The argv length calculation was not only off by one, but failed to take

into account the extra space required by expanded quotes, backslashes and
newlines.  Instead of pre-allocating a (possibly too short) buffer, start
with a 64-byte buffer and double it every time we come close to filling
it up.  Also, avoid appending a trailing space before the final newline.

This issue was uncovered by Kristoffer Gleditsch <kristoffer@linpro.no>,
who also helped test this patch.

git-svn-id: svn+ssh://projects.linpro.no/svn/varnish/trunk@1287 d4fa192b-c00b-0410-8231-f00ffab90ce4

diff --git a/varnish-cache/bin/varnishd/mgt_cli.c b/varnish-cache/bin/varnishd/mgt_cli.c
index 08adbb675d50972054ff5b1dc88bd4344d941596..032bd3d8384b4ab8863f412b0ab26577ff320d77 100644 (file)
--- a/varnish-cache/bin/varnishd/mgt_cli.c
+++ b/varnish-cache/bin/varnishd/mgt_cli.c
@@ -95,14 +95,23 @@ mcf_passthru(struct cli *cli, char **av, void *priv)
                cli_out(cli, "Cache process not running");
                return;
        }
-       v = 0;
-       for (u = 1; av[u] != NULL; u++)
-               v += strlen(av[u]) + 3;
+       v = 64;
        p = malloc(v);
        XXXAN(p);
        q = p;
        for (u = 1; av[u] != NULL; u++) {
+               if (v < (q - p) + 8) {
+                       r = realloc(p, v + v);
+                       XXXAN(r);
+                       v += v;
+                       q += r - p;
+                       p = r;
+               }
+               /* v >= (q - p) + 8 */
+               if (u > 1)
+                       *q++ = ' ';
                *q++ = '"';
+               /* v >= (q - p) + 6 */
                for (r = av[u]; *r; r++) {
                        switch (*r) {
                        case '\\':      *q++ = '\\'; *q++ = '\\'; break;
@@ -111,9 +120,10 @@ mcf_passthru(struct cli *cli, char **av, void *priv)
                        default:        *q++ = *r; break;
                        }
                }
+               /* v >= (q - p) + 4 */
                *q++ = '"';
-               *q++ = ' ';
        }
+       /* v >= (q - p) + 3 */
        *q++ = '\n';
        v = q - p;
        i = write(cli_o, p, v);