Bug#416928: libc6: off-by-one bug in strxfrm()

["Piotr Engelking" <inkerman42@gmail.com>]

Package: libc6
Version: 2.3.6.ds1-13
Severity: normal

The result of strxfrm() varies depending on the length of the destination
buffer. In particular, in the pl_PL.UTF8 locale, strxfrm(buf, "a", i)
returns 6 for i <= 6, and 5 for i > 6 (and the string placed in the
destination buffer does, indeed, have the length of 5). This mismatch is
probably unintended. It is also a violation of the C standard, which states:

   "The  strxfrm  function  returns  the  length  of  the transformed
   string (not including the terminating null character)."


Steps to reproduce:

$ cat foo.c
#include <locale.h>
#include <stdio.h>
#include <string.h>

int
main(void)
{
   char buf[42];
   size_t i;

   printf("%s\n", setlocale(LC_COLLATE, "pl_PL.UTF8"));

   for (i = 0; i <= 9; ++i)
   {
       char *p;

       memset(buf, '\0', sizeof(buf));
       printf("%zd: %zd:", i, strxfrm(buf, "a", i));

       for (p = buf; *p; ++p)
           printf(" %02x", (int)*p);

       printf("\n");
   }

   return 0;
}
$ gcc foo.c && ./a.out
pl_PL.UTF8
0: 6:
1: 6:
2: 6: 0c 01
3: 6: 0c 01
4: 6: 0c 01 08 01
5: 6: 0c 01 08 01
6: 6: 0c 01 08 01 02 01
7: 5: 0c 01 08 01 02
8: 5: 0c 01 08 01 02
9: 5: 0c 01 08 01 02
$


-- System Information:
Debian Release: 4.0
 APT prefers testing
 APT policy: (500, 'testing')
Architecture: i386 (x86_64)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18
Locale: LANG=C, LC_CTYPE=pl_PL.UTF8 (charmap=UTF-8)

Versions of packages libc6 depends on:
ii  tzdata                        2007b-1    Time Zone and Daylight Saving Time

libc6 recommends no packages.

-- no debconf information