From 5afdbc4eab6fd5e60367a0740eba14dfb5c32ad0 Mon Sep 17 00:00:00 2001 From: Johannes Sixt Date: Sun, 3 Feb 2019 17:51:54 +0100 Subject: [PATCH] strbuf_vinsertf: provide the correct buffer size to vsnprintf strbuf_vinsertf inserts a formatted string in the middle of an existing strbuf value. It makes room in the strbuf by moving existing string to the back, then formats the string to insert directly into the hole. It uses vsnprintf to format the string. The buffer size provided in the invocation is the number of characters available in the allocated space behind the final string. This does not make any sense at all. Fix it to pass the length of the inserted string plus one for the NUL. (The functions saves and restores the character that the NUL occupies.) Signed-off-by: Johannes Sixt Signed-off-by: Junio C Hamano --- strbuf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/strbuf.c b/strbuf.c index bfbbdadbf3..87ecf7f975 100644 --- a/strbuf.c +++ b/strbuf.c @@ -270,7 +270,7 @@ void strbuf_vinsertf(struct strbuf *sb, size_t pos, const char *fmt, va_list ap) memmove(sb->buf + pos + len, sb->buf + pos, sb->len - pos); /* vsnprintf() will append a NUL, overwriting one of our characters */ save = sb->buf[pos + len]; - len2 = vsnprintf(sb->buf + pos, sb->alloc - sb->len, fmt, ap); + len2 = vsnprintf(sb->buf + pos, len + 1, fmt, ap); sb->buf[pos + len] = save; if (len2 != len) BUG("your vsnprintf is broken (returns inconsistent lengths)");