Don't report an unjustified overflow error.

1 files changed, 21 insertions, 12 deletions

diff --git a/lib/vasnprintf.c b/lib/vasnprintf.c
index 5d818aa642..42d0e747a7 100644
--- a/lib/vasnprintf.c
+++ b/lib/vasnprintf.c
@@ -3442,7 +3442,7 @@ VASNPRINTF (DCHAR_T *resultbuf, size_t *lengthp,
 		    /* SNPRINTF can fail if its second argument is
 		       > INT_MAX.  */
 		    if (maxlen > INT_MAX / TCHARS_PER_DCHAR)
-		      goto overflow;
+		      maxlen = INT_MAX / TCHARS_PER_DCHAR;
 		    maxlen = maxlen * TCHARS_PER_DCHAR;
 # define SNPRINTF_BUF(arg) \
 		    switch (prefix_count)				    \
@@ -3663,17 +3663,26 @@ VASNPRINTF (DCHAR_T *resultbuf, size_t *lengthp,
 		    /* Handle overflow of the allocated buffer.  */
 		    if (count >= maxlen)
 		      {
-			/* Need at least count * sizeof (TCHAR_T) bytes.  But
-			   allocate proportionally, to avoid looping eternally
-			   if snprintf() reports a too small count.  */
-			size_t n =
-			  xmax (xsum (length,
-				      (count + TCHARS_PER_DCHAR - 1)
-				      / TCHARS_PER_DCHAR),
-				xtimes (allocated, 2));
-
-			ENSURE_ALLOCATION (n);
-			continue;
+			/* If maxlen already has attained its allowed maximum,
+			   allocating more memory will not increase maxlen.
+			   Instead of looping, bail out.  */
+			if (maxlen == INT_MAX / TCHARS_PER_DCHAR)
+			  goto overflow;
+			else
+			  {
+			    /* Need at least count * sizeof (TCHAR_T) bytes.
+			       But allocate proportionally, to avoid looping
+			       eternally if snprintf() reports a too small
+			       count.  */
+			    size_t n =
+			      xmax (xsum (length,
+					  (count + TCHARS_PER_DCHAR - 1)
+					  / TCHARS_PER_DCHAR),
+				    xtimes (allocated, 2));
+
+			    ENSURE_ALLOCATION (n);
+			    continue;
+			  }
 		      }
 #endif