = _IO_strfile_readw (&sf, &wd, s);
+ 
+-  return __vfwscanf_internal (f, fmt, ap,
+  int ret = __vfwscanf_internal (f, fmt, ap,
+ 			      SCANF_LDBL_IS_DBL | SCANF_ISOC99_A
+ 			      | SCANF_ISOC23_BIN_CST);
+  _IO_wstrfile_fclose_stack (f);
+  return ret;
+ }
+ libc_hidden_def (__nldbl___isoc23_vswscanf)
+ 
+diff --git a/wcsmbs/isoc23_swscanf.c b/wcsmbs/isoc23_swscanf.c
+index 72e865cbb43022af..e2d91193630ab146 100644
+--- a/wcsmbs/isoc23_swscanf.c
+++ b/wcsmbs/isoc23_swscanf.c
+@@ -33,6 +33,6 @@ __isoc23_swscanf (const wchar_t *s, const wchar_t *format, ...)
+   done = __vfwscanf_internal (f, format, arg,
+ 			      SCANF_ISOC99_A | SCANF_ISOC23_BIN_CST);
+   va_end (arg);
+-
+  _IO_wstrfile_fclose_stack (f);
+   return done;
+ }
+diff --git a/wcsmbs/isoc23_vswscanf.c b/wcsmbs/isoc23_vswscanf.c
+index 9b1f4f31fef217fc..9535bc6bfcc08d56 100644
+--- a/wcsmbs/isoc23_vswscanf.c
+++ b/wcsmbs/isoc23_vswscanf.c
+@@ -24,7 +24,9 @@ __isoc23_vswscanf (const wchar_t *string, const wchar_t *format, va_list args)
+   _IO_strfile sf;
+   struct _IO_wide_data wd;
+   FILE *f = _IO_strfile_readw (&sf, &wd, string);
+-  return __vfwscanf_internal (f, format, args,
+  int done = __vfwscanf_internal (f, format, args,
+ 			      SCANF_ISOC99_A | SCANF_ISOC23_BIN_CST);
+  _IO_wstrfile_fclose_stack (f);
+  return done;
+ }
+ libc_hidden_def (__isoc23_vswscanf)
+diff --git a/wcsmbs/isoc99_swscanf.c b/wcsmbs/isoc99_swscanf.c
+index 7968b056bff4c94a..d97ce652c9fe02a3 100644
+--- a/wcsmbs/isoc99_swscanf.c
+++ b/wcsmbs/isoc99_swscanf.c
+@@ -32,6 +32,6 @@ __isoc99_swscanf (const wchar_t *s, const wchar_t *format, ...)
+   va_start (arg, format);
+   done = __vfwscanf_internal (f, format, arg, SCANF_ISOC99_A);
+   va_end (arg);
+-
+  _IO_wstrfile_fclose_stack (f);
+   return done;
+ }
+diff --git a/wcsmbs/isoc99_vswscanf.c b/wcsmbs/isoc99_vswscanf.c
+index df33e2cd3ef6c9f6..ce424789a3287bf9 100644
+--- a/wcsmbs/isoc99_vswscanf.c
+++ b/wcsmbs/isoc99_vswscanf.c
+@@ -33,6 +33,8 @@ __isoc99_vswscanf (const wchar_t *string, const wchar_t *format, va_list args)
+   _IO_strfile sf;
+   struct _IO_wide_data wd;
+   FILE *f = _IO_strfile_readw (&sf, &wd, string);
+-  return __vfwscanf_internal (f, format, args, SCANF_ISOC99_A);
+  int done = __vfwscanf_internal (f, format, args, SCANF_ISOC99_A);
+  _IO_wstrfile_fclose_stack (f);
+  return done;
+ }
+ libc_hidden_def (__isoc99_vswscanf)
--- a/glibc-RHEL-180800-2.patch
+++ b/glibc-RHEL-180800-2.patch
@ -0,0 +1,116 @@
+commit 1cc165baed20b6589ef2f2c8c0e0415139bbb151
+Author: Frédéric Bérat <fberat@redhat.com>
+Date:   Wed Apr 29 13:26:38 2026 +0200
+
+    test: Add gconv refcount leak test for swscanf
+    
+    Add a new internal test, `tst-wcsmbs-clone-overflow`, to verify correct
+    gconv module reference counting. The Makefile is updated to include this
+    test in the `tests-internal` list and ensure it runs with generated locales.
+    
+    This test specifically checks that the `__counter` for `gconv_fcts->towc`
+    does not leak references when `swscanf` is used with a stack-allocated
+    wide character stream. It ensures that `_IO_wstrfile_fclose_stack`
+    properly decrements the module reference counter, preventing a module
+    from staying loaded indefinitely due to unreleased references.
+    
+    Assisted-by: LLM
+    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
+
+diff --git a/wcsmbs/Makefile b/wcsmbs/Makefile
+index cbe2824082dff72a..7186881d28b1b204 100644
+--- a/wcsmbs/Makefile
+++ b/wcsmbs/Makefile
+@@ -208,6 +208,12 @@ tests := \
+ # This test runs for a long time.
