Re: [libvirt] [PATCH] Avoid crash in virBufferEscapeString

If virBufferEscapeString is called on a buffer that has 0 bytes of space, a size of -1 will be passed to snprintf, resulting in a segmentation fault. This patch checks for 0 space, and grows the buffer if needed prior to determining size. I discovered this when I accidentally made virBufferEscapeString the first function to add something to a newly minted buffer. --- src/util/buf.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/src/util/buf.c b/src/util/buf.c index c802aa2..9681635 100644 --- a/src/util/buf.c +++ b/src/util/buf.c @@ -318,6 +318,12 @@ virBufferEscapeString(const virBufferPtr buf, const char *format, const char *st } *out = 0; + if ((buf->use >= buf->size) && + virBufferGrow(buf, 100) < 0) {