heap-buffer-overflow in simple_recode()

[rockdaboot]

If the local charset is a multi-byte charset (MBCS), a malicious server can trigger a heap buffer overflow in simple_recode().

I used this fuzzer code to trigger the issue:
fuzz_simple_recode.c

Steps to reproduce

clang -fsanitize=address,undefined -g utils.c -c
clang -fsanitize=address,undefined -g simple_recode.c -c
clang -fsanitize=fuzzer,address,undefined -g fuzz_simple_recode.c simple_recode.o utils.o -o fuzzer
mkdir -p corpus
./fuzzer corpus/

The fuzzer finds the issue within a second here.

Output

==9549==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7d044f8341d1 at pc 0x5593074afe5f bp 0x7ffdb07f8db0 sp 0x7ffdb07f8da8
WRITE of size 1 at 0x7d044f8341d1 thread T0
    #0 0x5593074afe5e in simple_recode /home/tim/src/whois/simple_recode.c:88:14
...