Fix infinite loop if the format buffer is too small.

diff --git a/cups/string.c b/cups/string.c
index 4d5e09172d2a821c27798473c307934c5e8a7f66..615caadf022ee526c5c79ae8aaa7a927606eebb0 100644 (file)
--- a/cups/string.c
+++ b/cups/string.c
@@ -480,6 +480,8 @@ cupsFormatStringv(
 
       if (bufptr < bufend)
         *bufptr++ = *format++;
+      else
+        format ++;
     }
   }