From 5b28eaf2b71894219cdbc646b8fc6de656ef741f Mon Sep 17 00:00:00 2001
From: millert <millert@openbsd.org>
Date: Mon, 29 Aug 2016 12:20:57 +0000
Subject: [PATCH] Store the return value of mbrtowc() in a size_t, not int. OK
 schwarze@

---
 lib/libc/stdio/vfprintf.c | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/lib/libc/stdio/vfprintf.c b/lib/libc/stdio/vfprintf.c
index 49fa61af607..7d8ccea9e3c 100644
--- a/lib/libc/stdio/vfprintf.c
+++ b/lib/libc/stdio/vfprintf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vfprintf.c,v 1.76 2016/08/27 16:10:40 millert Exp $	*/
+/*	$OpenBSD: vfprintf.c,v 1.77 2016/08/29 12:20:57 millert Exp $	*/
 /*-
  * Copyright (c) 1990 The Regents of the University of California.
  * All rights reserved.
@@ -489,17 +489,17 @@ __vfprintf(FILE *fp, const char *fmt0, __va_list ap)
 		size_t len;
 
 		cp = fmt;
-		while ((n = mbrtowc(&wc, fmt, MB_CUR_MAX, &ps)) > 0) {
-			fmt += n;
+		while ((len = mbrtowc(&wc, fmt, MB_CUR_MAX, &ps)) != 0) {
+			if (len == (size_t)-1 || len == (size_t)-2) {
+				ret = -1;
+				goto error;
+			}
+			fmt += len;
 			if (wc == '%') {
 				fmt--;
 				break;
 			}
 		}
-		if (n < 0) {
-			ret = -1;
-			goto error;
-		}
 		if (fmt != cp) {
 			ptrdiff_t m = fmt - cp;
 			if (m < 0 || m > INT_MAX - ret)
@@ -507,7 +507,7 @@ __vfprintf(FILE *fp, const char *fmt0, __va_list ap)
 			PRINT(cp, m);
 			ret += m;
 		}
-		if (n == 0)
+		if (len == 0)
 			goto done;
 		fmt++;		/* skip over '%' */
 
@@ -1217,17 +1217,19 @@ __find_arguments(const char *fmt0, va_list ap, union arg **argtable,
 	 * Scan the format for conversions (`%' character).
 	 */
 	for (;;) {
+		size_t len;
+
 		cp = fmt;
-		while ((n = mbrtowc(&wc, fmt, MB_CUR_MAX, &ps)) > 0) {
-			fmt += n;
+		while ((len = mbrtowc(&wc, fmt, MB_CUR_MAX, &ps)) != 0) {
+			if (len == (size_t)-1 || len == (size_t)-2)
+				return (-1);
+			fmt += len;
 			if (wc == '%') {
 				fmt--;
 				break;
 			}
 		}
-		if (n < 0)
-			return (-1);
-		if (n == 0)
+		if (len == 0)
 			goto done;
 		fmt++;		/* skip over '%' */
 
-- 
2.20.1