fix buffer overflows

Signed-off-by: Benjamin Otte <in7y118@public.uni-hamburg.de>

diff --git a/src/output.c b/src/output.c
index 025d2f0c249a98c12db03a01207b1c62dae62338..2fbabed2e11c4fb059ac0d6d78defc52095d48b0 100644 (file)
--- a/src/output.c
+++ b/src/output.c
@@ -255,7 +255,9 @@ static int snd_output_buffer_need(snd_output_t *output, size_t size)
        if (buffer->alloc == 0)
                alloc = 256;
        else
-               alloc = buffer->alloc * 2;
+               alloc = buffer->alloc;
+       while (alloc < size)
+               alloc *= 2;
        buffer->buf = realloc(buffer->buf, alloc);
        if (!buffer->buf)
                return -ENOMEM;
@@ -281,8 +283,9 @@ static int snd_output_buffer_print(snd_output_t *output, const char *format, va_
        result = snd_output_buffer_need(output, size);
        if (result < 0)
                return result;
-       result = vsprintf(buffer->buf + buffer->size, format, args);
+       result = vsnprintf(buffer->buf + buffer->size, result, format, args);
        assert(result == (int)size);
+       buffer->size += result;
        return result;
 }