- n3 = wcstombs(0, wch, 0);
- if (isEILSEQ(n3) || (n3 == 0)) {
- ;
- } else if ((int) (n3 + i) >= n) {
- done = TRUE;
- } else if ((tmp = typeCalloc(char, n3 + 10)) == 0) {
- done = TRUE;
- } else {
- init_mb(state);
- wcstombs(tmp, wch, n3);
- for (i3 = 0; i3 < n3; ++i3)
- str[i++] = tmp[i3];
- free(tmp);
+ n3 = wcstombs(0, wch, (size_t) 0);
+ if (!isEILSEQ(n3) && (n3 != 0)) {
+ size_t need = n3 + 10 + (size_t) i;
+ int have = (int) n3 + i;
+
+ /* check for loop-done as well as overflow */
+ if (have > n || (int) need <= 0) {
+ done = TRUE;
+ } else if ((tmp = typeCalloc(char, need)) == 0) {
+ done = TRUE;
+ } else {
+ size_t i3;
+
+ init_mb(state);
+ wcstombs(tmp, wch, n3);
+ for (i3 = 0; i3 < n3; ++i3)
+ str[i++] = tmp[i3];
+ free(tmp);
+ }