[9fans] possible buffer overflow in devcons.c?

[Yoann Padioleau]

Hi,

In devcons.c there is

/*
 *  Put character, possibly a rune, into read queue at interrupt time.
 *  Called at interrupt time to process a character.
 */
int
kbdputc(Queue*, int ch)
{
        int i, n;
        char buf[3]; <----- enough?
        Rune r;
        char *next;

        if(kbd.ir == nil)
                return 0;               /* in case we're not inited yet */
        
        ilock(&kbd.lockputc);           /* just a mutex */
        r = ch;
        n = runetochar(buf, &r);
        for(i = 0; i < n; i++){
                next = kbd.iw+1;
                if(next >= kbd.ie)
                        next = kbd.istage;
                if(next == kbd.ir)
                        break;
                *kbd.iw = buf[i];
                kbd.iw = next;
        }
        iunlock(&kbd.lockputc);
        return 0;
}

But is the buf[3] enough? UTFMAX is 4 so we could possibly overflow no?
Shouldn't it be buf[UTFMAX] ?