From f9239e2c0f0be9856322727887a45333683940a6 Mon Sep 17 00:00:00 2001 From: jvoisin Date: Thu, 30 Apr 2026 17:42:29 +0200 Subject: Fix a bug in wcsnrtombs __d is a char * destination buffer, so __b is already the byte capacity. Dividing by sizeof(wchar_t) makes no sense here, it was likely copy-pasted from mbsnrtowcs (where the destination is wchar_t *). The first branch also fails to limit __n (the byte write cap) to __b, so overflows are possible when a wide character produces multi-byte output. The second branch (else) correctly limits __n to __b. This commit replaces the broken two-branch logic with the simple correct pattern matching wcsrtombs, and adds two tests two prove that nothing broke. --- tests/test_wcsnrtombs_dynamic.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 tests/test_wcsnrtombs_dynamic.c (limited to 'tests/test_wcsnrtombs_dynamic.c') diff --git a/tests/test_wcsnrtombs_dynamic.c b/tests/test_wcsnrtombs_dynamic.c new file mode 100644 index 0000000..808c9c8 --- /dev/null +++ b/tests/test_wcsnrtombs_dynamic.c @@ -0,0 +1,28 @@ +#include "common.h" + +#include +#include + +int main(int argc, char** argv) { + char buffer[8] = {0}; + const wchar_t src[] = L"ABCD"; + const wchar_t *srcp = src; + mbstate_t st; + memset(&st, 0, sizeof(st)); + + /* Safe: convert up to 4 wide chars, write at most 4 bytes */ + srcp = src; + wcsnrtombs(buffer, &srcp, 4, 4, &st); + + /* Unsafe: ask to write argc (10) bytes into 8-byte buffer. + * Before the fix, the first branch incorrectly divided the byte-sized + * buffer capacity by sizeof(wchar_t), making the check too permissive. */ + CHK_FAIL_START + srcp = src; + memset(&st, 0, sizeof(st)); + wcsnrtombs(buffer, &srcp, 4, argc, &st); + CHK_FAIL_END + + puts(buffer); + return ret; +} -- cgit v1.3