utf16_to_utf8() should croak if the buffer ends without the second surrogate.

1 files changed, 8 insertions, 4 deletions

diff --git a/utf8.c b/utf8.c
index 455078d582..4a728aa09a 100644
--- a/utf8.c
+++ b/utf8.c
@@ -986,11 +986,15 @@ Perl_utf16_to_utf8(pTHX_ U8* p, U8* d, I32 bytelen, I32 *newlen)
 	    continue;
 	}
 	if (uv >= 0xd800 && uv < 0xdbff) {	/* surrogates */
-	    UV low = (p[0] << 8) + p[1];
-	    p += 2;
-	    if (low < 0xdc00 || low >= 0xdfff)
+	    if (p >= pend) {
 		Perl_croak(aTHX_ "Malformed UTF-16 surrogate");
-	    uv = ((uv - 0xd800) << 10) + (low - 0xdc00) + 0x10000;
+	    } else {
+		UV low = (p[0] << 8) + p[1];
+		p += 2;
+		if (low < 0xdc00 || low >= 0xdfff)
+		    Perl_croak(aTHX_ "Malformed UTF-16 surrogate");
+		uv = ((uv - 0xd800) << 10) + (low - 0xdc00) + 0x10000;
+	    }
 	}
 	if (uv < 0x10000) {
 	    *d++ = (U8)(( uv >> 12)         | 0xe0);