5366 strcoll_l may destroy its arguments, then crash

          --- old/usr/src/lib/libc/port/locale/mbstowcs.c
          +++ new/usr/src/lib/libc/port/locale/mbstowcs.c

   1    1  /*
   2    2   * Copyright 2013 Garrett D'Amore <garrett@damore.org>
   3    3   * Copyright 2010 Nexenta Systems, Inc.  All rights reserved.
   4    4   * Copyright (c) 2002-2004 Tim J. Robbins.
   5    5   * All rights reserved.
   6    6   *
   7    7   * Redistribution and use in source and binary forms, with or without
   8    8   * modification, are permitted provided that the following conditions
   9    9   * are met:
  10   10   * 1. Redistributions of source code must retain the above copyright
  11   11   *    notice, this list of conditions and the following disclaimer.
  12   12   * 2. Redistributions in binary form must reproduce the above copyright
  13   13   *    notice, this list of conditions and the following disclaimer in the
  14   14   *    documentation and/or other materials provided with the distribution.
  15   15   *
  16   16   * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  17   17   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  18   18   * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  19   19   * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  20   20   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  21   21   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  22   22   * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  23   23   * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  24   24   * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  25   25   * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  26   26   * SUCH DAMAGE.
  27   27   */
  28   28  
  29   29  #include "lint.h"
  30   30  #include <limits.h>
  31   31  #include <stdlib.h>

  32   32  #include <wchar.h>
  33   33  #include <locale.h>
  34   34  #include "mblocal.h"
  35   35  #include "localeimpl.h"
  36   36  #include "lctype.h"
  37   37  
  38   38  size_t
  39   39  mbstowcs_l(wchar_t *_RESTRICT_KYWD pwcs, const char *_RESTRICT_KYWD s,
  40   40      size_t n, locale_t loc)
  41   41  {
  42      -        static const mbstate_t initial = { 0 };
  43      -        mbstate_t mbs;
       42 +        mbstate_t mbs = { 0 };
  44   43          const char *sp;
  45   44  
  46      -        mbs = initial;
  47   45          sp = s;
  48   46          return (loc->ctype->lc_mbsnrtowcs(pwcs, &sp, ULONG_MAX, n, &mbs));
  49   47  }
  50   48  
  51   49  size_t
  52   50  mbstowcs(wchar_t *_RESTRICT_KYWD pwcs, const char *_RESTRICT_KYWD s, size_t n)
  53   51  {
  54   52          return (mbstowcs_l(pwcs, s, n, uselocale(NULL)));
  55   53  }
    

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX