bugfix: segfault when an *empty* template was used

Bug: http://bugzilla.adiscon.com/show_bug.cgi?id=206
Thanks to David Hill for alerting us.

1 files changed, 10 insertions, 2 deletions

diff --git a/template.c b/template.c
index c46d144e..06949e45 100644
--- a/template.c
+++ b/template.c
@@ -85,7 +85,7 @@ rsRetVal tplToString(struct template *pTpl, msg_t *pMsg, uchar **ppBuf, size_t *
 {
 	DEFiRet;
 	struct templateEntry *pTpe;
-	int iBuf;
+	size_t iBuf;
 	unsigned short bMustBeFreed;
 	uchar *pVal;
 	size_t iLenVal;
@@ -141,7 +141,15 @@ rsRetVal tplToString(struct template *pTpl, msg_t *pMsg, uchar **ppBuf, size_t *
 		pTpe = pTpe->pNext;
 	}
 
-	(*ppBuf)[iBuf] = '\0'; /* space was reserved above (see copy) */
+	if(iBuf == *pLenBuf) {
+		/* in the weired case of an *empty* template, this can happen.
+		 * it is debatable if we should really fix it here or simply
+		 * forbid that case. However, performance toll is minimal, so 
+		 * I tend to permit it. -- 201011-05 rgerhards
+		 */
+		CHKiRet(ExtendBuf(ppBuf, pLenBuf, iBuf + 1));
+	}
+	(*ppBuf)[iBuf] = '\0';
 	
 finalize_it:
 	RETiRet;