upnp_event_prepare(): check the return value of snprintf()
@@ -443,6 +443,7 @@ static void upnp_event_prepare(struct upnp_event_notify * obj)
l = 0;
}
obj->buffersize = 1024;
+ for (;;) {
obj->buffer = malloc(obj->buffersize);
if(!obj->buffer) {
syslog(LOG_ERR, "%s: malloc returned NULL", "upnp_event_prepare");
@@ -456,6 +457,20 @@ static void upnp_event_prepare(struct upnp_event_notify * obj)
obj->path, obj->addrstr, obj->portstr, l+2,
obj->sub->uuid, obj->sub->seq,
l, xml);
+ if (obj->tosend < 0) {
+ syslog(LOG_ERR, "%s: snprintf() failed", "upnp_event_prepare");
+ if(xml) {
+ free(xml);
+ }
+ obj->state = EError;
+ return;
+ } else if (obj->tosend < obj->buffersize) {
+ break; /* the buffer was large enough */
+ }
+ /* Try again with a buffer big enough */
+ free(obj->buffer);
+ obj->buffersize = obj->tosend + 1; /* reserve space for the final 0 */
+ }
if(xml) {
free(xml);
xml = NULL;
