diff --git a/winsup/cygwin/ChangeLog b/winsup/cygwin/ChangeLog
index 6716b03ea..88131cb82 100644
--- a/winsup/cygwin/ChangeLog
+++ b/winsup/cygwin/ChangeLog
@@ -1,3 +1,7 @@
+2009-03-24  Corinna Vinschen  <corinna@vinschen.de>
+
+	* strfuncs.cc (sys_cp_mbstowcs): Don't read beyond src + nms.
+
 2009-03-24  Corinna Vinschen  <corinna@vinschen.de>
 
 	* shared_info.h (CURR_SHARED_MAGIC): Update.
diff --git a/winsup/cygwin/strfuncs.cc b/winsup/cygwin/strfuncs.cc
index 5a9dd7d14..9386d7885 100644
--- a/winsup/cygwin/strfuncs.cc
+++ b/winsup/cygwin/strfuncs.cc
@@ -423,12 +423,13 @@ sys_cp_mbstowcs (UINT cp, PWCHAR dst, size_t dlen, const char *src, size_t nms)
   memset (&ps, 0, sizeof ps);
   if (dst == NULL)
     len = (size_t)-1;
-  while (len > 0)
+  while (len > 0 && nms > 0)
     {
       /* ASCII SO.  Convert following UTF-8 sequence (if not UTF-8 anyway). */
       if (*pmbs == 0x0e && *charset != 'U'/*TF-8*/)
 	{
 	  pmbs++;
+	  --nms;
 	  bytes = __utf8_mbtowc (_REENT, ptr, pmbs, nms, charset, &ps);
 	  if (bytes < 0)
 	    {