From 8f0801033282ae8543f09d6e82509d8e1ef9122e Mon Sep 17 00:00:00 2001
From: apnadkarni <apnmbx-wits@yahoo.com>
Date: Fri, 18 Aug 2023 06:57:08 +0000
Subject: Fix UtfToUtf16Proc and UtfToUCS2Proc to not assume
 sizeof(Tcl_UniChar) is size of UTF16 / UCS2 code unit"

---
 generic/tclEncoding.c | 4 ++--
 tests/encoding.test   | 6 +-----
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/generic/tclEncoding.c b/generic/tclEncoding.c
index 18e81f9..9311833 100644
--- a/generic/tclEncoding.c
+++ b/generic/tclEncoding.c
@@ -3165,7 +3165,7 @@ UtfToUtf16Proc(
     }
 
     dstStart = dst;
-    dstEnd   = dst + dstLen - sizeof(Tcl_UniChar);
+    dstEnd   = dst + dstLen - 2; /* 2 -> sizeof a UTF-16 code unit */
     flags |= PTR2INT(clientData);
 
     result = TCL_OK;
@@ -3275,7 +3275,7 @@ UtfToUcs2Proc(
     }
 
     dstStart = dst;
-    dstEnd   = dst + dstLen - sizeof(Tcl_UniChar);
+    dstEnd   = dst + dstLen - 2; /* 2 - size of UCS code unit */
 
     result = TCL_OK;
     for (numChars = 0; src < srcEnd; numChars++) {
diff --git a/tests/encoding.test b/tests/encoding.test
index 0d56a0b..72cc964 100644
--- a/tests/encoding.test
+++ b/tests/encoding.test
@@ -1075,12 +1075,8 @@ test encoding-bug-183a1adcc0-4 {Bug [183a1adcc0] Buffer overflow Tcl_UtfToExtern
 } -result [list 0 [list nospace {} \x00\x00\xFF]]
 
 test encoding-bug-183a1adcc0-5 {Bug [183a1adcc0] Buffer overflow Tcl_UtfToExternal} -constraints {
-    testencoding ucs2 knownBug
+    testencoding 
 } -body {
-    # The knownBug constraint is because test depends on TCL_UTF_MAX and
-    # also UtfToUtf16 assumes space required in destination buffer is
-    # sizeof(Tcl_UniChar) which is incorrect when TCL_UTF_MAX==4
-    # Note - buffers are initialized to \xFF
     list [catch {testencoding Tcl_UtfToExternal utf-16 A {start end} {} 4} result] $result
 } -result [list 0 [list ok {} [expr {$::tcl_platform(byteOrder) eq "littleEndian" ? "\x41\x00" : "\x00\x41"}]\x00\x00]]
 
-- 
cgit v0.12