On Wed, Nov 5, 2014 at 7:36 AM, Norihiro Tanaka <noritnk@kcn.ne.jp> wrote:
> Uninitialized variable are referred with invalid sequence in
> str_append_modified().
>
> When mbrtowc() returns (size_t) -1, wc is not changed, even if wc is
> uninitialized.  below may return unexpected result in order that the
> value is referred at a following position in source code.
>
>   $ echo a | LC_ALL=ja_JP.eucJP ./sed/sed -e 's/a/b\U\xb2c/'

Thank you for the patch and reproducer.
I've made some small improvements to the actual patch and
wrote a valgrind-using test that I'm adding to the test suite.
I've included your patch with an adjusted log, followed by
the changes I made to it in a separate commit. That commit
is separate solely to show what I've done; I will squash into your
commit before I push, followed by the test-adding commit.