Fix doprnt when buffer is too small for multibyte sequences.

 src/doprnt.c (doprnt): Fix the case where a multibyte sequence
 produced by %s or %c overflows available buffer space.  (Bug#8545)

3 files changed, 21 insertions, 4 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 832c8abfdcc..bb660036c17 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,8 @@
+2011-04-29  Eli Zaretskii  <eliz@gnu.org>
+
+        * doprnt.c (doprnt): Fix the case where a multibyte sequence
+        produced by %s or %c overflows available buffer space.  (Bug#8545)
+
 2011-04-28  Paul Eggert  <eggert@cs.ucla.edu>
 
         * doprnt.c (doprnt): Omit useless test; int overflow check (Bug#8545).
diff --git a/src/doprnt.c b/src/doprnt.c
index e9a68f9d219..2508ddd831a 100644
--- a/src/doprnt.c
+++ b/src/doprnt.c
@@ -367,9 +367,21 @@ doprnt (char *buffer, register size_t bufsize, const char *format,
                   /* Truncate the string at character boundary.  */
                   tem = bufsize;
                   while (!CHAR_HEAD_P (string[tem - 1])) tem--;
-                  memcpy (bufptr, string, tem);
-                  /* We must calculate WIDTH again.  */
-                  width = strwidth (bufptr, tem);
+                  /* If the multibyte sequence of this character is
+                     too long for the space we have left in the
+                     buffer, truncate before it.  */
+                  if (tem > 0
+                      && BYTES_BY_CHAR_HEAD (string[tem - 1]) > bufsize)
+                    tem--;
+                  if (tem > 0)
+                    memcpy (bufptr, string, tem);
+                  bufptr[tem] = 0;
+                  /* Trigger exit from the loop, but make sure we
+                     return to the caller a value which will indicate
+                     that the buffer was too small.  */
+                  bufptr += bufsize;
+                  bufsize = 0;
+                  continue;
                 }
               else
                 memcpy (bufptr, string, tem);
diff --git a/src/eval.c b/src/eval.c
index bcbbf740153..ea090644c07 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -1994,7 +1994,7 @@ verror (const char *m, va_list ap)
 {
   char buf[4000];
   size_t size = sizeof buf;
-  size_t size_max =    min (MOST_POSITIVE_FIXNUM, SIZE_MAX);
+  size_t size_max = min (MOST_POSITIVE_FIXNUM, SIZE_MAX);
   size_t mlen = strlen (m);
   char *buffer = buf;
   size_t used;