snprintf includes zero-terminator in its size limit, so 7
rather than 6 bytes are needed to snprintf a colon followed
by 5 port digits.
Whether the bug has any runtime effects in the current code,
I do not know, but I did waste a few hours following
misleading debugging output.
p += ToHostname(p, blen);
- if (m_SocketAddr.sin6_port > 0 && p < (buf+blen-6) ) {
- /* 6 is max length of expected ':port' (short int) */
- snprintf(p, 6,":%d", GetPort() );
+ if (m_SocketAddr.sin6_port > 0 && p <= (buf+blen-7) ) {
+ // ':port' (short int) needs at most 6 bytes plus 1 for 0-terminator
+ snprintf(p, 7, ":%d", GetPort() );
}
// force a null-terminated string