From b8bda67f304b7c70dee891b7ca660036793c2a4b Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Fri, 11 Apr 2014 19:35:54 +0000
Subject: Don't blindly increase offsets by the return value of snprintf, if
 there wasn't enough space this will go off the end. Instead clamp to the
 available space. Fixes crash reported by Julien Rebetez.

---
 cmd-list.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

(limited to 'cmd-list.c')

diff --git a/cmd-list.c b/cmd-list.c
index 82ae7480..6dc4493a 100644
--- a/cmd-list.c
+++ b/cmd-list.c
@@ -103,7 +103,7 @@ size_t
 cmd_list_print(struct cmd_list *cmdlist, char *buf, size_t len)
 {
 	struct cmd	*cmd;
-	size_t		 off;
+	size_t		 off, used;
 
 	off = 0;
 	TAILQ_FOREACH(cmd, &cmdlist->list, qentry) {
@@ -112,8 +112,12 @@ cmd_list_print(struct cmd_list *cmdlist, char *buf, size_t len)
 		off += cmd_print(cmd, buf + off, len - off);
 		if (off >= len)
 			break;
-		if (TAILQ_NEXT(cmd, qentry) != NULL)
-			off += xsnprintf(buf + off, len - off, " ; ");
+		if (TAILQ_NEXT(cmd, qentry) != NULL) {
+			used = xsnprintf(buf + off, len - off, " ; ");
+			if (used > len - off)
+				used = len - off;
+			off += used;
+		}
 	}
 	return (off);
 }
-- 
cgit