From b163757a47d525019cebae8e1ecb843a49a14196 Mon Sep 17 00:00:00 2001
From: root <root@abc39116-655e-4be6-ad55-d661dc543056>
Date: Fri, 25 Jul 2008 01:11:39 +0000
Subject: This was the culprit causing the `Abort' crash, valgrind showed that
 this file is where the error lied.  Stephen Darragh discovered this, and the
 fix has been to use vsnprintf() and not vsprintf(), which should have been
 the case to begin with really.

git-svn-id: svn://svn.autonomy.net.au/python-dmidecode@18 abc39116-655e-4be6-ad55-d661dc543056
---
 catsprintf.c | 14 ++++++++++----
 catsprintf.h |  4 +++-
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/catsprintf.c b/catsprintf.c
index d9d73ff..c8f74fc 100644
--- a/catsprintf.c
+++ b/catsprintf.c
@@ -59,20 +59,26 @@ dmi_minor* dmiAppendObject(long code, char const *key, const char *format, ...)
 
   //. int minor = code&0x00FF;
   //. int major = code>>8;
+
   va_list arg;
   va_start(arg, format);
 
   dmi_minor *o = (dmi_minor *)malloc(sizeof(dmi_minor));
+  o->next = last;
   o->id = code;
   o->major = (dmi_codes_major *)&dmiCodesMajor[map_maj[code>>8]];
   o->key = (char *)key;
-  if (format != NULL)
-    vsprintf(o->value, format, arg);
 
-  o->next = last;
+  if(format != NULL)
+    if(vsnprintf(o->value, MAXVAL-1, format, arg) > MAXVAL) {
+      free(o);
+      o = NULL;
+      //. TODO: Make this a python exception.
+      printf("dmidecode: Internal (python module) error; Value too long.\n");
+    }
 
-  va_end(arg); /* cleanup */
   last = o;
+  va_end(arg); /* cleanup */
 
   return o;
 }
diff --git a/catsprintf.h b/catsprintf.h
index b4060e6..bab2e2c 100644
--- a/catsprintf.h
+++ b/catsprintf.h
@@ -9,6 +9,8 @@
 #include <stdlib.h>
 #include <assert.h>
 
+#define MAXVAL 1024
+
 typedef struct _dmi_codes_major {
   const unsigned short code;
   const char *id;
@@ -19,7 +21,7 @@ typedef struct _dmi_minor {
   long id;
   dmi_codes_major* major;
   char *key;
-  char value[512];
+  char value[MAXVAL];
   struct _dmi_minor* next;
 } dmi_minor;
 
-- 
cgit