From c3ddec37aab70e1b59d5ff35b1f0d1964efe288f Mon Sep 17 00:00:00 2001 From: Tom Sepez Date: Mon, 3 Apr 2017 09:42:56 -0700 Subject: Do not shrink buffer before examining last byte in TryVSWPrintF Bug: 707479 Change-Id: I6deea8ca2408df8715e639c8ff161cbb3d5f8296 Reviewed-on: https://pdfium-review.googlesource.com/3595 Commit-Queue: Lei Zhang Reviewed-by: Lei Zhang --- core/fxcrt/cfx_widestring.cpp | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'core/fxcrt') diff --git a/core/fxcrt/cfx_widestring.cpp b/core/fxcrt/cfx_widestring.cpp index 49a62da9a7..c3be23a8df 100644 --- a/core/fxcrt/cfx_widestring.cpp +++ b/core/fxcrt/cfx_widestring.cpp @@ -611,8 +611,9 @@ bool CFX_WideString::TryVSWPrintf(FX_STRSIZE size, // See https://crbug.com/705912. memset(m_pData->m_String, 0, (size + 1) * sizeof(wchar_t)); int ret = vswprintf(m_pData->m_String, size + 1, pFormat, argList); + bool bSufficientBuffer = ret >= 0 || m_pData->m_String[size - 1] == 0; ReleaseBuffer(); - return ret >= 0 || m_pData->m_String[size - 1] == 0; + return bSufficientBuffer; } void CFX_WideString::FormatV(const wchar_t* pFormat, va_list argList) { @@ -627,9 +628,9 @@ void CFX_WideString::FormatV(const wchar_t* pFormat, va_list argList) { } while (nMaxLen < 32 * 1024) { FX_VA_COPY(argListCopy, argList); - bool bRetryPointless = TryVSWPrintf(nMaxLen, pFormat, argListCopy); + bool bSufficientBuffer = TryVSWPrintf(nMaxLen, pFormat, argListCopy); va_end(argListCopy); - if (bRetryPointless) + if (bSufficientBuffer) break; nMaxLen *= 2; } -- cgit v1.2.3