From 17893b24ea87ae013d88ab280e262cbde00e2815 Mon Sep 17 00:00:00 2001
From: Scot Breitenfeld <brtnfld@hdfgroup.org>
Date: Mon, 29 Sep 2014 10:31:40 -0500
Subject: [svn-r25629] Fix for hdffv-8855.

---
 hl/src/H5LT.c       | 23 +++++++++++++++++++++--
 hl/test/test_lite.c | 38 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 59 insertions(+), 2 deletions(-)

diff --git a/hl/src/H5LT.c b/hl/src/H5LT.c
index 1eba40c..ed725a3 100644
--- a/hl/src/H5LT.c
+++ b/hl/src/H5LT.c
@@ -2267,6 +2267,8 @@ out:
 static char* 
 realloc_and_append(hbool_t _no_user_buf, size_t *len, char *buf, char *str_to_add)
 {
+    size_t size_str_to_add, size_str;
+
     if(_no_user_buf) {
         /* If the buffer isn't big enough, reallocate it.  Otherwise, go to do strcat. */
         if(str_to_add && ((ssize_t)(*len - (HDstrlen(buf) + HDstrlen(str_to_add) + 1)) < LIMIT)) {
@@ -2281,8 +2283,25 @@ realloc_and_append(hbool_t _no_user_buf, size_t *len, char *buf, char *str_to_ad
     if(!buf)
         goto out;
 
-    if(str_to_add)
-        HDstrcat(buf, str_to_add);
+    if(str_to_add) {
+      /* find the size of the buffer to add */
+      size_str_to_add = HDstrlen(str_to_add);
+      /* find the size of the current buffer */
+      size_str = HDstrlen(buf);
+
+      /* Check to make sure the appended string does not 
+       * extend past the allocated buffer; if it does then truncate the string
+       */
+      if(size_str < *len - 1) {
+	if( size_str + size_str_to_add < *len - 1) {
+	  HDstrncat(buf, str_to_add, size_str_to_add);
+	} else {
+	  HDstrncat(buf, str_to_add, (*len - 1) - size_str);
+	}
+      } else {
+	buf[*len-1] = '\0'; /* buffer is full, null terminate */
+      }
+    }
 
     return buf;
 
diff --git a/hl/test/test_lite.c b/hl/test/test_lite.c
index cb13061..d61d6cf 100644
--- a/hl/test/test_lite.c
+++ b/hl/test/test_lite.c
@@ -1238,6 +1238,41 @@ static int test_strings(void)
     }
     HDfree(dt_str);
 
+    /* Length of the character buffer is larger then needed */
+    str_len = str_len + 10;
+    if(NULL==(dt_str = (char*)HDcalloc(str_len, sizeof(char))))
+      goto out;
+    
+    if(H5LTdtype_to_text(dtype, dt_str, H5LT_DDL, &str_len)<0) {
+      HDfree(dt_str);
+      goto out;
+    }
+    if(HDstrncmp(dt_str, "H5T_STRING {\n      STRSIZE H5T_VARIABLE;\n      STRPAD H5T_STR_NULLPAD;\n      CSET H5T_CSET_ASCII;\n      CTYPE H5T_C_S1;\n   }", str_len-1)) {
+      printf("dt=\n%s\n", dt_str);
+      HDfree(dt_str);
+      goto out;
+    }
+
+    /* Length of the character buffer is smaller then needed */
+    str_len = 21;
+    if(NULL==(dt_str = (char*)HDcalloc(str_len, sizeof(char))))
+      goto out;
+
+    if(H5LTdtype_to_text(dtype, dt_str, H5LT_DDL, &str_len)<0) {
+      HDfree(dt_str);
+      goto out;
+    }
+    /* check the truncated string */
+    if(strlen(dt_str) != str_len-1) goto out;
+    str_len = strlen(dt_str);
+    if(HDstrncmp(dt_str, "H5T_STRING {\n      STRSIZE H5T_VARIABLE;\n      STRPAD H5T_STR_NULLPAD;\n      CSET H5T_CSET_ASCII;\n      CTYPE H5T_C_S1;\n   }", str_len)) {
+      printf("dt=\n%s\n", dt_str);
+      HDfree(dt_str);
+      goto out;
+    }
+
+    HDfree(dt_str);
+
     if(H5Tclose(dtype)<0)
         goto out;
 
@@ -1245,6 +1280,9 @@ static int test_strings(void)
     return 0;
 
 out:
+    if(dt_str)
+      HDfree(dt_str);
+
     H5_FAILED();
     return -1;
 }
-- 
cgit v0.12