Actually check the output buffer length all of the time.

diff --git a/sbr/snprintb.c b/sbr/snprintb.c
index 5f3f1243bc1967007ed551f5f273ac3a846269ed..629da4b7dbf0e367bf3a03ddefae7a4eb6414c06 100644 (file)
--- a/sbr/snprintb.c
+++ b/sbr/snprintb.c
@@ -18,21 +18,28 @@ snprintb (char *buffer, size_t n, unsigned v, char *bits)
 
     snprintf (buffer, n, bits && *bits == 010 ? "0%o" : "0x%x", v);
     bp = buffer + strlen(buffer);
 
     snprintf (buffer, n, bits && *bits == 010 ? "0%o" : "0x%x", v);
     bp = buffer + strlen(buffer);

+    n -= strlen(buffer);

 
     if (bits && *++bits) {
        j = 0;
        *bp++ = '<';
 
     if (bits && *++bits) {
        j = 0;
        *bp++ = '<';

-       while ((i = *bits++))
+       while ((i = *bits++) && n > 1)

            if (v & (1 << (i - 1))) {
            if (v & (1 << (i - 1))) {

-               if (j++)
+               if (j++ && n > 1) {

                    *bp++ = ',';
                    *bp++ = ',';

-               for (; (c = *bits) > 32; bits++)
+                   n--;
+               }
+               for (; (c = *bits) > 32 && n > 1; bits++) {

                    *bp++ = c;
                    *bp++ = c;

+                   n--;
+               }

            }
            else
                for (; *bits > 32; bits++)
                    continue;
            }
            else
                for (; *bits > 32; bits++)
                    continue;

-       *bp++ = '>';
+       if (n > 1)
+           *bp++ = '>';
+

        *bp = 0;
     }
 
        *bp = 0;
     }