From 0e48ac1f99a370a8b378e8ca059525feb0bf74d3 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Wed, 13 Jul 2022 23:46:16 +0200
Subject: [PATCH] mprintf: make dprintf_formatf never return negative

This function no longer returns a negative value if the formatting
string is bad since the return value would sometimes be propagated as a
return code from the mprintf* functions and they are documented to
return the length of the output. Which cannot be negative.

Fixes #9149
Closes #9151
Reported-by: yiyuaner on github
---
 lib/mprintf.c          | 12 ++++++------
 lib/sendf.c            |  4 ++--
 tests/libtest/lib557.c |  4 ++--
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/lib/mprintf.c b/lib/mprintf.c
index f0401a881a..1d8052dcd6 100644
--- a/lib/mprintf.c
+++ b/lib/mprintf.c
@@ -594,7 +594,7 @@ static int dprintf_formatf(
 
   /* Do the actual %-code parsing */
   if(dprintf_Pass1(format, vto, endpos, ap_save))
-    return -1;
+    return 0;
 
   end = &endpos[0]; /* the initial end-position from the list dprintf_Pass1()
                        created for us */
@@ -1025,11 +1025,12 @@ int curl_mvsnprintf(char *buffer, size_t maxlength, const char *format,
   info.max = maxlength;
 
   retcode = dprintf_formatf(&info, addbyter, format, ap_save);
-  if((retcode != -1) && info.max) {
+  if(info.max) {
     /* we terminate this with a zero byte */
     if(info.max == info.length) {
       /* we're at maximum, scrap the last letter */
       info.buffer[-1] = 0;
+      DEBUGASSERT(retcode);
       retcode--; /* don't count the nul byte */
     }
     else
@@ -1073,7 +1074,7 @@ int Curl_dyn_vprintf(struct dynbuf *dyn, const char *format, va_list ap_save)
   info.fail = 0;
 
   retcode = dprintf_formatf(&info, alloc_addbyter, format, ap_save);
-  if((-1 == retcode) || info.fail) {
+  if(!retcode && info.fail) {
     Curl_dyn_free(info.b);
     return 1;
   }
@@ -1082,15 +1083,14 @@ int Curl_dyn_vprintf(struct dynbuf *dyn, const char *format, va_list ap_save)
 
 char *curl_mvaprintf(const char *format, va_list ap_save)
 {
-  int retcode;
   struct asprintf info;
   struct dynbuf dyn;
   info.b = &dyn;
   Curl_dyn_init(info.b, DYN_APRINTF);
   info.fail = 0;
 
-  retcode = dprintf_formatf(&info, alloc_addbyter, format, ap_save);
-  if((-1 == retcode) || info.fail) {
+  (void)dprintf_formatf(&info, alloc_addbyter, format, ap_save);
+  if(info.fail) {
     Curl_dyn_free(info.b);
     return NULL;
   }
diff --git a/lib/sendf.c b/lib/sendf.c
index a210284579..32714255d4 100644
--- a/lib/sendf.c
+++ b/lib/sendf.c
@@ -245,7 +245,7 @@ void Curl_infof(struct Curl_easy *data, const char *fmt, ...)
   DEBUGASSERT(!strchr(fmt, '\n'));
   if(data && data->set.verbose) {
     va_list ap;
-    size_t len;
+    int len;
     char buffer[MAXINFO + 2];
     va_start(ap, fmt);
     len = mvsnprintf(buffer, MAXINFO, fmt, ap);
@@ -265,7 +265,7 @@ void Curl_failf(struct Curl_easy *data, const char *fmt, ...)
   DEBUGASSERT(!strchr(fmt, '\n'));
   if(data->set.verbose || data->set.errorbuffer) {
     va_list ap;
-    size_t len;
+    int len;
     char error[CURL_ERROR_SIZE + 2];
     va_start(ap, fmt);
     len = mvsnprintf(error, CURL_ERROR_SIZE, fmt, ap);
diff --git a/tests/libtest/lib557.c b/tests/libtest/lib557.c
index 9afc566b6a..d9f5c4e63b 100644
--- a/tests/libtest/lib557.c
+++ b/tests/libtest/lib557.c
@@ -1532,8 +1532,8 @@ static int test_weird_arguments(void)
                       0, 1, 2, 3, 4, 5, 6, 7, 8, 9, /* 10 11 */
                       0, 1, 2, 3, 4, 5, 6, 7, 8);   /* 9 */
 
-  if(rc != -1) {
-    printf("curl_mprintf() returned %d and not -1!\n", rc);
+  if(rc) {
+    printf("curl_mprintf() returned %d and not 0\n", rc);
     errors++;
   }
 
-- 
2.47.3