fix up potential printf's with unsafe format strings

[oweals/busybox.git] / libbb / verror_msg.c

diff --git a/libbb/verror_msg.c b/libbb/verror_msg.c
index ca44030b20bc7d964138e2eafc290ae4c7a7d709..506b9066a905ac8d6fe6d00fc32baac7e05e722e 100644 (file)
--- a/libbb/verror_msg.c
+++ b/libbb/verror_msg.c
@@ -13,9 +13,9 @@
 smallint logmode = LOGMODE_STDIO;
 const char *msg_eol = "\n";
 
-void bb_verror_msg(const char *s, va_list p, const char* strerr)
+void FAST_FUNC bb_verror_msg(const char *s, va_list p, const char* strerr)
 {
-       char *msg;
+       char *msg, *msg1;
        int applet_len, strerr_len, msgeol_len, used;
 
        if (!logmode)
@@ -36,27 +36,36 @@ void bb_verror_msg(const char *s, va_list p, const char* strerr)
        applet_len = strlen(applet_name) + 2; /* "applet: " */
        strerr_len = strerr ? strlen(strerr) : 0;
        msgeol_len = strlen(msg_eol);
+       /* can't use xrealloc: it calls error_msg on failure,
+        * that may result in a recursion */
        /* +3 is for ": " before strerr and for terminating NUL */
-       msg = xrealloc(msg, applet_len + used + strerr_len + msgeol_len + 3);
-       /* TODO: maybe use writev instead of memmoving? Need full_writev? */
-       memmove(msg + applet_len, msg, used);
-       used += applet_len;
-       strcpy(msg, applet_name);
-       msg[applet_len - 2] = ':';
-       msg[applet_len - 1] = ' ';
-       if (strerr) {
-               if (s[0]) { /* not perror_nomsg? */
-                       msg[used++] = ':';
-                       msg[used++] = ' ';
+       msg1 = realloc(msg, applet_len + used + strerr_len + msgeol_len + 3);
+       if (!msg1) {
+               msg[used++] = '\n'; /* overwrites NUL */
+               applet_len = 0;
+       } else {
+               msg = msg1;
+               /* TODO: maybe use writev instead of memmoving? Need full_writev? */
+               memmove(msg + applet_len, msg, used);
+               used += applet_len;
+               strcpy(msg, applet_name);
+               msg[applet_len - 2] = ':';
+               msg[applet_len - 1] = ' ';
+               if (strerr) {
+                       if (s[0]) { /* not perror_nomsg? */
+                               msg[used++] = ':';
+                               msg[used++] = ' ';
+                       }
+                       strcpy(&msg[used], strerr);
+                       used += strerr_len;
                }
-               strcpy(&msg[used], strerr);
-               used += strerr_len;
+               strcpy(&msg[used], msg_eol);
+               used += msgeol_len;
        }
-       strcpy(&msg[used], msg_eol);
 
        if (logmode & LOGMODE_STDIO) {
                fflush(stdout);
-               full_write(2, msg, used + msgeol_len);
+               full_write(STDERR_FILENO, msg, used);
        }
        if (logmode & LOGMODE_SYSLOG) {
                syslog(LOG_ERR, "%s", msg + applet_len);
@@ -70,7 +79,7 @@ void bb_verror_msg(const char *s, va_list p, const char* strerr)
 /* Code size is approximately the same, but currently it's the only user
  * of writev in entire bbox. __libc_writev in uclibc is ~50 bytes. */
 
-void bb_verror_msg(const char *s, va_list p, const char* strerr)
+void FAST_FUNC bb_verror_msg(const char *s, va_list p, const char* strerr)
 {
        int strerr_len, msgeol_len;
        struct iovec iov[3];