Re: [libvirt] [PATCH v2] buf: Fix possible infinite loop in EscapeString, VSnprintf

2010-09-09 Thread Cole Robinson
On 09/02/2010 04:47 AM, Daniel P. Berrange wrote: > On Wed, Sep 01, 2010 at 05:41:46PM -0400, Cole Robinson wrote: >> The current code will go into an infinite loop if the printf generated >> string is >= 1000, AND exactly 1 character smaller than the amount of free >> space in the buffer. When thi

Re: [libvirt] [PATCH v2] buf: Fix possible infinite loop in EscapeString, VSnprintf

2010-09-02 Thread Daniel P. Berrange
On Wed, Sep 01, 2010 at 05:41:46PM -0400, Cole Robinson wrote: > The current code will go into an infinite loop if the printf generated > string is >= 1000, AND exactly 1 character smaller than the amount of free > space in the buffer. When this happens, we are dropped into the loop body, > but not

Re: [libvirt] [PATCH v2] buf: Fix possible infinite loop in EscapeString, VSnprintf

2010-09-01 Thread Eric Blake
On 09/01/2010 03:41 PM, Cole Robinson wrote: +size = buf->size - buf->use; +if ((count = vsnprintf(&buf->content[buf->use], + size, format, argptr))< 0) { +buf->error = 1; +goto err; +} Hmm, thinking about this a bit more, most callers blin

Re: [libvirt] [PATCH v2] buf: Fix possible infinite loop in EscapeString, VSnprintf

2010-09-01 Thread Eric Blake
On 09/01/2010 03:41 PM, Cole Robinson wrote: The current code will go into an infinite loop if the printf generated string is>= 1000, AND exactly 1 character smaller than the amount of free space in the buffer. When this happens, we are dropped into the loop body, but nothing will actually change

[libvirt] [PATCH v2] buf: Fix possible infinite loop in EscapeString, VSnprintf

2010-09-01 Thread Cole Robinson
The current code will go into an infinite loop if the printf generated string is >= 1000, AND exactly 1 character smaller than the amount of free space in the buffer. When this happens, we are dropped into the loop body, but nothing will actually change, because count == (buf->size - buf->use - 1),