>From Martin's comments in the Jira issue:
 
"...The function attempts to convert the source sequence up until the
terminating NUL (or an invalid byte) or until it has produced the
requested number of destitation characters. When the destination buffer
is large enough for more the number of characters in the source sequence
the function just keeps converting past the end."
 
More than that, I think the call to mbsrtowcs() is using the wrong
length.  It's using dst_len when it should be using src_len which is
smaller in the test case listed in the issue.
 
Some debugging excerpts:
 
    __rw_libc_do_in (state=@0x7fff5d880800
<mailto:state=@0x7fff5d880800> , from=0x7fff5d880820 "abc",
    from_end=0x7fff5d880821 "bc", from_next=@0x7fff5d8807f8
<mailto:from_next=@0x7fff5d8807f8> , to=0x7fff5d880810,
    to_limit=0x7fff5d880818, to_next=@0x7fff5d8807f0
<mailto:to_next=@0x7fff5d8807f0> )
    at /work/stdcxx/trunk.1/src/wcodecvt.cpp:357

    372         const _RWSTD_SIZE_T ret = mbsrtowcs (pdst, &psrc,
dst_len, &state);
 
    (gdb) print src_len
    $6 = 1
    (gdb) print dst_len
    $7 = 2

I think it should actually use min(src_len, dst_len).
 
Thoughts?
 
Brad.