bugfix: segfault when an *empty* template was used

Bug: http://bugzilla.adiscon.com/show_bug.cgi?id=206
Thanks to David Hill for alerting us.

2 files changed, 13 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 8b735a94..e78dcd48 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,8 @@
 ---------------------------------------------------------------------------
 Version 5.6.1  [V5-BETA] (rgerhards), 2010-??-??
+- bugfix: segfault when an *empty* template was used
+  Bug: http://bugzilla.adiscon.com/show_bug.cgi?id=206
+  Thanks to David Hill for alerting us.
 - bugfix: compile failed with --enable-unlimited-select
   thanks varmojfekoj for the patch
 ---------------------------------------------------------------------------
diff --git a/template.c b/template.c
index c46d144e..06949e45 100644
--- a/template.c
+++ b/template.c
@@ -85,7 +85,7 @@ rsRetVal tplToString(struct template *pTpl, msg_t *pMsg, uchar **ppBuf, size_t *
 {
 	DEFiRet;
 	struct templateEntry *pTpe;
-	int iBuf;
+	size_t iBuf;
 	unsigned short bMustBeFreed;
 	uchar *pVal;
 	size_t iLenVal;
@@ -141,7 +141,15 @@ rsRetVal tplToString(struct template *pTpl, msg_t *pMsg, uchar **ppBuf, size_t *
 		pTpe = pTpe->pNext;
 	}
 
-	(*ppBuf)[iBuf] = '\0'; /* space was reserved above (see copy) */
+	if(iBuf == *pLenBuf) {
+		/* in the weired case of an *empty* template, this can happen.
+		 * it is debatable if we should really fix it here or simply
+		 * forbid that case. However, performance toll is minimal, so 
+		 * I tend to permit it. -- 201011-05 rgerhards
+		 */
+		CHKiRet(ExtendBuf(ppBuf, pLenBuf, iBuf + 1));
+	}
+	(*ppBuf)[iBuf] = '\0';
 	
 finalize_it:
 	RETiRet;