On 09/02/2010 04:47 AM, Daniel P. Berrange wrote: > On Wed, Sep 01, 2010 at 05:41:46PM -0400, Cole Robinson wrote: >> The current code will go into an infinite loop if the printf generated >> string is >= 1000, AND exactly 1 character smaller than the amount of free >> space in the buffer. When this happens, we are dropped into the loop body, >> but nothing will actually change, because count == (buf->size - buf->use - 1), >> and virBufferGrow returns unchanged if count < (buf->size - buf->use) >> >> Fix this by removing the '- 1' bit from 'size'. The *nprintf functions handle >> the NULL byte for us anyways, so we shouldn't need to manually accomodate >> for it. >> >> Here's a bug where we are actually hitting this issue: >> https://bugzilla.redhat.com/show_bug.cgi?id=602772 >> >> v2: Eric's improvements: while -> if (), remove extra va_list variable, >> make sure we report buffer error if snprintf fails > > How about adding a unit test for the virBuffer APIs to verify all > this stuff is working as designed. It is nicely self-contained > code so we ought to be able to get 100% coverage of all codepaths > and error conditions like this one > > Daniel I sent an updated patch with a unittest that reproduces the infinite loop as a start. Thanks, Cole -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list