From 8d94d4a2b9b14f9692f1dfd14102d24eea48eefd Mon Sep 17 00:00:00 2001
From: Serhiy Storchaka <storchaka@gmail.com>
Date: Tue, 15 Sep 2026 13:42:56 +0300
Subject: [PATCH] Fix heap buffer underflow in PDC_mbstowcs()

mbstowcs() returns (size_t)-1 on an invalid multibyte sequence, and
PDC_mbstowcs() then stored the terminator at dest[(size_t)-1], one
element before the buffer.  Return (size_t)-1 with an empty dest
instead, as PDC_wcstombs() does since ea9baa42.  Fixes #383.
---
 pdcurses/util.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pdcurses/util.c b/pdcurses/util.c
index bd00fb50..bfabe9e3 100644
--- a/pdcurses/util.c
+++ b/pdcurses/util.c
@@ -467,6 +467,11 @@ size_t PDC_mbstowcs(wchar_t *dest, const char *src, size_t n)
     }
 # else
     size_t i = mbstowcs(dest, src, n);
+    if (i == (size_t)-1)        /* an invalid multibyte sequence */
+    {
+        *dest = 0;
+        return i;
+    }
 # endif
     dest[i] = 0;
     return i;