[libvirt] [PATCH v2] buf: Fix possible infinite loop in EscapeString, VSnprintf

[Daniel P. Berrange]

On Wed, Sep 01, 2010 at 05:41:46PM -0400, Cole Robinson wrote:
> The current code will go into an infinite loop if the printf generated
> string is >= 1000, AND exactly 1 character smaller than the amount of free
> space in the buffer. When this happens, we are dropped into the loop body,
> but nothing will actually change, because count == (buf->size - buf->use - 1),
> and virBufferGrow returns unchanged if count < (buf->size - buf->use)
> 
> Fix this by removing the '- 1' bit from 'size'. The *nprintf functions handle
> the NULL byte for us anyways, so we shouldn't need to manually accomodate
> for it.
> 
> Here's a bug where we are actually hitting this issue:
> https://bugzilla.redhat.com/show_bug.cgi?id=602772
> 
> v2: Eric's improvements: while -> if (), remove extra va_list variable,
>     make sure we report buffer error if snprintf fails

How about adding a unit test for the virBuffer APIs to verify all
this stuff is working as designed. It is nicely self-contained
code so we ought to be able to get 100% coverage of all codepaths
and error conditions like this one

Daniel
-- 
|: Red Hat, Engineering, London    -o-   http://people.redhat.com/berrange/ :|
|: http://libvirt.org -o- http://virt-manager.org -o- http://deltacloud.org :|
|: http://autobuild.org        -o-         http://search.cpan.org/~danberr/ :|
|: GnuPG: 7D3B9505  -o-   F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|