Made some security enhancements:

- no writing past end of buffer caused by bogus locale.
- explicitely add a \0 character at end of string. (Bugzilla #2262)

1 files changed, 9 insertions, 11 deletions

diff --git a/src/xlibi18n/lcFile.c b/src/xlibi18n/lcFile.c
index fc28047b..39e59345 100644
--- a/src/xlibi18n/lcFile.c
+++ b/src/xlibi18n/lcFile.c
@@ -382,23 +382,21 @@ normalize_lcname (const char *name)
 {
     char *p, *ret;
     const char *tmp = name;
-    Bool normalize = False;
     
     p = ret = Xmalloc(strlen(name) + 1);
     if (!p)
 	return NULL;
     
-    do {
-	if (normalize) {
-	    if (*tmp == '-')
-		continue;
-	    *p++ = c_tolower(*tmp);
-	} else {
-	    *p++ = *tmp;
-	    if (*tmp == '.' || *tmp == '@')
-		normalize = True;
+    if (tmp) {
+	while (*tmp && *tmp != '.' && *tmp != '@')
+	    *p++ = *tmp++;
+	while (*tmp) {
+	    if (*tmp != '-')
+		*p++ = c_tolower(*tmp);
+	    tmp++;
 	}
-    } while (*tmp++);
+    }
+    *p = '\0';
 
     if (strcmp(ret, name) == 0) {
 	Xfree(ret);