From 14ea06212bc7e585024c80b6084455559da3d22f Mon Sep 17 00:00:00 2001
From: Corinna Vinschen <corinna@vinschen.de>
Date: Mon, 19 Jun 2017 12:57:16 +0200
Subject: [PATCH] Revert "Don't overread or write memory returned by _DTOA_R"

This reverts commit efaef1bba263501e1e7264833ddfc9b8c20f9ebc.
---
 newlib/libc/stdio/vfwprintf.c | 25 ++++++++++++-------------
 1 file changed, 12 insertions(+), 13 deletions(-)

diff --git a/newlib/libc/stdio/vfwprintf.c b/newlib/libc/stdio/vfwprintf.c
index f0872fd55..4786ed6a9 100644
--- a/newlib/libc/stdio/vfwprintf.c
+++ b/newlib/libc/stdio/vfwprintf.c
@@ -1631,18 +1631,12 @@ wcvt(struct _reent *data, _PRINTF_FLOAT_TYPE value, int ndigits, int flags,
 
 	{
 	  char *digits, *bp, *rve;
+#ifndef _MB_CAPABLE
 	  int i;
+#endif
 
 	  digits = _DTOA_R (data, value, mode, ndigits, decpt, &dsgn, &rve);
 
-#ifdef _MB_CAPABLE
-	  _mbsnrtowcs_r (data, buf, (const char **) &digits, rve - digits,
-			 len, NULL);
-#else
-	  for (i = 0; i < rve - digits && i < len; ++i)
-	    buf[i] = (wchar_t) digits[i];
-#endif
-
 	  if ((ch != L'g' && ch != L'G') || flags & ALT) {	/* Print trailing zeros */
 		bp = digits + ndigits;
 		if (ch == L'f' || ch == L'F') {
@@ -1652,13 +1646,18 @@ wcvt(struct _reent *data, _PRINTF_FLOAT_TYPE value, int ndigits, int flags,
 		}
 		if (value == 0)	/* kludge for __dtoa irregularity */
 			rve = bp;
-
-		for (i = rve - digits; i < bp - digits && i < len; ++i)
-			buf[i] = L'0';
-
-		rve = rve > bp ? rve : bp;
+		while (rve < bp)
+			*rve++ = '0';
 	  }
+
 	  *length = rve - digits; /* full length of the string */
+#ifdef _MB_CAPABLE
+	  _mbsnrtowcs_r (data, buf, (const char **) &digits, *length,
+			 len, NULL);
+#else
+	  for (i = 0; i < *length && i < len; ++i)
+	    buf[i] = (wchar_t) digits[i];
+#endif
 	  return buf;
 	}
 }