(ksc5601_to_ucs4): Avoid invalid memory accesses.

1 files changed, 15 insertions, 13 deletions

diff --git a/iconvdata/ksc5601.h b/iconvdata/ksc5601.h
index e67d91199e..e50d6d6c20 100644
--- a/iconvdata/ksc5601.h
+++ b/iconvdata/ksc5601.h
@@ -1,5 +1,5 @@
 /* Access functions for KS C 5601-1992 based encoding conversion.
-   Copyright (C) 1998 Free Software Foundation, Inc.
+   Copyright (C) 1998, 1999 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
    The GNU C Library is free software; you can redistribute it and/or
@@ -46,7 +46,7 @@ extern const struct map __ksc5601_hanja_from_ucs[KSC5601_HANJA];
 static inline uint32_t
 ksc5601_to_ucs4 (const unsigned char **s, size_t avail, unsigned char offset)
 {
-  unsigned char ch = *(*s);
+  unsigned char ch = **s;
   unsigned char ch2;
   int idx;
 
@@ -54,31 +54,33 @@ ksc5601_to_ucs4 (const unsigned char **s, size_t avail, unsigned char offset)
 
   if (ch < offset || (ch - offset) <= 0x20 || (ch - offset) >= 0x7e
       || (ch - offset) == 0x49)
-    return UNKNOWN_10646_CHAR;
+    return __UNKNOWN_10646_CHAR;
 
   if (avail < 2)
     return 0;
 
   ch2 = (*s)[1];
   if (ch2 < offset || (ch2 - offset) <= 0x20 || (ch2 - offset) >= 0x7f)
-    return UNKNOWN_10646_CHAR;
+    return __UNKNOWN_10646_CHAR;
 
   idx = (ch - offset - 0x21) * 94 + (ch2 - offset - 0x21);
 
   /* 1410 = 15 * 94 , 3760 = 40 * 94
      Hangul in KS C 5601 : row 16 - row 40 */
 
-  (*s) += 2;
+  *s += 2;
 
-  if (idx >= 1410 && idx < 3760)
+  if (idx >= 1410 && idx < 1410 + KSC5601_HANGUL)
     return (__ksc5601_hangul_to_ucs[idx - 1410]
-	    ?: ((*s) -= 2, UNKNOWN_10646_CHAR));
+	    ?: ((*s) -= 2, __UNKNOWN_10646_CHAR));
   else if (idx >= 3854)
     /* Hanja : row 42 - row 93 : 3854 = 94 * (42-1) */
    return (__ksc5601_hanja_to_ucs[idx - 3854]
-	   ?: ((*s) -= 2, UNKNOWN_10646_CHAR));
-  else
-    return __ksc5601_sym_to_ucs[idx] ?: ((*s) -= 2, UNKNOWN_10646_CHAR);
+	   ?: ((*s) -= 2, __UNKNOWN_10646_CHAR));
+  else if (idx <= 1114)
+    return __ksc5601_sym_to_ucs[idx] ?: ((*s) -= 2, __UNKNOWN_10646_CHAR);
+
+  return __UNKNOWN_10646_CHAR;
 }
 
 static inline size_t
@@ -108,7 +110,7 @@ ucs4_to_ksc5601_hangul (uint32_t wch, unsigned char *s, size_t avail)
 	}
     }
 
-  return UNKNOWN_10646_CHAR;
+  return __UNKNOWN_10646_CHAR;
 }
 
 
@@ -139,7 +141,7 @@ ucs4_to_ksc5601_hanja (uint32_t wch, unsigned char *s, size_t avail)
 	}
     }
 
-  return UNKNOWN_10646_CHAR;
+  return __UNKNOWN_10646_CHAR;
 }
 
 static inline  size_t
@@ -169,7 +171,7 @@ ucs4_to_ksc5601_sym (uint32_t wch, unsigned char *s, size_t avail)
 	}
     }
 
-  return UNKNOWN_10646_CHAR;
+  return __UNKNOWN_10646_CHAR;
 }