Please retry with a current version of rsync. Your 3.0.2 version is 5 years old.

(In reply to comment #1)
> Please retry with a current version of rsync. Your 3.0.2 version is 5 years
> old.

Crash is observed in the latest rsync. I checked the diff with the latest one and
with 3.0.2

I think rsync is not handling EILSEQ error returned by iconv(3). Here are couple of observations.

1>
 while (icnt) {
    retVal = -1;
    while (iconv(ic, &ibuf, &icnt, &obuf, &ocnt) == (size_t)-1 || retVal == -1) {
      errno = EILSEQ;
      if (errno == EINTR)
        continue;
      if (errno == EINVAL) {
        if (!(flags & ICB_INCLUDE_INCOMPLETE))
          goto finish;
      } else if (errno == EILSEQ) {
        if (!(flags & ICB_INCLUDE_BAD))
          goto finish;
      } else {
        size_t opos = obuf - out->buf;
        if (!(flags & ICB_EXPAND_OUT)) {
          errno = E2BIG;
          goto finish;
        }
        realloc_xbuf(out, out->size + 1024);
        obuf = out->buf + opos;
        ocnt += 1024;
        continue;
      }
      *obuf++ = *ibuf++;
      ocnt--, icnt--;
    }
  }

The condition checking "while(icnt)" is bad since icnt is size_t and there were cases where icnt had wrapped causing it to crash.

2>
   while (inbuf.len) {                      
      iconvbufs(ic, &inbuf, &outbuf, 0);                 
      ierrno = errno;
      if (outbuf.len) {  
        filtered_fwrite(f, convbuf, outbuf.len, 0);
        outbuf.len = 0;
      }              
      if (!ierrno || ierrno == E2BIG)
        continue;                          
      fprintf(f, "\\#%03o", CVAL(inbuf.buf, inbuf.pos++));
      inbuf.len--;        
      save_len = inbuf.len;   
    }                           


Lets assume iconvbufs is returning EILSEQ continuously there are
chances of "inbuf.len"  wrapping again when inbuf.len reaches zero.
so again the "while(inbuf.len)" starts iterating from (size_t)-1 which is
0xffffff. This can lead to a crash again.

Best way to do this check is to save the (size_t)len to an integer and have
the while check "0 < save_len". This will make sure that inbuf.len can never
wrap. Let me know if it is plausible so that i can give you a patch. I have tested it and it works.

+  int save_len = len;                                                     
                                                                             
    INIT_CONST_XBUF(outbuf, convbuf);                                        
    INIT_XBUF(inbuf, (char*)buf, len, -1);                                 

 -while(inbuf.len)                                                                           
+    while (0 < save_len) {                      
      iconvbufs(ic, &inbuf, &outbuf, 0);                 
      ierrno = errno;
      if (outbuf.len) {  
        filtered_fwrite(f, convbuf, outbuf.len, 0);
        outbuf.len = 0;
      }              
      if (!ierrno || ierrno == E2BIG)
        continue;                          
      fprintf(f, "\\#%03o", CVAL(inbuf.buf, inbuf.pos++));
      inbuf.len--;        
      save_len = inbuf.len;   
    }

(In reply to comment #2)
> I think rsync is not handling EILSEQ error returned by iconv(3).

No, but it did expect an E2BIG in preference to an EILSEQ, which might not be the case.  I've fixed that in the latest git (for 3.1.0).

> Lets assume iconvbufs is returning EILSEQ continuously there are
> chances of "inbuf.len" wrapping again when inbuf.len reaches zero.

I would hope that iconv() would not return EILSEQ if inbuf.len was zero, but I went ahead and made the code avoid the extra iconv() call if the input buffer goes empty.

Thanks for sharing your thoughts -- the code should be a good bit safer now.

Can you test if the latest rsync fixes the crash for you?

(In reply to comment #3)
> (In reply to comment #2)
> > I think rsync is not handling EILSEQ error returned by iconv(3).
> 
> No, but it did expect an E2BIG in preference to an EILSEQ, which might not be
> the case.  I've fixed that in the latest git (for 3.1.0).
> 
> > Lets assume iconvbufs is returning EILSEQ continuously there are
> > chances of "inbuf.len" wrapping again when inbuf.len reaches zero.
> 
> I would hope that iconv() would not return EILSEQ if inbuf.len was zero, but I
> went ahead and made the code avoid the extra iconv() call if the input buffer
> goes empty.
> 
> Thanks for sharing your thoughts -- the code should be a good bit safer now.
> 
> Can you test if the latest rsync fixes the crash for you

I have already tested EILSEQ case and it works fine. Did you add any code by the way ? Do you need any test reports to mark this bug verified ?

I asked you to test the fix.  Either grab the git version or the latest nightly tar file.

(In reply to comment #5)
> I asked you to test the fix.  Either grab the git version or the latest nightly
> tar file.

Tested ok.