In the absence of proper validation, at least check that null bytes

do not appear as anything but the first byte of a multibyte character.

4 files changed, 19 insertions, 1 deletions

diff --git a/lib/libc/locale/big5.c b/lib/libc/locale/big5.c
index d9adfba..2f3d5b3 100644
--- a/lib/libc/locale/big5.c
+++ b/lib/libc/locale/big5.c
@@ -122,6 +122,10 @@ _BIG5_mbrtowc(wchar_t * __restrict pwc, const char * __restrict s, size_t n,
 	if (n == 0 || (size_t)(len = _big5_check(*s)) > n)
 		/* Incomplete multibyte sequence */
 		return ((size_t)-2);
+	if (n == 2 && s[1] == '\0') {
+		errno = EILSEQ;
+		return ((size_t)-1);
+	}
 	wc = 0;
 	i = len;
 	while (i-- > 0)
diff --git a/lib/libc/locale/euc.c b/lib/libc/locale/euc.c
index 6a75033..b45aaf6 100644
--- a/lib/libc/locale/euc.c
+++ b/lib/libc/locale/euc.c
@@ -185,8 +185,14 @@ _EUC_mbrtowc(wchar_t * __restrict pwc, const char * __restrict s, size_t n,
 		/* FALLTHROUGH */
 	case 1:
 	case 0:
-		while (remain-- > 0)
+		wc = (unsigned char)*s++;
+		while (--remain > 0) {
+			if (*s == '\0') {
+				errno = EILSEQ;
+				return ((size_t)-1);
+			}
 			wc = (wc << 8) | (unsigned char)*s++;
+		}
 		break;
 	}
 	wc = (wc & ~CEI->mask) | CEI->bits[set];
diff --git a/lib/libc/locale/gbk.c b/lib/libc/locale/gbk.c
index fc42c55..3d061f3 100644
--- a/lib/libc/locale/gbk.c
+++ b/lib/libc/locale/gbk.c
@@ -119,6 +119,10 @@ _GBK_mbrtowc(wchar_t * __restrict pwc, const char * __restrict s, size_t n,
 	if (n == 0 || (size_t)(len = _gbk_check(*s)) > n)
 		/* Incomplete multibyte sequence */
 		return ((size_t)-2);
+	if (n == 2 && s[1] == '\0') {
+		errno = EILSEQ;
+		return ((size_t)-1);
+	}
 	wc = 0;
 	i = len;
 	while (i-- > 0)
diff --git a/lib/libc/locale/mskanji.c b/lib/libc/locale/mskanji.c
index 3f11b7c..0798e89 100644
--- a/lib/libc/locale/mskanji.c
+++ b/lib/libc/locale/mskanji.c
@@ -118,6 +118,10 @@ _MSKanji_mbrtowc(wchar_t * __restrict pwc, const char * __restrict s, size_t n,
 		if (n < 2)
 			/* Incomplete multibyte sequence */
 			return ((size_t)-2);
+		if (*s == '\0') {
+			errno = EILSEQ;
+			return ((size_t)-1);
+		}
 		wc = (wc << 8) | (*s++ & 0xff);
 		len = 2;
 	}