getservbyport_r: fix out-of-bounds buffer read

[musl] / src / multibyte / mbrtowc.c

diff --git a/src/multibyte/mbrtowc.c b/src/multibyte/mbrtowc.c
index a354573..c94819e 100644 (file)
--- a/src/multibyte/mbrtowc.c
+++ b/src/multibyte/mbrtowc.c
@@ -1,35 +1,28 @@
-/* 
- * This code was written by Rich Felker in 2010; no copyright is claimed.
- * This code is in the public domain. Attribution is appreciated but
- * unnecessary.
- */
-
 #include <stdlib.h>
-#include <inttypes.h>
 #include <wchar.h>
 #include <errno.h>
-
 #include "internal.h"
 
-size_t mbrtowc(wchar_t *wc, const char *src, size_t n, mbstate_t *st)
+size_t mbrtowc(wchar_t *restrict wc, const char *restrict src, size_t n, mbstate_t *restrict st)
 {
        static unsigned internal_state;
        unsigned c;
        const unsigned char *s = (const void *)src;
        const unsigned N = n;
+       wchar_t dummy;
 
        if (!st) st = (void *)&internal_state;
        c = *(unsigned *)st;
        
        if (!s) {
-               s = "";
-               wc = (void *)&wc;
-               n = 1;
-       } else if (!wc) wc = (void *)&wc;
+               if (c) goto ilseq;
+               return 0;
+       } else if (!wc) wc = &dummy;
 
        if (!n) return -2;
        if (!c) {
                if (*s < 0x80) return !!(*wc = *s);
+               if (MB_CUR_MAX==1) return (*wc = CODEUNIT(*s)), 1;
                if (*s-SA > SB-SA) goto ilseq;
                c = bittab[*s++-SA]; n--;
        }
@@ -52,7 +45,7 @@ loop:
        *(unsigned *)st = c;
        return -2;
 ilseq:
-       *(unsigned *)st = FAILSTATE;
+       *(unsigned *)st = 0;
        errno = EILSEQ;
        return -1;
 }