Avoid crash in *printf functions for invalid format string with dollar.

diff --git a/gettext-runtime/intl/ChangeLog b/gettext-runtime/intl/ChangeLog
index cb55f3a440196420cb5353c9efff8073fc450e25..425001559f619ca498ff512243a1447aa795a69c 100644 (file)
--- a/gettext-runtime/intl/ChangeLog
+++ b/gettext-runtime/intl/ChangeLog
@@ -1,3 +1,11 @@
+2011-10-15  Bruno Haible  <bruno@clisp.org>
+
+       Avoid crash in *printf functions for invalid format string with dollar.
+       * printf.c (libintl_vsnprintf, libintl_vswprintf): Don't crash in
+       mempy if libintl_vasnprintf returned NULL.
+       Reported by Jeong, Heon <bimarket@gmail.com>
+       in <https://savannah.gnu.org/bugs/?34555>.
+
 2011-10-15  Bruno Haible  <bruno@clisp.org>
 
        vasnprintf: Optimize bit search operation.

diff --git a/gettext-runtime/intl/printf.c b/gettext-runtime/intl/printf.c
index 157853ad4c441865e6832e50d4d1e61780946a45..0369e879e6cddd81fa9fcdfd6903c8d4d291d4be 100644 (file)
--- a/gettext-runtime/intl/printf.c
+++ b/gettext-runtime/intl/printf.c
@@ -213,6 +213,8 @@ libintl_vsnprintf (char *resultbuf, size_t length, const char *format, va_list a
     {
       size_t maxlength = length;
       char *result = libintl_vasnprintf (resultbuf, &length, format, args);
+      if (result == NULL)
+        return -1;
       if (result != resultbuf)
         {
           if (maxlength > 0)
@@ -388,6 +390,8 @@ libintl_vswprintf (wchar_t *resultbuf, size_t length, const wchar_t *format, va_
     {
       size_t maxlength = length;
       wchar_t *result = libintl_vasnwprintf (resultbuf, &length, format, args);
+      if (result == NULL)
+        return -1;
       if (result != resultbuf)
         {
           if (maxlength > 0)