Fix assertion in gconv's loop.c

2 files changed, 6 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 074c7a8..f31cc94 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,8 @@
 2012-01-03  Ulrich Drepper  <drepper@gmail.com>
 
+	* iconv/loop.c (single loop): Fix assertion in storing of
+	remaining bytes.
+
 	* posix/regcomp.c (init_word_char): Optimize a bit for sane encodings.
 
 2012-01-01  Ulrich Drepper  <drepper@gmail.com>
diff --git a/iconv/loop.c b/iconv/loop.c
index 4f43062..2e88b1d 100644
--- a/iconv/loop.c
+++ b/iconv/loop.c
@@ -1,5 +1,5 @@
 /* Conversion loop frame work.
-   Copyright (C) 1998-2003, 2005, 2008, 2011 Free Software Foundation, Inc.
+   Copyright (C) 1998-2003, 2005, 2008, 2011, 2012 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Ulrich Drepper <drepper@cygnus.com>, 1998.
 
@@ -390,6 +390,7 @@ SINGLE(LOOPFCT) (struct __gconv_step *step,
   UNPACK_BYTES
 #else
   /* Add the bytes from the state to the input buffer.  */
+  assert ((state->__count & 7) <= sizeof (state->__value));
   for (inlen = 0; inlen < (size_t) (state->__count & 7); ++inlen)
     bytebuf[inlen] = state->__value.__wchb[inlen];
 #endif
@@ -474,7 +475,7 @@ SINGLE(LOOPFCT) (struct __gconv_step *step,
       /* We don't have enough input for another complete input
 	 character.  */
       assert (inend - inptr > (state->__count & ~7));
-      assert (inend - inptr <= 7);
+      assert (inend - inptr <= sizeof (state->__value));
       state->__count = (state->__count & ~7) | (inend - inptr);
       inlen = 0;
       while (inptr < inend)