(CCL_WRITE_CHAR): Increment extra_bytes only when

ccl->eight_bit_control.  Fix check for buffer overflow.
(CCL_WRITE_MULTIBYTE_CHAR): Fix check for buffer overflow.
(ccl_driver): Initialize extra_bytes to 0.

diff --git a/src/ccl.c b/src/ccl.c
index 0b0439933f98c175474292a0468748bc9568620e..9f7baf0b4ff9c7645292d36d96242d4548f07cb0 100644 (file)
--- a/src/ccl.c
+++ b/src/ccl.c
@@ -748,16 +748,13 @@ while(0)
     int bytes = SINGLE_BYTE_CHAR_P (ch) ? 1: CHAR_BYTES (ch);          \
     if (!dst)                                                          \
       CCL_INVALID_CMD;                                                 \
-    else if (dst + bytes + extra_bytes < (dst_bytes ? dst_end : src))  \
+    if (ccl->eight_bit_control                                         \
+       && bytes == 1 && (ch) >= 0x80 && (ch) < 0xA0)                   \
+      extra_bytes++;                                                   \
+    if (dst + bytes + extra_bytes <= (dst_bytes ? dst_end : src))      \
       {                                                                        \
        if (bytes == 1)                                                 \
-         {                                                             \
-           *dst++ = (ch);                                              \
-           if (extra_bytes && (ch) >= 0x80 && (ch) < 0xA0)             \
-             /* We may have to convert this eight-bit char to          \
-                multibyte form later.  */                              \
-             extra_bytes++;                                            \
-         }                                                             \
+         *dst++ = (ch);                                                \
        else if (CHAR_VALID_P (ch, 0))                                  \
          dst += CHAR_STRING (ch, dst);                                 \
        else                                                            \
@@ -775,7 +772,7 @@ while(0)
     int bytes = CHAR_BYTES (ch);                                       \
     if (!dst)                                                          \
       CCL_INVALID_CMD;                                                 \
-    else if (dst + bytes + extra_bytes < (dst_bytes ? dst_end : src))  \
+    else if (dst + bytes + extra_bytes <= (dst_bytes ? dst_end : src)) \
       {                                                                        \
        if (CHAR_VALID_P ((ch), 0))                                     \
          dst += CHAR_STRING ((ch), dst);                               \
@@ -919,7 +916,7 @@ ccl_driver (ccl, source, destination, src_bytes, dst_bytes, consumed)
      each of them will be converted to multibyte form of 2-byte
      sequence.  For that conversion, we remember how many more bytes
      we must keep in DESTINATION in this variable.  */
-  int extra_bytes = ccl->eight_bit_control;
+  int extra_bytes = 0;
   int eof_ic = ccl->eof_ic;
   int eof_hit = 0;