diff --git a/0001-Bump-MSVCRT_MB_LEN_MAX-to-5-and-use-it-in-MSVCRT__wc.patch b/0001-Bump-MSVCRT_MB_LEN_MAX-to-5-and-use-it-in-MSVCRT__wc.patch
new file mode 100644
index 0000000..8e3e493
--- /dev/null
+++ b/0001-Bump-MSVCRT_MB_LEN_MAX-to-5-and-use-it-in-MSVCRT__wc.patch
@@ -0,0 +1,54 @@
+From c74fda8b8c1593aa9652fd08d07eb63a8bddf09b Mon Sep 17 00:00:00 2001
+From: Orion Poplawski <orion@cora.nwra.com>
+Date: Fri, 23 Jan 2015 09:24:37 -0700
+Subject: [PATCH] Bump MSVCRT_MB_LEN_MAX to 5 and use it in MSVCRT__wctomb_l
+ for default buffer length Set MB_LEN_MAX to 5 to match MSVCRT_MB_LEN_MAX
+
+---
+ dlls/msvcrt/msvcrt.h    | 2 +-
+ dlls/msvcrt/wcs.c       | 2 +-
+ include/msvcrt/limits.h | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/dlls/msvcrt/msvcrt.h b/dlls/msvcrt/msvcrt.h
+index 41f31b9..806c4bf 100644
+--- a/dlls/msvcrt/msvcrt.h
++++ b/dlls/msvcrt/msvcrt.h
+@@ -47,7 +47,7 @@
+ #define MSVCRT_I64_MAX    (((__int64)0x7fffffff << 32) | 0xffffffff)
+ #define MSVCRT_I64_MIN    (-MSVCRT_I64_MAX-1)
+ #define MSVCRT_UI64_MAX   (((unsigned __int64)0xffffffff << 32) | 0xffffffff)
+-#define MSVCRT_MB_LEN_MAX 2
++#define MSVCRT_MB_LEN_MAX 5
+ #ifdef _WIN64
+ #define MSVCRT_SIZE_MAX MSVCRT_UI64_MAX
+ #else
+diff --git a/dlls/msvcrt/wcs.c b/dlls/msvcrt/wcs.c
+index 771f6f6..52345fa 100644
+--- a/dlls/msvcrt/wcs.c
++++ b/dlls/msvcrt/wcs.c
+@@ -1474,7 +1474,7 @@ int CDECL MSVCRT__wctomb_l(char *dst, MSVCRT_wchar_t ch, MSVCRT__locale_t locale
+ {
+     int len;
+ 
+-    MSVCRT__wctomb_s_l(&len, dst, dst ? 6 : 0, ch, locale);
++    MSVCRT__wctomb_s_l(&len, dst, dst ? MSVCRT_MB_LEN_MAX : 0, ch, locale);
+     return len;
+ }
+ 
+diff --git a/include/msvcrt/limits.h b/include/msvcrt/limits.h
+index d0f058b..ece8c68 100644
+--- a/include/msvcrt/limits.h
++++ b/include/msvcrt/limits.h
+@@ -4,7 +4,7 @@
+ #include <crtdefs.h>
+ 
+ #define CHAR_BIT 8
+-#define MB_LEN_MAX 2
++#define MB_LEN_MAX 5
+ 
+ #define SCHAR_MIN (-0x80)
+ #define SCHAR_MAX   0x7f
+-- 
+2.1.0
+
diff --git a/wine.spec b/wine.spec
index 5259088..62d3758 100644
--- a/wine.spec
+++ b/wine.spec
@@ -11,7 +11,7 @@
 
 Name:           wine
 Version:        1.7.35
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        A compatibility layer for windows applications
 
 Group:          Applications/Emulators
@@ -57,6 +57,7 @@ Source501:      wine-tahoma.conf
 Source502:      wine-README-tahoma
 
 Patch511:       wine-cjk.patch
+Patch512:       0001-Bump-MSVCRT_MB_LEN_MAX-to-5-and-use-it-in-MSVCRT__wc.patch
 
 # wine compholio patches for pipelight.
 # pulseaudio-patch is covered by that patch-set, too.
@@ -600,6 +601,7 @@ This package adds the opencl driver for wine.
 %prep
 %setup -q
 %patch511 -p1 -b.cjk
+%patch512 -p1 -b.buf
 
 # setup and apply compholio-patches or pulseaudio-patch.
 # since the pulse patch is included in the compholio patches use it from
@@ -1799,6 +1801,9 @@ fi
 %{_libdir}/wine/opencl.dll.so
 
 %changelog
+* Wed Feb 04 2015 Orion Poplawski <orion@cora.nwra.com> - 1.7.35-3
+- Add patch to fix stack smashing (bug #1110419)
+
 * Mon Jan 26 2015 Michael Cronenworth <mike@cchtml.com> - 1.7.35-2
 - Rebuild (libgphoto2)