(CCL_WRITE_CHAR): Increment extra_bytes only when

ccl->eight_bit_control.  Fix check for buffer overflow.
(CCL_WRITE_MULTIBYTE_CHAR): Fix check for buffer overflow.
(ccl_driver): Initialize extra_bytes to 0.

1 files changed, 7 insertions, 10 deletions

diff --git a/src/ccl.c b/src/ccl.c
index 0b0439933f9..9f7baf0b4ff 100644
--- a/src/ccl.c
+++ b/src/ccl.c
@@ -748,16 +748,13 @@ while(0)
     int bytes = SINGLE_BYTE_CHAR_P (ch) ? 1: CHAR_BYTES (ch);           \
     if (!dst)                                                           \
       CCL_INVALID_CMD;                                                  \
-    else if (dst + bytes + extra_bytes < (dst_bytes ? dst_end : src))   \
+    if (ccl->eight_bit_control                                          \
+        && bytes == 1 && (ch) >= 0x80 && (ch) < 0xA0)                   \
+      extra_bytes++;                                                    \
+    if (dst + bytes + extra_bytes <= (dst_bytes ? dst_end : src))       \
       {                                                                 \
         if (bytes == 1)                                                 \
-          {                                                             \
-            *dst++ = (ch);                                              \
-            if (extra_bytes && (ch) >= 0x80 && (ch) < 0xA0)             \
-              /* We may have to convert this eight-bit char to          \
-                 multibyte form later.  */                              \
-              extra_bytes++;                                            \
-          }                                                             \
+          *dst++ = (ch);                                                \
         else if (CHAR_VALID_P (ch, 0))                                  \
           dst += CHAR_STRING (ch, dst);                                 \
         else                                                            \
@@ -775,7 +772,7 @@ while(0)
     int bytes = CHAR_BYTES (ch);                                        \
     if (!dst)                                                           \
       CCL_INVALID_CMD;                                                  \
-    else if (dst + bytes + extra_bytes < (dst_bytes ? dst_end : src))   \
+    else if (dst + bytes + extra_bytes <= (dst_bytes ? dst_end : src))  \
       {                                                                 \
         if (CHAR_VALID_P ((ch), 0))                                     \
           dst += CHAR_STRING ((ch), dst);                               \
@@ -919,7 +916,7 @@ ccl_driver (ccl, source, destination, src_bytes, dst_bytes, consumed)
      each of them will be converted to multibyte form of 2-byte
      sequence.  For that conversion, we remember how many more bytes
      we must keep in DESTINATION in this variable.  */
-  int extra_bytes = ccl->eight_bit_control;
+  int extra_bytes = 0;
   int eof_ic = ccl->eof_ic;
   int eof_hit = 0;