diff --git a/euc-kr-overrun.patch b/euc-kr-overrun.patch
new file mode 100644
index 0000000..993f1a8
--- /dev/null
+++ b/euc-kr-overrun.patch
@@ -0,0 +1,133 @@
+Fix buffer overrun in EUC-KR conversion module (bug 24973)
+
+The byte 0xfe as input to the EUC-KR conversion denotes a user-defined
+area and is not allowed. The from_euc_kr function used to skip two bytes
+when told to skip over the unknown designation, potentially running over
+the buffer end.
+
+ [BZ #24973]
+ * iconvdata/ksc5601.h (ksc5601_to_ucs4): Check for available bytes
+ first.
+ * iconvdata/euc-kr.c (BODY for FROM_LOOP): Don't check for unknown
+ two-byte codes here.
+ * iconvdata/Makefile (tests): Add bug-iconv13.
+ * iconvdata/bug-iconv13.c: New file.
+---
+ iconvdata/Makefile | 2 +-
+ iconvdata/bug-iconv13.c | 53 +++++++++++++++++++++++++++++++++++++++++
+ iconvdata/euc-kr.c | 6 +----
+ iconvdata/ksc5601.h | 6 ++---
+ 4 files changed, 58 insertions(+), 9 deletions(-)
+ create mode 100644 iconvdata/bug-iconv13.c
+
+Index: glibc-2.30/iconvdata/Makefile
+===================================================================
+--- glibc-2.30.orig/iconvdata/Makefile
++++ glibc-2.30/iconvdata/Makefile
+@@ -73,7 +73,7 @@ modules.so := $(addsuffix .so, $(modules
+ ifeq (yes,$(build-shared))
+ tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \
+ tst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \
+- bug-iconv10 bug-iconv11 bug-iconv12
++ bug-iconv10 bug-iconv11 bug-iconv12 bug-iconv13
+ ifeq ($(have-thread-library),yes)
+ tests += bug-iconv3
+ endif
+Index: glibc-2.30/iconvdata/bug-iconv13.c
+===================================================================
+--- /dev/null
++++ glibc-2.30/iconvdata/bug-iconv13.c
+@@ -0,0 +1,53 @@
++/* bug 24973: Test EUC-KR module
++ Copyright (C) 2019 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ . */
++
++#include
++#include
++#include
++#include
++
++static int
++do_test (void)
++{
++ iconv_t cd = iconv_open ("UTF-8//IGNORE", "EUC-KR");
++ TEST_VERIFY_EXIT (cd != (iconv_t) -1);
++
++ /* 0xfe (->0x7e : row 94) and 0xc9 (->0x49 : row 41) are user-defined
++ areas, which are not allowed and should be skipped over due to
++ //IGNORE. The trailing 0xfe also is an incomplete sequence, which
++ should be checked first. */
++ char input[4] = { '\xc9', '\xa1', '\0', '\xfe' };
++ char *inptr = input;
++ size_t insize = sizeof (input);
++ char output[4];
++ char *outptr = output;
++ size_t outsize = sizeof (output);
++
++ /* This used to crash due to buffer overrun. */
++ TEST_VERIFY (iconv (cd, &inptr, &insize, &outptr, &outsize) == (size_t) -1);
++ TEST_VERIFY (errno == EINVAL);
++ /* The conversion should produce one character, the converted null
++ character. */
++ TEST_VERIFY (sizeof (output) - outsize == 1);
++
++ TEST_VERIFY_EXIT (iconv_close (cd) != -1);
++
++ return 0;
++}
++
++#include
+Index: glibc-2.30/iconvdata/euc-kr.c
+===================================================================
+--- glibc-2.30.orig/iconvdata/euc-kr.c
++++ glibc-2.30/iconvdata/euc-kr.c
+@@ -80,11 +80,7 @@ euckr_from_ucs4 (uint32_t ch, unsigned c
+ \
+ if (ch <= 0x9f) \
+ ++inptr; \
+- /* 0xfe(->0x7e : row 94) and 0xc9(->0x59 : row 41) are \
+- user-defined areas. */ \
+- else if (__builtin_expect (ch == 0xa0, 0) \
+- || __builtin_expect (ch > 0xfe, 0) \
+- || __builtin_expect (ch == 0xc9, 0)) \
++ else if (__glibc_unlikely (ch == 0xa0)) \
+ { \
+ /* This is illegal. */ \
+ STANDARD_FROM_LOOP_ERR_HANDLER (1); \
+Index: glibc-2.30/iconvdata/ksc5601.h
+===================================================================
+--- glibc-2.30.orig/iconvdata/ksc5601.h
++++ glibc-2.30/iconvdata/ksc5601.h
+@@ -50,15 +50,15 @@ ksc5601_to_ucs4 (const unsigned char **s
+ unsigned char ch2;
+ int idx;
+
++ if (avail < 2)
++ return 0;
++
+ /* row 94(0x7e) and row 41(0x49) are user-defined area in KS C 5601 */
+
+ if (ch < offset || (ch - offset) <= 0x20 || (ch - offset) >= 0x7e
+ || (ch - offset) == 0x49)
+ return __UNKNOWN_10646_CHAR;
+
+- if (avail < 2)
+- return 0;
+-
+ ch2 = (*s)[1];
+ if (ch2 < offset || (ch2 - offset) <= 0x20 || (ch2 - offset) >= 0x7f)
+ return __UNKNOWN_10646_CHAR;
diff --git a/glibc.changes b/glibc.changes
index de5cd95..ca1709e 100644
--- a/glibc.changes
+++ b/glibc.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Mon Oct 14 13:36:30 UTC 2019 - Andreas Schwab
+
+- euc-kr-overrun.patch: Fix buffer overrun in EUC-KR conversion module
+ (BZ #24973)
+
-------------------------------------------------------------------
Thu Oct 10 14:39:24 UTC 2019 - Andreas Schwab
diff --git a/glibc.spec b/glibc.spec
index 3cc8e75..d34ec2a 100644
--- a/glibc.spec
+++ b/glibc.spec
@@ -248,8 +248,6 @@ Patch104: glibc-c-utf8-locale.patch
# PATCH-FIX-OPENSUSE -- Disable gettext for C.UTF-8 locale
Patch105: glibc-disable-gettext-for-c-utf8.patch
-### Broken patches in glibc that we revert for now:
-
### Network related patches
# PATCH-FIX-OPENSUSE Warn about usage of mdns in resolv.conv
Patch304: glibc-resolv-mdnshint.diff
@@ -273,6 +271,8 @@ Patch2000: fix-locking-in-_IO_cleanup.patch
Patch2001: ldconfig-concurrency.patch
# PATCH-FIX-UPSTREAM ldconfig: handle .dynstr located in separate segment (BZ #25087)
Patch2002: ldconfig-dynstr.patch
+# PATCH-FIX-UPSTREAM Fix buffer overrun in EUC-KR conversion module (BZ #24973)
+Patch2003: euc-kr-overrun.patch
# Non-glibc patches
# PATCH-FIX-OPENSUSE Remove debianisms from manpages
@@ -476,6 +476,7 @@ makedb: A program to create a database for nss
%patch2000 -p1
%patch2001 -p1
%patch2002 -p1
+%patch2003 -p1
%patch3000