From: Laine Stump <laine@laine.org>
Date: Thu, 15 Oct 2009 12:19:11 +0000 (+0200)
Subject: Avoid crash in virBufferEscapeString
X-Git-Tag: v0.7.3~218
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=04e068626282d7b1783bac6633c30dfbe0bfe714;p=thirdparty%2Flibvirt.git

Avoid crash in virBufferEscapeString

* src/util/buf.c: if virBufferEscapeString was called on a buffer that
  had 0 bytes of space, a size of -1 will be passed to snprintf, resulting
  in a segmentation fault, this preallocate some space.
---

diff --git a/src/util/buf.c b/src/util/buf.c
index c802aa2c61..9681635caa 100644
--- a/src/util/buf.c
+++ b/src/util/buf.c
@@ -318,6 +318,12 @@ virBufferEscapeString(const virBufferPtr buf, const char *format, const char *st
     }
     *out = 0;
 
+    if ((buf->use >= buf->size) &&
+        virBufferGrow(buf, 100) < 0) {
+        VIR_FREE(escaped);
+        return;
+    }
+
     size = buf->size - buf->use - 1;
     while (((count = snprintf(&buf->content[buf->use], size, format,
                               (char *)escaped)) < 0) || (count >= size - 1)) {