wcstombs: also call __WCTOMB on terminating NUL if output buffer is NULL

A __WCTOMB call on the terminating NUL may emit more than a NUL byte.
This is the case if the string ends with a lone UTF-16 high surrogate.

Fixes: 2a3a02a ("Add SUSV2 support for calculating size if output buffer is NULL")
Signed-off-by: Christian Franke <[email protected]>
(cherry picked from commit fa272e05bbd049bb39420c6c8997700397283100)

Author: chrfranke

newlib/libc/stdlib/wcstombs_r.c

@@ -17,14 +17,15 @@ _wcstombs_r (struct _reent *r,
   if (s == NULL)
     {
       size_t num_bytes = 0;
-      while (*pwcs != 0)
+      do
 	{
-	  bytes = __WCTOMB (r, buff, *pwcs++, state);
+	  bytes = __WCTOMB (r, buff, *pwcs, state);
 	  if (bytes == -1)
 	    return -1;
 	  num_bytes += bytes;
 	}
-      return num_bytes;
+      while (*pwcs++ != 0x00);
+      return num_bytes - 1;
     }
   else
     {