+ xtests += test-wcsncmp-nonarray
+ 
+tests-internal += \
+  tst-wcsmbs-clone-overflow
+
+tests-static += \
+  tst-wcsmbs-clone-overflow
+
+ 
+ include ../Rules
+ 
+@@ -239,6 +245,7 @@ $(objpfx)tst-c32-state.out: $(gen-locales)
+ $(objpfx)test-c8rtomb.out: $(gen-locales)
+ $(objpfx)test-mbrtoc8.out: $(gen-locales)
+ $(objpfx)tst-wscanf-to_inpunct.out: $(gen-locales)
+$(objpfx)tst-wcsmbs-clone-overflow.out: $(gen-locales)
+ endif
+ 
+ $(objpfx)tst-wcstod-round: $(libm)
+diff --git a/wcsmbs/tst-wcsmbs-clone-overflow.c b/wcsmbs/tst-wcsmbs-clone-overflow.c
+new file mode 100644
+index 0000000000000000..adfd4fa61da8a201
+--- /dev/null
+++ b/wcsmbs/tst-wcsmbs-clone-overflow.c
+@@ -0,0 +1,66 @@
+/* Test for gconv module reference counter leak.
+   Copyright (C) 2026 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#include <locale.h>
+#include <stdio.h>
+#include <wchar.h>
+#include <support/check.h>
+#include <support/support.h>
+
+/* Internal headers for accessing the gconv structures.  */
+#include <locale/localeinfo.h>
+#include <iconv/gconv_int.h>
+#include <wcsmbs/wcsmbsload.h>
+
+static int
+do_test (void)
+{
+  if (setlocale (LC_ALL, "de_DE.ISO-8859-1") == NULL)
+    FAIL_EXIT1 ("setlocale failed, check if de_DE.ISO-8859-1 is generated");
+
+  wchar_t buf[32] = L"123";
+  int j;
+
+  /* First iteration initializes the gconv functions internally.  */
+  if (swscanf (buf, L"%d", &j) < 1)
+    FAIL_EXIT1 ("swscanf failed");
+
+  /* Retrieve the current gconv_fcts from the LC_CTYPE locale data.  */
+  struct __locale_data *loc = _NL_CURRENT_DATA (LC_CTYPE);
+  struct lc_ctype_data *ctype = loc->private;
+  const struct gconv_fcts *fcts = ctype->fcts;
+
+  TEST_VERIFY_EXIT (fcts != NULL);
+  TEST_VERIFY_EXIT (fcts->towc != NULL);
+
+  /* Capture the reference counter.  */
+  int initial_counter = fcts->towc->__counter;
+
+  /* Perform a second iteration of swscanf. If the stack-allocated FILE
+     leaks the gconv reference, the counter will increment.  */
+  if (swscanf (buf, L"%d", &j) < 1)
+    FAIL_EXIT1 ("swscanf failed");
+
+  /* The counter should be unchanged, as _IO_wstrfile_fclose_stack should
+     have decremented it correctly.  */
+  TEST_COMPARE (fcts->towc->__counter, initial_counter);
+
+  return 0;
+}
+
+#include <support/test-driver.c>
--- a/glibc-RHEL-180800-3.patch
+++ b/glibc-RHEL-180800-3.patch
@ -0,0 +1,139 @@
+commit 9ef37798fa7dc2b10926742e3f3bd304a17a9ad1
+Author: Frédéric Bérat <fberat@redhat.com>
+Date:   Tue May 26 13:29:57 2026 +0200
+
+    test: Fix and stabilize tst-wcsmbs-clone-overflow test
+    
+    The test tst-wcsmbs-clone-overflow was initially added to tests-static.
+    However, this causes the test to be unstable because gconv modules
+    dynamically load libc.so. Any discrepancy between the statically linked
+    version and the dynamically loaded one can lead to a crash.
+    
+    By removing the test from tests-static, it relies on dynamic linking,
+    safely bypassing the dlopen crash. Since the test is now dynamically
+    linked, it cannot use the internal thread-local symbol
+    _NL_CURRENT_DATA(LC_CTYPE) because _nl_current_LC_CTYPE is hidden in
+    libc.so, leading to undefined references. Thus, the test now uses
+    newlocale and uselocale, safely extracting the locale data from the
+    returned locale_t object.
+    
+    Furthermore, using newlocale requires the gconv-modules configuration to
+    be built and available so that the ISO8859-1.so module can be
+    dynamically loaded. Otherwise, glibc falls back to the built-in C locale
+    conversions, leaving __shlib_handle as NULL and silently bypassing the
+    reference counter increment.
+    A new Makefile fragment, gen-gconv-modules.mk, is introduced to ensure
+    the gconv-modules are built before the test runs, and an explicit check
+    for __shlib_handle != NULL is added to the test.
