* strfuncs.cc (sys_cp_mbstowcs): Don't read beyond src + nms.

diff --git a/winsup/cygwin/ChangeLog b/winsup/cygwin/ChangeLog
index 6716b03..88131cb 100644 (file)
--- a/winsup/cygwin/ChangeLog
+++ b/winsup/cygwin/ChangeLog
@@ -1,5 +1,9 @@
 2009-03-24  Corinna Vinschen  <corinna@vinschen.de>
 
+       * strfuncs.cc (sys_cp_mbstowcs): Don't read beyond src + nms.
+
+2009-03-24  Corinna Vinschen  <corinna@vinschen.de>
+
        * shared_info.h (CURR_SHARED_MAGIC): Update.
 
 2009-03-24  Corinna Vinschen  <corinna@vinschen.de>

diff --git a/winsup/cygwin/strfuncs.cc b/winsup/cygwin/strfuncs.cc
index 5a9dd7d..9386d78 100644 (file)
--- a/winsup/cygwin/strfuncs.cc
+++ b/winsup/cygwin/strfuncs.cc
@@ -423,12 +423,13 @@ sys_cp_mbstowcs (UINT cp, PWCHAR dst, size_t dlen, const char *src, size_t nms)
   memset (&ps, 0, sizeof ps);
   if (dst == NULL)
     len = (size_t)-1;
-  while (len > 0)
+  while (len > 0 && nms > 0)
     {
       /* ASCII SO.  Convert following UTF-8 sequence (if not UTF-8 anyway). */
       if (*pmbs == 0x0e && *charset != 'U'/*TF-8*/)
        {
          pmbs++;
+         --nms;
          bytes = __utf8_mbtowc (_REENT, ptr, pmbs, nms, charset, &ps);
          if (bytes < 0)
            {