--- vswprintf.c.orig Tue May 20 15:22:44 2003 +++ vswprintf.c Wed Nov 12 00:30:05 2003 @@ -48,6 +48,7 @@ mbstate_t mbs; char *mbp; int ret, sverrno; + size_t conv; if (n == 0) { errno = EINVAL; @@ -78,13 +79,13 @@ * XXX Undo the conversion from wide characters to multibyte that * fputwc() did in __vfwprintf(). */ - if (mbsrtowcs(s, (const char **)&mbp, n, &mbs) == (size_t)-1) { + if ((conv = mbsrtowcs(s, (const char **)&mbp, n, &mbs)) == (size_t)-1) { free(f._bf._base); errno = EILSEQ; return (-1); } free(f._bf._base); - if (s[n - 1] != L'\0') { + if (conv >= n) { s[n - 1] = L'\0'; errno = EOVERFLOW; return (-1);