From 71b8b60b220945aa0c2b541bf144182e2bb6e032 Mon Sep 17 00:00:00 2001
From: Rainer Gerhards <rgerhards@adiscon.com>
Date: Fri, 5 Nov 2010 10:41:44 +0100
Subject: bugfix: segfault when an *empty* template was used

Bug: http://bugzilla.adiscon.com/show_bug.cgi?id=206
Thanks to David Hill for alerting us.
---
 template.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

(limited to 'template.c')

diff --git a/template.c b/template.c
index c46d144e..06949e45 100644
--- a/template.c
+++ b/template.c
@@ -85,7 +85,7 @@ rsRetVal tplToString(struct template *pTpl, msg_t *pMsg, uchar **ppBuf, size_t *
 {
 	DEFiRet;
 	struct templateEntry *pTpe;
-	int iBuf;
+	size_t iBuf;
 	unsigned short bMustBeFreed;
 	uchar *pVal;
 	size_t iLenVal;
@@ -141,7 +141,15 @@ rsRetVal tplToString(struct template *pTpl, msg_t *pMsg, uchar **ppBuf, size_t *
 		pTpe = pTpe->pNext;
 	}
 
-	(*ppBuf)[iBuf] = '\0'; /* space was reserved above (see copy) */
+	if(iBuf == *pLenBuf) {
+		/* in the weired case of an *empty* template, this can happen.
+		 * it is debatable if we should really fix it here or simply
+		 * forbid that case. However, performance toll is minimal, so 
+		 * I tend to permit it. -- 201011-05 rgerhards
+		 */
+		CHKiRet(ExtendBuf(ppBuf, pLenBuf, iBuf + 1));
+	}
+	(*ppBuf)[iBuf] = '\0';
 	
 finalize_it:
 	RETiRet;
-- 
cgit