diff --git a/newlib/ChangeLog b/newlib/ChangeLog
index b40d62abb..8704d6a06 100644
--- a/newlib/ChangeLog
+++ b/newlib/ChangeLog
@@ -1,3 +1,8 @@
+2012-05-30  Corinna Vinschen  <vinschen@redhat.com>
+
+	* libc/stdio/fgetws.c (_fgetws_r): Call _mbsnrtowcs_r rather than
+	_mbsrtowcs_r and restrict number of wide chars to n - 1.
+
 2012-05-30  Corinna Vinschen  <vinschen@redhat.com>
 
 	* libc/stdio/local.h (_newlib_flockfile_start): New macro to
diff --git a/newlib/libc/stdio/fgetws.c b/newlib/libc/stdio/fgetws.c
index cbfd84eb2..3cf45a976 100644
--- a/newlib/libc/stdio/fgetws.c
+++ b/newlib/libc/stdio/fgetws.c
@@ -110,9 +110,13 @@ _DEFUN(_fgetws_r, (ptr, ws, n, fp),
     {
       src = (char *) fp->_p;
       nl = memchr (fp->_p, '\n', fp->_r);
-      nconv = _mbsrtowcs_r (ptr, wsp, &src,
-			    nl != NULL ? (nl - fp->_p + 1) : fp->_r,
-			    &fp->_mbstate);
+      nconv = _mbsnrtowcs_r (ptr, wsp, &src,
+			     /* Read all bytes up to the next NL, or up to the
+				end of the buffer if there is no NL. */
+			     nl != NULL ? (nl - fp->_p + 1) : fp->_r,
+			     /* But never more than n - 1 wide chars. */
+			     n - 1,
+			     &fp->_mbstate);
       if (nconv == (size_t) -1)
 	/* Conversion error */
 	goto error;