* strings/apr_strings.c (apr_pstrcat): Only read from the initialized

  part of saved_lengths array when nargs < MAX_SAVED_LENGTHS (fixing
  Coverity warning).

* test/teststr.c: Add trivial testcases for apr_pstrcat (though this
  does not reproduce any problems from the bug).


git-svn-id: https://svn.apache.org/repos/asf/apr/apr/trunk@1878354 13f79535-47bb-0310-9956-ffa450edef68

2 files changed, 18 insertions, 4 deletions

diff --git a/strings/apr_strings.c b/strings/apr_strings.c
index beca6d480..ed999561b 100644
--- a/strings/apr_strings.c
+++ b/strings/apr_strings.c
@@ -124,7 +124,7 @@ APR_DECLARE_NONSTD(char *) apr_pstrcat(apr_pool_t *a, ...)
 {
     char *cp, *argp, *res;
     apr_size_t saved_lengths[MAX_SAVED_LENGTHS];
-    int nargs = 0;
+    unsigned n, nargs = 0;
 
     /* Pass one --- find length of required string */
 
@@ -152,10 +152,10 @@ APR_DECLARE_NONSTD(char *) apr_pstrcat(apr_pool_t *a, ...)
 
     va_start(adummy, a);
 
-    nargs = 0;
+    n = 0;
     while ((argp = va_arg(adummy, char *)) != NULL) {
-        if (nargs < MAX_SAVED_LENGTHS) {
-            len = saved_lengths[nargs++];
+        if (n < nargs) {
+            len = saved_lengths[n++];
         }
         else {
             len = strlen(argp);
diff --git a/test/teststr.c b/test/teststr.c
index 951a83001..1a1d8fa01 100644
--- a/test/teststr.c
+++ b/test/teststr.c
@@ -394,6 +394,19 @@ static void skip_prefix(abts_case *tc, void *data)
     ABTS_STR_EQUAL(tc, apr_cstr_skip_prefix("",      "12"),    NULL);
 }
 
+static void pstrcat(abts_case *tc, void *data)
+{
+    ABTS_STR_EQUAL(tc, apr_pstrcat(p, "a", "bc", "def", NULL),
+                   "abcdef");
+    ABTS_STR_EQUAL(tc, apr_pstrcat(p, NULL), "");
+    ABTS_STR_EQUAL(tc, apr_pstrcat(p,
+                                   "a", "b", "c", "d", "e",
+                                   "f", "g", "h", "i", "j",
+                                   "1", "2", "3", "4", "5",
+                                   NULL),
+                   "abcdefghij12345");
+}
+
 abts_suite *teststr(abts_suite *suite)
 {
     suite = ADD_SUITE(suite)
@@ -412,6 +425,7 @@ abts_suite *teststr(abts_suite *suite)
     abts_run_test(suite, string_cpystrn, NULL);
     abts_run_test(suite, snprintf_overflow, NULL);
     abts_run_test(suite, skip_prefix, NULL);
+    abts_run_test(suite, pstrcat, NULL);
 
     return suite;
 }