From dbbdaa49cd336b5a6080926ce7d7131af8eba430 Mon Sep 17 00:00:00 2001
From: Kern Sibbald <kern@sibbald.com>
Date: Fri, 24 Aug 2007 19:59:43 +0000
Subject: [PATCH] Add insanity checks in bsnprintf

git-svn-id: https://bacula.svn.sourceforge.net/svnroot/bacula/trunk@5403 91ce42f0-d328-0410-95d8-f526ca767f89
---
 bacula/src/lib/bsnprintf.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/bacula/src/lib/bsnprintf.c b/bacula/src/lib/bsnprintf.c
index d9f485ad68..b38b353405 100644
--- a/bacula/src/lib/bsnprintf.c
+++ b/bacula/src/lib/bsnprintf.c
@@ -400,15 +400,15 @@ static int32_t fmtstr(char *buffer, int32_t currlen, int32_t maxlen,
    int padlen, strln;              /* amount to pad */
    int cnt = 0;
 
-   if (value == 0) {
-      value = "<NULL>";
-   }
 
    if (flags & DP_F_DOT && max < 0) {   /* Max not specified */
       max = 0;
    } else if (max < 0) {
       max = maxlen;
    }
+   if (!value) {
+      value = "<NULL>";
+   }
    strln = strlen(value);
    if (strln > max) {
       strln = max;                /* truncate to max */
@@ -578,6 +578,7 @@ static int32_t fmtfp(char *buffer, int32_t currlen, int32_t maxlen,
    char iconvert[311];
    char fconvert[311];
    char *result;
+   char dummy[10];
    int dec_pt, sig;
    int r_length;
    extern char *fcvt(double value, int ndigit, int *decpt, int *sign);
@@ -630,6 +631,7 @@ static int32_t fmtfp(char *buffer, int32_t currlen, int32_t maxlen,
       intpart++;
       fracpart -= (int64_t)pow10(max);
    }
+
 #ifdef DEBUG_SNPRINTF
    printf("fmtfp: %g %d.%d min=%d max=%d\n",
           (double)fvalue, intpart, fracpart, min, max);
@@ -663,7 +665,12 @@ static int32_t fmtfp(char *buffer, int32_t currlen, int32_t maxlen,
    result = fcvt(ufvalue, max, &dec_pt, &sig);
 # endif
 
-   r_length = strlen(result);
+   if (!result) {
+      r_length = 0;
+      result = dummy;
+   } else {
+      r_length = strlen(result);
+   }
 
    /*
     * Fix broken fcvt implementation returns..
@@ -685,8 +692,9 @@ static int32_t fmtfp(char *buffer, int32_t currlen, int32_t maxlen,
 
       fplace = 0;
 
-      while (r_length)
+      while (r_length) {
          fconvert[fplace++] = result[--r_length];
+      }
 
       while ((dec_pt < 0) && (fplace < max)) {
          fconvert[fplace++] = '0';
-- 
2.39.5