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+
+diff --git a/gen-gconv-modules.mk b/gen-gconv-modules.mk
+new file mode 100644
+index 0000000000000000..046721a7a7bf460c
+--- /dev/null
+++ b/gen-gconv-modules.mk
+@@ -0,0 +1,6 @@
+# defines target $(gen-gconv-modules) that ensures gconv-modules are available
+
+gen-gconv-modules := $(common-objpfx)iconvdata/gconv-modules
+
+$(gen-gconv-modules):
+	$(MAKE) -C ../iconvdata subdir=iconvdata $@
+diff --git a/localedata/Makefile b/localedata/Makefile
+index 3ed79e55a5496210..c399d35b91bb41d7 100644
+--- a/localedata/Makefile
+++ b/localedata/Makefile
+@@ -282,7 +282,7 @@ install-others := $(addprefix $(inst_i18ndir)/, \
+ 			      $(locales))
+ endif
+ 
+-tests: $(objdir)/iconvdata/gconv-modules
+tests: $(gen-gconv-modules)
+ 
+ tests-static += \
+   tst-langinfo-newlocale-static \
+@@ -404,6 +404,7 @@ LOCALES := \
+   # LOCALES
+ 
+ include ../gen-locales.mk
+include ../gen-gconv-modules.mk
+ 
+ $(objpfx)tst-iconv-emojis-trans.out: $(gen-locales)
+ 
+@@ -577,6 +578,3 @@ $(objpfx)mtrace-tst-leaks.out: $(objpfx)tst-leaks.out
+ 
+ bug-setlocale1-ENV-only = LOCPATH=$(objpfx) LC_CTYPE=de_DE.UTF-8
+ bug-setlocale1-static-ENV-only = $(bug-setlocale1-ENV-only)
+-
+-$(objdir)/iconvdata/gconv-modules:
+-	$(MAKE) -C ../iconvdata subdir=iconvdata $@
+diff --git a/wcsmbs/Makefile b/wcsmbs/Makefile
+index 7186881d28b1b204..b6cfdee81b5ce771 100644
+--- a/wcsmbs/Makefile
+++ b/wcsmbs/Makefile
+@@ -211,10 +211,6 @@ xtests += test-wcsncmp-nonarray
+ tests-internal += \
+   tst-wcsmbs-clone-overflow
+ 
+-tests-static += \
+-  tst-wcsmbs-clone-overflow
+-
+-
+ include ../Rules
+ 
+ ifeq ($(run-built-tests),yes)
+@@ -231,6 +227,7 @@ LOCALES := \
+   zh_TW.EUC-TW \
+   # LOCALES
+ include ../gen-locales.mk
+include ../gen-gconv-modules.mk
+ 
+ $(objpfx)tst-btowc.out: $(gen-locales)
+ $(objpfx)tst-c16c32-1.out: $(gen-locales)
+@@ -245,7 +242,7 @@ $(objpfx)tst-c32-state.out: $(gen-locales)
+ $(objpfx)test-c8rtomb.out: $(gen-locales)
+ $(objpfx)test-mbrtoc8.out: $(gen-locales)
+ $(objpfx)tst-wscanf-to_inpunct.out: $(gen-locales)
+-$(objpfx)tst-wcsmbs-clone-overflow.out: $(gen-locales)
+$(objpfx)tst-wcsmbs-clone-overflow.out: $(gen-locales) $(gen-gconv-modules)
+ endif
+ 
+ $(objpfx)tst-wcstod-round: $(libm)
+diff --git a/wcsmbs/tst-wcsmbs-clone-overflow.c b/wcsmbs/tst-wcsmbs-clone-overflow.c
+index adfd4fa61da8a201..99461ea0877ca7fb 100644
+--- a/wcsmbs/tst-wcsmbs-clone-overflow.c
+++ b/wcsmbs/tst-wcsmbs-clone-overflow.c
+@@ -30,8 +30,11 @@
+ static int
+ do_test (void)
+ {
+-  if (setlocale (LC_ALL, "de_DE.ISO-8859-1") == NULL)
+-    FAIL_EXIT1 ("setlocale failed, check if de_DE.ISO-8859-1 is generated");
+  locale_t loc_obj = newlocale (LC_ALL_MASK, "de_DE.ISO-8859-1", NULL);
+  if (loc_obj == NULL)
+    FAIL_EXIT1 ("newlocale failed, check if de_DE.ISO-8859-1 is generated");
+
+  uselocale (loc_obj);
+ 
+   wchar_t buf[32] = L"123";
+   int j;
+@@ -41,7 +44,7 @@ do_test (void)
+     FAIL_EXIT1 ("swscanf failed");
+ 
+   /* Retrieve the current gconv_fcts from the LC_CTYPE locale data.  */
+-  struct __locale_data *loc = _NL_CURRENT_DATA (LC_CTYPE);
+  struct __locale_data *loc = loc_obj->__locales[LC_CTYPE];
+   struct lc_ctype_data *ctype = loc->private;
+   const struct gconv_fcts *fcts = ctype->fcts;
+ 
+@@ -51,6 +54,9 @@ do_test (void)
+   /* Capture the reference counter.  */
+   int initial_counter = fcts->towc->__counter;
+ 
+  if (fcts->towc->__shlib_handle == NULL)
+    FAIL_EXIT1 ("__shlib_handle is NULL!");
+
+   /* Perform a second iteration of swscanf. If the stack-allocated FILE
+      leaks the gconv reference, the counter will increment.  */
+   if (swscanf (buf, L"%d", &j) < 1)