2000-08-08 Jeff Johnston <jjohnstn@redhat.com>

        * libc/stdio/snprintf.c (snprintf, _snprintf_r): Fixed code
        so size of 0 results in nothing being written to string.
        Also fixed code so that when size is non-zero, there is only
        a maximum of size - 1 characters written to the array and
        a nul terminator is appended at the end.
        * libc/stdio/vsnprintf.c (vsnprintf, _vsnprintf_r): Ditto.

1 files changed, 6 insertions, 4 deletions

diff --git a/newlib/libc/stdio/snprintf.c b/newlib/libc/stdio/snprintf.c
index 333e808e4..c67f8e49b 100644
--- a/newlib/libc/stdio/snprintf.c
+++ b/newlib/libc/stdio/snprintf.c
@@ -47,7 +47,7 @@ _snprintf_r (ptr, str, size, fmt, va_alist)
 
   f._flags = __SWR | __SSTR;
   f._bf._base = f._p = (unsigned char *) str;
-  f._bf._size = f._w = size;
+  f._bf._size = f._w = (size > 0 ? size - 1 : 0);
   f._data = ptr;
 #ifdef _HAVE_STDC
   va_start (ap, fmt);
@@ -56,7 +56,8 @@ _snprintf_r (ptr, str, size, fmt, va_alist)
 #endif
   ret = vfprintf (&f, fmt, ap);
   va_end (ap);
-  *f._p = 0;
+  if (size > 0)
+    *f._p = 0;
   return (ret);
 }
 
@@ -79,7 +80,7 @@ snprintf (str, size, fmt, va_alist)
 
   f._flags = __SWR | __SSTR;
   f._bf._base = f._p = (unsigned char *) str;
-  f._bf._size = f._w = size;
+  f._bf._size = f._w = (size > 0 ? size - 1 : 0);
   f._data = _REENT;
 #ifdef _HAVE_STDC
   va_start (ap, fmt);
@@ -88,7 +89,8 @@ snprintf (str, size, fmt, va_alist)
 #endif
   ret = vfprintf (&f, fmt, ap);
   va_end (ap);
-  *f._p = 0;
+  if (size > 0)
+    *f._p = 0;
   return (ret);
 }