Update.

	* wcsmbs/mbrtowc.c (__mbrtowc): Cap s + n at the end of address space.
	* stdlib/Makefile (tests): Add testmb2.
	(testmb2-ENV): New.
	* stdlib/testmb2.c: New test.

2004-02-23  Jakub Jelinek  <jakub@redhat.com>

4 files changed, 48 insertions, 5 deletions

diff --git a/ChangeLog b/ChangeLog
index 8c365b9781..b2ceca72c3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
 2004-02-23  Jakub Jelinek  <jakub@redhat.com>
 
+	* wcsmbs/mbrtowc.c (__mbrtowc): Cap s + n at the end of address space.
+	* stdlib/Makefile (tests): Add testmb2.
+	(testmb2-ENV): New.
+	* stdlib/testmb2.c: New test.
+
+2004-02-23  Jakub Jelinek  <jakub@redhat.com>
+
 	* sysdeps/posix/getaddrinfo.c (gaih_inet): If _res has not been
 	inited yet, try to init it before saving old _res.options.
 	* posix/Makefile (xtests): Add bug-ga2.
diff --git a/stdlib/Makefile b/stdlib/Makefile
index 72633d8290..5f4675033e 100644
--- a/stdlib/Makefile
+++ b/stdlib/Makefile
@@ -1,4 +1,4 @@
-# Copyright (C) 1991-2002, 2003 Free Software Foundation, Inc.
+# Copyright (C) 1991-2002, 2003, 2004 Free Software Foundation, Inc.
 # This file is part of the GNU C Library.
 
 # The GNU C Library is free software; you can redistribute it and/or
@@ -63,7 +63,7 @@ tests		:= tst-strtol tst-strtod testmb testrand testsort testdiv   \
 		   test-canon test-canon2 tst-strtoll tst-environ	    \
 		   tst-xpg-basename tst-random tst-bsearch tst-limits	    \
 		   tst-rand48 bug-strtod tst-setcontext test-a64l tst-qsort \
-		   tst-system
+		   tst-system testmb2
 
 
 # Several mpn functions from GNU MP are used by the strtod function.
@@ -105,6 +105,7 @@ include ../Rules
 test-canon-ARGS = --test-dir=${common-objpfx}stdlib
 
 tst-strtod-ENV = LOCPATH=$(common-objpfx)localedata
+testmb2-ENV = LOCPATH=$(common-objpfx)localedata
 
 # Run a test on the header files we use.
 tests: $(objpfx)isomac.out
diff --git a/stdlib/testmb2.c b/stdlib/testmb2.c
new file mode 100644
index 0000000000..3a3e354629
--- /dev/null
+++ b/stdlib/testmb2.c
@@ -0,0 +1,31 @@
+/* Test case by Miloslav Trmac <mitr@volny.cz>.  */
+#include <locale.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+int
+main (void)
+{
+  wchar_t wc;
+
+  if (setlocale (LC_CTYPE, "de_DE.UTF-8") == NULL)
+    {
+      puts ("setlocale failed");
+      return 1;
+    }
+
+  if (mbtowc (&wc, "\xc3\xa1", MB_CUR_MAX) != 2 || wc != 0xE1)
+    {
+      puts ("1st mbtowc failed");
+      return 1;
+    }
+
+  if (mbtowc (&wc, "\xc3\xa1", SIZE_MAX) != 2 || wc != 0xE1)
+    {
+      puts ("2nd mbtowc failed");
+      return 1;
+    }
+
+  return 0;
+}
diff --git a/wcsmbs/mbrtowc.c b/wcsmbs/mbrtowc.c
index de79e10e5d..6932b047ae 100644
--- a/wcsmbs/mbrtowc.c
+++ b/wcsmbs/mbrtowc.c
@@ -1,4 +1,5 @@
-/* Copyright (C) 1996,1997,1998,1999,2000,2002 Free Software Foundation, Inc.
+/* Copyright (C) 1996, 1997, 1998, 1999, 2000, 2002, 2004
+   Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Ulrich Drepper <drepper@gnu.org>, 1996.
 
@@ -40,7 +41,7 @@ __mbrtowc (wchar_t *pwc, const char *s, size_t n, mbstate_t *ps)
   int status;
   size_t result;
   size_t dummy;
-  const unsigned char *inbuf;
+  const unsigned char *inbuf, *endbuf;
   char *outbuf = (char *) (pwc ?: buf);
   const struct gconv_fcts *fcts;
 
@@ -69,8 +70,11 @@ __mbrtowc (wchar_t *pwc, const char *s, size_t n, mbstate_t *ps)
 
   /* Do a normal conversion.  */
   inbuf = (const unsigned char *) s;
+  endbuf = inbuf + n;
+  if (__builtin_expect (endbuf < inbuf, 0))
+    endbuf = (const unsigned char *) ~(uintptr_t) 0;
   status = DL_CALL_FCT (fcts->towc->__fct,
-			(fcts->towc, &data, &inbuf, inbuf + n,
+			(fcts->towc, &data, &inbuf, endbuf,
 			 NULL, &dummy, 0, 1));
 
   /* There must not be any problems with the conversion but illegal input