strbuf_vinsertf inserts a formatted string in the middle of an existing
strbuf value. It makes room in the strbuf by moving existing string to
the back, then formats the string to insert directly into the hole.
It uses vsnprintf to format the string. The buffer size provided in the
invocation is the number of characters available in the allocated space
behind the final string. This does not make any sense at all.
Fix it to pass the length of the inserted string plus one for the NUL.
(The functions saves and restores the character that the NUL occupies.)
Signed-off-by: Johannes Sixt <j6t@xxxxxxxx>
---
I found this, because in my environment I have to compile with
SNPRINTF_RETURNS_BOGUS. Our implementation of vsnprintf in
compat/snprintf.c writes into the end of the buffer unconditionally,
at a spot that is unrelated to the formatted string, and this leads to
"BUG: a NUL byte in commit log message not allowed" in some "stash"
tests.
strbuf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/strbuf.c b/strbuf.c
index bfbbdadbf3..87ecf7f975 100644
--- a/strbuf.c
+++ b/strbuf.c
@@ -270,7 +270,7 @@ void strbuf_vinsertf(struct strbuf *sb, size_t pos, const char *fmt, va_list ap)
memmove(sb->buf + pos + len, sb->buf + pos, sb->len - pos);
/* vsnprintf() will append a NUL, overwriting one of our characters */
save = sb->buf[pos + len];
- len2 = vsnprintf(sb->buf + pos, sb->alloc - sb->len, fmt, ap);
+ len2 = vsnprintf(sb->buf + pos, len + 1, fmt, ap);
sb->buf[pos + len] = save;
if (len2 != len)
BUG("your vsnprintf is broken (returns inconsistent lengths)");
--
2.20.1.86.gb0de946387
