Fix assertion in gconv's loop.c

diff --git a/ChangeLog b/ChangeLog
index 074c7a8e8db8a005d3f9ce7f3c1f67d8942d733a..f31cc94f75c2c30c236adab3afb3d7dfd572f792 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,8 @@
 2012-01-03  Ulrich Drepper  <drepper@gmail.com>
 
+       * iconv/loop.c (single loop): Fix assertion in storing of
+       remaining bytes.
+
        * posix/regcomp.c (init_word_char): Optimize a bit for sane encodings.
 
 2012-01-01  Ulrich Drepper  <drepper@gmail.com>

diff --git a/iconv/loop.c b/iconv/loop.c
index 4f430628f77079acad78846767a48c7ee03a8998..2e88b1deefbaa77de71bfcd45c664075a5040c35 100644 (file)
--- a/iconv/loop.c
+++ b/iconv/loop.c
@@ -1,5 +1,5 @@
 /* Conversion loop frame work.
-   Copyright (C) 1998-2003, 2005, 2008, 2011 Free Software Foundation, Inc.
+   Copyright (C) 1998-2003, 2005, 2008, 2011, 2012 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Ulrich Drepper <drepper@cygnus.com>, 1998.
 
@@ -390,6 +390,7 @@ SINGLE(LOOPFCT) (struct __gconv_step *step,
   UNPACK_BYTES
 #else
   /* Add the bytes from the state to the input buffer.  */
+  assert ((state->__count & 7) <= sizeof (state->__value));
   for (inlen = 0; inlen < (size_t) (state->__count & 7); ++inlen)
     bytebuf[inlen] = state->__value.__wchb[inlen];
 #endif
@@ -474,7 +475,7 @@ SINGLE(LOOPFCT) (struct __gconv_step *step,
       /* We don't have enough input for another complete input
         character.  */
       assert (inend - inptr > (state->__count & ~7));
-      assert (inend - inptr <= 7);
+      assert (inend - inptr <= sizeof (state->__value));
       state->__count = (state->__count & ~7) | (inend - inptr);
       inlen = 0;
       while (inptr < inend)