[libvirt] [PATCH v2] buf: Fix possible infinite loop in EscapeString, VSnprintf

[Cole Robinson]

On 09/02/2010 04:47 AM, Daniel P. Berrange wrote:
> On Wed, Sep 01, 2010 at 05:41:46PM -0400, Cole Robinson wrote:
>> The current code will go into an infinite loop if the printf generated
>> string is >= 1000, AND exactly 1 character smaller than the amount of free
>> space in the buffer. When this happens, we are dropped into the loop body,
>> but nothing will actually change, because count == (buf->size - buf->use - 1),
>> and virBufferGrow returns unchanged if count < (buf->size - buf->use)
>>
>> Fix this by removing the '- 1' bit from 'size'. The *nprintf functions handle
>> the NULL byte for us anyways, so we shouldn't need to manually accomodate
>> for it.
>>
>> Here's a bug where we are actually hitting this issue:
>> https://bugzilla.redhat.com/show_bug.cgi?id=602772
>>
>> v2: Eric's improvements: while -> if (), remove extra va_list variable,
>>     make sure we report buffer error if snprintf fails
> 
> How about adding a unit test for the virBuffer APIs to verify all
> this stuff is working as designed. It is nicely self-contained
> code so we ought to be able to get 100% coverage of all codepaths
> and error conditions like this one
> 
> Daniel

I sent an updated patch with a unittest that reproduces the infinite
loop as a start.

Thanks,
Cole