[PATCH 3/3] msvcrt: Don't access input string after NULL-byte in mbstowcs.

[Piotr Caban]

From: Piotr Caban

---
 dlls/msvcrt/mbcs.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/dlls/msvcrt/mbcs.c b/dlls/msvcrt/mbcs.c
index 5f5cd3e8cda..bd4245c2c53 100644
--- a/dlls/msvcrt/mbcs.c
+++ b/dlls/msvcrt/mbcs.c
@@ -3322,8 +3322,20 @@ size_t CDECL _mbstowcs_l(wchar_t *wcstr, const char *mbstr,
         if(mbstr[size] == '\0')
             break;

-        if (locinfo->lc_codepage == CP_UTF8)
-            size += get_utf8_char_len(mbstr[size]);
+        if(locinfo->lc_codepage == CP_UTF8) {
+            int j, chlen = get_utf8_char_len(mbstr[size]);
+
+            for(j = 1; j < chlen; j++)
+            {
+                if(!mbstr[size + j])
+                {
+                    if(count) wcstr[0] = '\0';
+                    *_errno() = EILSEQ;
+                    return -1;
+                }
+            }
+            size += chlen;
+        }
         else
             size += (_isleadbyte_l((unsigned char)mbstr[size], locale) ? 2 : 1);
     }