Update.

1999-11-10  Andreas Jaeger  <aj@suse.de>

	* string/strsignal.c (strsignal): Correct check for snprintf
	return value.
	* argp/argp-fmtstream.c (__argp_fmtstream_printf): Likewise.

	* misc/efgcvt_r.c (APPEND): Correct check for too small buffer
	according to changed snprintf return value.
	Reported by Lawrence K. Chen <lchen@opentext.com>.

	* misc/tst-efgcvt.c (special): Add tests for a too small buffer
	for ecvt_r and fcvt_r.

5 files changed, 41 insertions, 9 deletions

diff --git a/ChangeLog b/ChangeLog
index f3d9cad..6ea306c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,16 @@
+1999-11-10  Andreas Jaeger  <aj@suse.de>
+
+	* string/strsignal.c (strsignal): Correct check for snprintf
+	return value.
+	* argp/argp-fmtstream.c (__argp_fmtstream_printf): Likewise.
+
+	* misc/efgcvt_r.c (APPEND): Correct check for too small buffer
+	according to changed snprintf return value.
+	Reported by Lawrence K. Chen <lchen@opentext.com>.
+
+	* misc/tst-efgcvt.c (special): Add tests for a too small buffer
+	for ecvt_r and fcvt_r.
+
 1999-11-09  Ulrich Drepper  <drepper@cygnus.com>
 
 	* elf/dl-load.c (_dl_dst_count): Allow $ORIGIN to point to
diff --git a/argp/argp-fmtstream.c b/argp/argp-fmtstream.c
index d563c31..ae547b0 100644
--- a/argp/argp-fmtstream.c
+++ b/argp/argp-fmtstream.c
@@ -1,5 +1,5 @@
 /* Word-wrapping and line-truncating streams
-   Copyright (C) 1997, 1998 Free Software Foundation, Inc.
+   Copyright (C) 1997, 1998, 1999 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Written by Miles Bader <miles@gnu.ai.mit.edu>.
 
@@ -362,6 +362,7 @@ ssize_t
 __argp_fmtstream_printf (struct argp_fmtstream *fs, const char *fmt, ...)
 {
   int out;
+  size_t avail;
   size_t size_guess = PRINTF_SIZE_GUESS; /* How much space to reserve. */
 
   do
@@ -370,13 +371,15 @@ __argp_fmtstream_printf (struct argp_fmtstream *fs, const char *fmt, ...)
 
       if (! __argp_fmtstream_ensure (fs, size_guess))
 	return -1;
-      size_guess += size_guess;
 
       va_start (args, fmt);
-      out = __vsnprintf (fs->p, fs->end - fs->p, fmt, args);
+      avail = fs->end - fs->p;
+      out = __vsnprintf (fs->p, avail, fmt, args);
       va_end (args);
+      if (out >= avail)
+	size_guess = out + 1;
     }
-  while (out == -1);
+  while (out >= avail);
 
   fs->p += out;
 
diff --git a/misc/efgcvt_r.c b/misc/efgcvt_r.c
index 80770e6..1a039ef 100644
--- a/misc/efgcvt_r.c
+++ b/misc/efgcvt_r.c
@@ -101,7 +101,8 @@ APPEND (FUNC_PREFIX, fcvt_r) (value, ndigit, decpt, sign, buf, len)
 
   n = __snprintf (buf, len, "%.*" FLOAT_FMT_FLAG "f", MIN (ndigit, NDIGIT_MAX),
 		  value);
-  if (n < 0)
+  /* Check for a too small buffer.  */
+  if (n >= len)
     return -1;
 
   i = 0;
diff --git a/misc/tst-efgcvt.c b/misc/tst-efgcvt.c
index cfbaa21..74dd6bd 100644
--- a/misc/tst-efgcvt.c
+++ b/misc/tst-efgcvt.c
@@ -120,9 +120,10 @@ test (testcase tests[], efcvt_func efcvt, const char *name)
 void
 special (void)
 {
-  int decpt, sign;
+  int decpt, sign, res;
   char *p;
-
+  char buf [1024];
+  
   p = ecvt (NAN, 10, &decpt, &sign);
   if (sign != 0 || strcmp (p, "nan") != 0)
     output_error ("ecvt", NAN, 10, "nan", 0, 0, p, decpt, sign);
@@ -135,6 +136,20 @@ special (void)
   (void) ecvt (123.456, 10000, &decpt, &sign);
   (void) fcvt (123.456, 10000, &decpt, &sign);
 
+  /* Some tests for for the reentrant functions.  */
+  /* Use a too small buffer.  */
+  res = ecvt_r (123.456, 10, &decpt, &sign, buf, 1);
+  if (res == 0)
+    {
+      printf ("ecvt_r with a too small buffer was succesful.\n");
+      ++error_count;
+    }
+  res = fcvt_r (123.456, 10, &decpt, &sign, buf, 1);
+  if (res == 0)
+    {
+      printf ("fcvt_r with a too small buffer was succesful.\n");
+      ++error_count;
+    }
 }
 
 
diff --git a/string/strsignal.c b/string/strsignal.c
index 1a13707..a9d7233 100644
--- a/string/strsignal.c
+++ b/string/strsignal.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1991, 94, 95, 96, 97, 98 Free Software Foundation, Inc.
+/* Copyright (C) 1991, 94, 95, 96, 97, 98, 99 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
    The GNU C Library is free software; you can redistribute it and/or
@@ -70,7 +70,7 @@ strsignal (int signum)
 #endif
 	len = __snprintf (buffer, BUFFERSIZ - 1, _("Unknown signal %d"),
 			  signum);
-      if (len < 0)
+      if (len >= BUFFERSIZ)
 	buffer = NULL;
       else
 	buffer[len] = '\0';