Update.

	* string/strcoll.c: Fix two memory allocation problems.
	* string/Makefile (tests): Add bug-strcoll1.
	* string/bug-strcoll1.c: New file.

3 files changed, 29 insertions, 4 deletions

diff --git a/string/Makefile b/string/Makefile
index c7dcbc4dc4..4b6ae6d865 100644
--- a/string/Makefile
+++ b/string/Makefile
@@ -48,7 +48,7 @@ o-objects.ob	:= memcpy.o memset.o memchr.o
 tests		:= tester inl-tester noinl-tester testcopy test-ffs	\
 		   tst-strlen stratcliff tst-svc tst-inlcall		\
 		   bug-strncat1 bug-strspn1 bug-strpbrk1 tst-bswap	\
-		   tst-strtok tst-strxfrm
+		   tst-strtok tst-strxfrm bug-strcoll1
 distribute	:= memcopy.h pagecopy.h tst-svc.expect
 
 
@@ -58,6 +58,7 @@ tester-ENV = LANGUAGE=C
 inl-tester-ENV = LANGUAGE=C
 noinl-tester-ENV = LANGUAGE=C
 tst-strxfrm-ENV = LOCPATH=$(common-objpfx)localedata
+bug-strcoll1-ENV = LOCPATH=$(common-objpfx)localedata
 CFLAGS-noinl-tester.c = -fno-builtin
 CFLAGS-tst-strlen.c = -fno-builtin
 CFLAGS-stratcliff.c = -fno-builtin
diff --git a/string/bug-strcoll1.c b/string/bug-strcoll1.c
new file mode 100644
index 0000000000..b6510d926f
--- /dev/null
+++ b/string/bug-strcoll1.c
@@ -0,0 +1,24 @@
+#include <stdio.h>
+#include <string.h>
+#include <locale.h>
+
+int
+main (void)
+{
+  const char t1[] = "0-0-0-0-0-0-0-0-0-0.COM";
+  const char t2[] = "00000-00000.COM";
+  int res1;
+  int res2;
+
+  setlocale (LC_ALL, "en_US.ISO-8859-1");
+
+  res1 = strcoll (t1, t2);
+  printf ("strcoll (\"%s\", \"%s\") = %d\n", t1, t2, res1);
+  res2 = strcoll (t2, t1);
+  printf ("strcoll (\"%s\", \"%s\") = %d\n", t2, t1, res2);
+
+  return ((res1 == 0 && res2 != 0)
+	  || (res1 != 0 && res2 == 0)
+	  || (res1 < 0 && res2 < 0)
+	  || (res1 > 0 && res2 > 0));
+}
diff --git a/string/strcoll.c b/string/strcoll.c
index a9ac5a8f01..d88dd860af 100644
--- a/string/strcoll.c
+++ b/string/strcoll.c
@@ -154,7 +154,7 @@ STRCOLL (s1, s2, l)
   if (s1len + s2len >= 16384)
     {
       idx1arr = (int32_t *) malloc ((s1len + s2len) * (sizeof (int32_t) + 1));
-      idx2arr = &idx1arr[s2len];
+      idx2arr = &idx1arr[s1len];
       rule1arr = (unsigned char *) &idx2arr[s2len];
       rule2arr = &rule1arr[s1len];
 
@@ -173,7 +173,7 @@ STRCOLL (s1, s2, l)
     try_stack:
       idx1arr = (int32_t *) alloca (s1len * sizeof (int32_t));
       idx2arr = (int32_t *) alloca (s2len * sizeof (int32_t));
-      rule1arr = (unsigned char *) alloca (s2len);
+      rule1arr = (unsigned char *) alloca (s1len);
       rule2arr = (unsigned char *) alloca (s2len);
     }
 
@@ -422,7 +422,7 @@ STRCOLL (s1, s2, l)
 		      {
 			/* No sequence at all or just one.  */
 			if (idx1cnt == idx1max)
-			  /* Note that seq2len is still zero.  */
+			  /* Note that seq1len is still zero.  */
 			  break;
 
 			backw1_stop = ~0ul;