proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-05-25 06:10:23 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

lib: fix __darr_in_vsprintf

Browse Source 
If the initial darr capacity is not enough for the output, the `ap` is
reused multiple times, which is wrong, because it may be altered by
`vsnprintf`. Make a copy of `ap` each time instead of reusing.

Signed-off-by: Igor Ryzhov <iryzhov@nfware.com>
This commit is contained in:
Igor Ryzhov 2024-02-05 19:04:39 +02:00
parent e3bc6e39e4
commit ee0c1cc1e4
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/darr.c
View File

@ -58,6 +58,7 @@ char *__darr_in_vsprintf(char **sp, bool concat, const char *fmt, va_list ap)
size_t inlen = concat ? darr_strlen(*sp) : 0; size_t inlen = concat ? darr_strlen(*sp) : 0;
size_t capcount = strlen(fmt) + MIN(inlen + 64, 128); size_t capcount = strlen(fmt) + MIN(inlen + 64, 128);
ssize_t len; ssize_t len;
va_list ap_copy;
darr_ensure_cap(*sp, capcount); darr_ensure_cap(*sp, capcount);
@ -68,7 +69,9 @@ char *__darr_in_vsprintf(char **sp, bool concat, const char *fmt, va_list ap)
if (darr_len(*sp) == 0) if (darr_len(*sp) == 0)
*darr_append(*sp) = 0; *darr_append(*sp) = 0;
again: again:
len = vsnprintf(darr_last(*sp), darr_avail(*sp), fmt, ap); va_copy(ap_copy, ap);
len = vsnprintf(darr_last(*sp), darr_avail(*sp), fmt, ap_copy);
va_end(ap_copy);
if (len < 0) if (len < 0)
darr_in_strcat(*sp, fmt); darr_in_strcat(*sp, fmt);
else if ((size_t)len < darr_avail(*sp)) else if ((size_t)len < darr_avail(*sp))