[libvirt] [PATCH] Avoid crash in virBufferEscapeString

[Chris Lalancette]

Laine Stump wrote:
> If virBufferEscapeString is called on a buffer that has 0 bytes of
> space, a size of -1 will be passed to snprintf, resulting in a
> segmentation fault. This patch checks for 0 space, and grows the
> buffer if needed prior to determining size.
> 
> I discovered this when I accidentally made virBufferEscapeString the
> first function to add something to a newly minted buffer.
> ---
>  src/util/buf.c |    6 ++++++
>  1 files changed, 6 insertions(+), 0 deletions(-)
> 
> diff --git a/src/util/buf.c b/src/util/buf.c
> index c802aa2..9681635 100644
> --- a/src/util/buf.c
> +++ b/src/util/buf.c
> @@ -318,6 +318,12 @@ virBufferEscapeString(const virBufferPtr buf, const char *format, const char *st
>      }
>      *out = 0;
>  
> +    if ((buf->use >= buf->size) &&
> +        virBufferGrow(buf, 100) < 0) {

Good catch.  The hardcode of 100 threw me at first, but I see that we
appropriately grow the buffer as needed in the loop below, so I think this works.

ACK

-- 
Chris Lalancette