From: Bruno Haible <bruno@clisp.org>
Date: Sat, 15 Oct 2011 15:30:44 +0000 (+0200)
Subject: Avoid crash in *printf functions for invalid format string with dollar.
X-Git-Tag: v0.18.2~50
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1a1831be04f634375c7e7c56cac7ec2f4167e863;p=thirdparty%2Fgettext.git

Avoid crash in *printf functions for invalid format string with dollar.
---

diff --git a/gettext-runtime/intl/ChangeLog b/gettext-runtime/intl/ChangeLog
index cb55f3a44..425001559 100644
--- a/gettext-runtime/intl/ChangeLog
+++ b/gettext-runtime/intl/ChangeLog
@@ -1,3 +1,11 @@
+2011-10-15  Bruno Haible  <bruno@clisp.org>
+
+	Avoid crash in *printf functions for invalid format string with dollar.
+	* printf.c (libintl_vsnprintf, libintl_vswprintf): Don't crash in
+	mempy if libintl_vasnprintf returned NULL.
+	Reported by Jeong, Heon <bimarket@gmail.com>
+	in <https://savannah.gnu.org/bugs/?34555>.
+
 2011-10-15  Bruno Haible  <bruno@clisp.org>
 
 	vasnprintf: Optimize bit search operation.
diff --git a/gettext-runtime/intl/printf.c b/gettext-runtime/intl/printf.c
index 157853ad4..0369e879e 100644
--- a/gettext-runtime/intl/printf.c
+++ b/gettext-runtime/intl/printf.c
@@ -213,6 +213,8 @@ libintl_vsnprintf (char *resultbuf, size_t length, const char *format, va_list a
     {
       size_t maxlength = length;
       char *result = libintl_vasnprintf (resultbuf, &length, format, args);
+      if (result == NULL)
+        return -1;
       if (result != resultbuf)
         {
           if (maxlength > 0)
@@ -388,6 +390,8 @@ libintl_vswprintf (wchar_t *resultbuf, size_t length, const wchar_t *format, va_
     {
       size_t maxlength = length;
       wchar_t *result = libintl_vasnwprintf (resultbuf, &length, format, args);
+      if (result == NULL)
+        return -1;
       if (result != resultbuf)
         {
           if (maxlength > 0)