* strfuncs.cc (sys_cp_mbstowcs): Don't read beyond src + nms.

diff --git a/winsup/cygwin/ChangeLog b/winsup/cygwin/ChangeLog
index 6716b03ea6ca0ee0092d770f01414d37e098182d..88131cb825b4eb0b0e6a7c3bada0b71282d21cb0 100644 (file)
--- a/winsup/cygwin/ChangeLog
+++ b/winsup/cygwin/ChangeLog
@@ -1,3 +1,7 @@
+2009-03-24  Corinna Vinschen  <corinna@vinschen.de>
+
+       * strfuncs.cc (sys_cp_mbstowcs): Don't read beyond src + nms.
+
 2009-03-24  Corinna Vinschen  <corinna@vinschen.de>
 
        * shared_info.h (CURR_SHARED_MAGIC): Update.

diff --git a/winsup/cygwin/strfuncs.cc b/winsup/cygwin/strfuncs.cc
index 5a9dd7d148ced13f01e05ffc72a41847c9676753..9386d788527607ff8469acf36fa4633403bda4c9 100644 (file)
--- a/winsup/cygwin/strfuncs.cc
+++ b/winsup/cygwin/strfuncs.cc
@@ -423,12 +423,13 @@ sys_cp_mbstowcs (UINT cp, PWCHAR dst, size_t dlen, const char *src, size_t nms)
   memset (&ps, 0, sizeof ps);
   if (dst == NULL)
     len = (size_t)-1;
-  while (len > 0)
+  while (len > 0 && nms > 0)
     {
       /* ASCII SO.  Convert following UTF-8 sequence (if not UTF-8 anyway). */
       if (*pmbs == 0x0e && *charset != 'U'/*TF-8*/)
        {
          pmbs++;
+         --nms;
          bytes = __utf8_mbtowc (_REENT, ptr, pmbs, nms, charset, &ps);
          if (bytes < 0)
            {