This was the culprit causing the `Abort' crash, valgrind showed that this file

is where the error lied.  Stephen Darragh discovered this, and the fix has been
to use vsnprintf() and not vsprintf(), which should have been the case to begin
with really.


git-svn-id: svn://svn.autonomy.net.au/python-dmidecode@18 abc39116-655e-4be6-ad55-d661dc543056

2 files changed, 13 insertions, 5 deletions

diff --git a/catsprintf.c b/catsprintf.c
index d9d73ff..c8f74fc 100644
--- a/catsprintf.c
+++ b/catsprintf.c
@@ -59,20 +59,26 @@ dmi_minor* dmiAppendObject(long code, char const *key, const char *format, ...)
 
   //. int minor = code&0x00FF;
   //. int major = code>>8;
+
   va_list arg;
   va_start(arg, format);
 
   dmi_minor *o = (dmi_minor *)malloc(sizeof(dmi_minor));
+  o->next = last;
   o->id = code;
   o->major = (dmi_codes_major *)&dmiCodesMajor[map_maj[code>>8]];
   o->key = (char *)key;
-  if (format != NULL)
-    vsprintf(o->value, format, arg);
 
-  o->next = last;
+  if(format != NULL)
+    if(vsnprintf(o->value, MAXVAL-1, format, arg) > MAXVAL) {
+      free(o);
+      o = NULL;
+      //. TODO: Make this a python exception.
+      printf("dmidecode: Internal (python module) error; Value too long.\n");
+    }
 
-  va_end(arg); /* cleanup */
   last = o;
+  va_end(arg); /* cleanup */
 
   return o;
 }
diff --git a/catsprintf.h b/catsprintf.h
index b4060e6..bab2e2c 100644
--- a/catsprintf.h
+++ b/catsprintf.h
@@ -9,6 +9,8 @@
 #include <stdlib.h>
 #include <assert.h>
 
+#define MAXVAL 1024
+
 typedef struct _dmi_codes_major {
   const unsigned short code;
   const char *id;
@@ -19,7 +21,7 @@ typedef struct _dmi_minor {
   long id;
   dmi_codes_major* major;
   char *key;
-  char value[512];
+  char value[MAXVAL];
   struct _dmi_minor* next;
 } dmi_minor;