fix integer underflow in tor_vsnprintf()

(probably exploitable)

svn:r3011

diff --git a/src/common/compat.c b/src/common/compat.c
index d46077485a3026c447f118827c76f4a3edba6ed3..da2b8a143d3118a44cef886f17ce783d992b9b4d 100644 (file)
--- a/src/common/compat.c
+++ b/src/common/compat.c
@@ -90,12 +90,14 @@ int tor_snprintf(char *str, size_t size, const char *format, ...)
   return r;
 }
 
-/** Replacement for vsnpritnf; behavior differs as tor_snprintf differs from
+/** Replacement for vsnprintf; behavior differs as tor_snprintf differs from
  * snprintf.
  */
 int tor_vsnprintf(char *str, size_t size, const char *format, va_list args)
 {
   int r;
+  if (size == 0)
+    return -1; /* no place for the NUL */
 #ifdef MS_WINDOWS
   r = _vsnprintf(str, size, format, args);
 #else