Bug 699018: Null terminate buffer in fz_snprintf() even if too short.

Previously the trailing null terminator would not be written if the
formatted string ended up longer than the buffer.

1 files changed, 9 insertions, 6 deletions

diff --git a/source/fitz/printf.c b/source/fitz/printf.c
index bbdda93f..95131ed1 100644
--- a/source/fitz/printf.c
+++ b/source/fitz/printf.c
@@ -474,13 +474,15 @@ fz_vsnprintf(char *buffer, size_t space, const char *fmt, va_list args)
 {
 	struct snprintf_buffer out;
 	out.p = buffer;
-	out.s = space;
+	out.s = space > 0 ? space - 1 : 0;
 	out.n = 0;
 
 	/* Note: using a NULL context is safe here */
 	fz_format_string(NULL, &out, snprintf_emit, fmt, args);
-	snprintf_emit(NULL, &out, 0);
-	return out.n - 1;
+	if (space > 0)
+		out.p[out.n < space ? out.n : space - 1] = '\0';
+
+	return out.n;
 }
 
 size_t
@@ -489,16 +491,17 @@ fz_snprintf(char *buffer, size_t space, const char *fmt, ...)
 	va_list ap;
 	struct snprintf_buffer out;
 	out.p = buffer;
-	out.s = space;
+	out.s = space > 0 ? space - 1 : 0;
 	out.n = 0;
 
 	va_start(ap, fmt);
 	/* Note: using a NULL context is safe here */
 	fz_format_string(NULL, &out, snprintf_emit, fmt, ap);
-	snprintf_emit(NULL, &out, 0);
+	if (space > 0)
+		out.p[out.n < space ? out.n : space - 1] = '\0';
 	va_end(ap);
 
-	return out.n - 1;
+	return out.n;
 }
 
 char *