Sync with libc.

diff --git a/lib/ChangeLog b/lib/ChangeLog
index 5d07911fa27cab3dfcef7a8f5bc99b8ddb0d06e4..b0d2e540d4b66c7b2623edf7d216d9065e4e206f 100644 (file)
--- a/lib/ChangeLog
+++ b/lib/ChangeLog
@@ -1,3 +1,13 @@
+2005-03-08  Paul Eggert  <eggert@cs.ucla.edu>
+
+       * iconvme.c (SIZE_MAX): New macro, if not already defined.
+       (iconv_string): Don't guess a size-zero buffer, as that might cause
+       buffer overrun.  Instead, avoid multiplying by MB_LEN_MAX if the
+       result would be 'too large', where 'too large' is (heuristically)
+       the square root of SIZE_MAX, divided by MB_LEN_MAX to allay
+       overflow concerns.  This will prevent some unwanted malloc failures
+       when the inputs are very large.
+
 2005-03-15  Bruno Haible  <bruno@clisp.org>
 
        * regex.c (byte_re_match_2_internal): Rename local variable 'not' to

diff --git a/lib/iconvme.c b/lib/iconvme.c
index 68d7f1aca42fc0f66166aa85b06ab25bdb5112eb..4074c7811e389d30b323bbc917fcea9bca80ad8a 100644 (file)
--- a/lib/iconvme.c
+++ b/lib/iconvme.c
@@ -41,10 +41,14 @@
 #if HAVE_ICONV
 /* Get iconv etc. */
 # include <iconv.h>
-/* Get MB_LEN_MAX. */
+/* Get MB_LEN_MAX, CHAR_BIT.  */
 # include <limits.h>
 #endif
 
+#ifndef SIZE_MAX
+# define SIZE_MAX ((size_t) -1)
+#endif
+
 /* Convert a zero-terminated string STR from the FROM_CODSET code set
    to the TO_CODESET code set.  The returned string is allocated using
    malloc, and must be dellocated by the caller using free.  On
@@ -63,10 +67,18 @@ iconv_string (const char *str, const char *from_codeset,
   char *p = (char *) str;
   size_t inbytes_remaining = strlen (p);
   /* Guess the maximum length the output string can have.  */
-  size_t outbuf_size = (inbytes_remaining + 1) * MB_LEN_MAX;
-  size_t outbytes_remaining = outbuf_size - 1; /* -1 for NUL */
+  size_t outbuf_size = inbytes_remaining + 1;
+  size_t outbytes_remaining;
   size_t err;
   int have_error = 0;
+
+  /* Use a worst-case output size guess, so long as that wouldn't be
+     too large for comfort.  It's OK if the guess is wrong so long as
+     it's nonzero.  */
+  size_t approx_sqrt_SIZE_MAX = SIZE_MAX >> (sizeof (size_t) * CHAR_BIT / 2);
+  if (outbuf_size <= approx_sqrt_SIZE_MAX / MB_LEN_MAX)
+    outbuf_size *= MB_LEN_MAX;
+  outbytes_remaining = outbuf_size - 1;
 #endif
 
   if (strcmp (to_codeset, from_codeset) == 0)