diff options
| -rw-r--r-- | winsup/cygwin/nlsfuncs.cc | 21 | ||||
| -rw-r--r-- | winsup/cygwin/release/3.0.5 | 3 |
2 files changed, 15 insertions, 9 deletions
diff --git a/winsup/cygwin/nlsfuncs.cc b/winsup/cygwin/nlsfuncs.cc index 5bf7d22ac..455afb417 100644 --- a/winsup/cygwin/nlsfuncs.cc +++ b/winsup/cygwin/nlsfuncs.cc @@ -1204,15 +1204,18 @@ wcsxfrm_l (wchar_t *__restrict ws1, const wchar_t *__restrict ws2, size_t wsn, if (ret) { ret /= sizeof (wchar_t); - /* Byte swap the array ourselves here. */ - for (size_t idx = 0; idx < ret; ++idx) - ws1[idx] = __builtin_bswap16 (ws1[idx]); - /* LCMapStringW returns byte count including the terminating NUL char. - wcsxfrm is supposed to return length in wchar_t excluding the NUL. - Since the array is only single byte NUL-terminated yet, make sure - the result is wchar_t-NUL terminated. */ - if (ret < wsn) - ws1[ret] = L'\0'; + if (wsn) + { + /* Byte swap the array ourselves here. */ + for (size_t idx = 0; idx < ret; ++idx) + ws1[idx] = __builtin_bswap16 (ws1[idx]); + /* LCMapStringW returns byte count including the terminating NUL char. + wcsxfrm is supposed to return length in wchar_t excluding the NUL. + Since the array is only single byte NUL-terminated yet, make sure + the result is wchar_t-NUL terminated. */ + if (ret < wsn) + ws1[ret] = L'\0'; + } return ret; } if (GetLastError () != ERROR_INSUFFICIENT_BUFFER) diff --git a/winsup/cygwin/release/3.0.5 b/winsup/cygwin/release/3.0.5 index 62c8cf5ca..a52412cd2 100644 --- a/winsup/cygwin/release/3.0.5 +++ b/winsup/cygwin/release/3.0.5 @@ -11,3 +11,6 @@ Bug Fixes - Fix /proc/version after uname change Addresses: https://cygwin.com/ml/cygwin/2019-03/msg00467.html + +- Fix a crash in wcsxfrm_l if destination size is 0. + Addresses: https://cygwin.com/ml/cygwin/2019-03/msg00492.html |