Fix two printf handler issues.

(cherry picked from commit c1d0e639a95d6d3d3f1c1f70cf97d596bd5a24ec)

3 files changed, 21 insertions, 7 deletions

diff --git a/ChangeLog b/ChangeLog
index 8e160ee80a..f6316741c7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2011-02-11  Jakub Jelinek  <jakub@redhat.com>
+
+	* stdio-common/printf-parsemb.c (__parse_one_specmb): Handle
+	arginfo fn returning -1.
+
+	* stdio-common/_i18n_number.h (_i18n_number_rewrite): Ensure decimal
+	and thousands string is zero terminated.
+
 2009-11-06  Petr Baudis <pasky@suse.cz>
 
 	* include/sys/uio.h: Change __vector to __iovec to avoid clash
diff --git a/stdio-common/_i18n_number.h b/stdio-common/_i18n_number.h
index 8bb56190c6..43ed17e717 100644
--- a/stdio-common/_i18n_number.h
+++ b/stdio-common/_i18n_number.h
@@ -30,8 +30,8 @@ _i18n_number_rewrite (CHAR_T *w, CHAR_T *rear_ptr, CHAR_T *end)
 # define decimal NULL
 # define thousands NULL
 #else
-  char decimal[MB_LEN_MAX];
-  char thousands[MB_LEN_MAX];
+  char decimal[MB_LEN_MAX + 1];
+  char thousands[MB_LEN_MAX + 1];
 #endif
 
   /* "to_outpunct" is a map from ASCII decimal point and thousands-sep
@@ -47,13 +47,19 @@ _i18n_number_rewrite (CHAR_T *w, CHAR_T *rear_ptr, CHAR_T *end)
       mbstate_t state;
       memset (&state, '\0', sizeof (state));
 
-      if (__wcrtomb (decimal, wdecimal, &state) == (size_t) -1)
+      size_t n = __wcrtomb (decimal, wdecimal, &state);
+      if (n == (size_t) -1)
 	memcpy (decimal, ".", 2);
+      else
+	decimal[n] = '\0';
 
       memset (&state, '\0', sizeof (state));
 
-      if (__wcrtomb (thousands, wthousands, &state) == (size_t) -1)
+      n = __wcrtomb (thousands, wthousands, &state);
+      if (n == (size_t) -1)
 	memcpy (thousands, ",", 2);
+      else
+	thousands[n] = '\0';
     }
 #endif
 
diff --git a/stdio-common/printf-parsemb.c b/stdio-common/printf-parsemb.c
index efd1eca3a2..a67cc1a499 100644
--- a/stdio-common/printf-parsemb.c
+++ b/stdio-common/printf-parsemb.c
@@ -295,9 +295,9 @@ __parse_one_specmb (const UCHAR_T *format, size_t posn,
       /* We don't try to get the types for all arguments if the format
 	 uses more than one.  The normal case is covered though.  If
 	 the call returns -1 we continue with the normal specifiers.  */
-      || (spec->ndata_args = (*__printf_arginfo_table[spec->info.spec])
-	  (&spec->info, 1, &spec->data_arg_type,
-	   &spec->size)) < 0)
+      || (int) (spec->ndata_args = (*__printf_arginfo_table[spec->info.spec])
+				   (&spec->info, 1, &spec->data_arg_type,
+				    &spec->size)) < 0)
     {
       /* Find the data argument types of a built-in spec.  */
       spec->ndata_args = 1;