mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-07-11 04:15:49 +00:00
18af6f4e64
The current code will go into an infinite loop if the printf generated string is >= 1000, AND exactly 1 character smaller than the amount of free space in the buffer. When this happens, we are dropped into the loop body, but nothing will actually change, because count == (buf->size - buf->use - 1), and virBufferGrow returns unchanged if count < (buf->size - buf->use) Fix this by removing the '- 1' bit from 'size'. The *nprintf functions handle the NULL byte for us anyways, so we shouldn't need to manually accommodate for it. Here's a bug where we are actually hitting this issue: https://bugzilla.redhat.com/show_bug.cgi?id=602772 v2: Eric's improvements: while -> if (), remove extra va_list variable, make sure we report buffer error if snprintf fails v3: Add tests/virbuftest which reproduces the infinite loop before this patch, works correctly after
36 lines
481 B
Plaintext
36 lines
481 B
Plaintext
Makefile
|
|
Makefile.in
|
|
.deps
|
|
.libs
|
|
sexpr2xmltest
|
|
xml2sexprtest
|
|
virshtest
|
|
conftest
|
|
reconnect
|
|
xmconfigtest
|
|
xencapstest
|
|
qemuxml2xmltest
|
|
qemuxml2argvtest
|
|
qemuargv2xmltest
|
|
qemuhelptest
|
|
networkxml2xmltest
|
|
nodedevxml2xmltest
|
|
interfacexml2xmltest
|
|
storagevolxml2xmltest
|
|
storagepoolxml2xmltest
|
|
nodeinfotest
|
|
statstest
|
|
qparamtest
|
|
virbuftest
|
|
seclabeltest
|
|
eventtest
|
|
*.exe
|
|
object-locking
|
|
object-locking.cmi
|
|
object-locking.cmx
|
|
object-locking-files.txt
|
|
esxutilstest
|
|
vmx2xmltest
|
|
xml2vmxtest
|
|
secaatest
|