From: Rich Felker <dalias@aerifal.cx>
Date: Tue, 8 Nov 2016 01:39:59 +0000 (-0500)
Subject: fix swprintf internal buffer state and error handling
X-Git-Tag: v1.1.16~27
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=7442442ccc665641a8827177e8e7ed45bbbd6584;p=musl

fix swprintf internal buffer state and error handling

the swprintf write callback never reset its buffer pointers, so after
its 256-byte buffer filled up, it would keep repeating those bytes
over and over in the output until the destination buffer filled up. it
also failed to set the error indicator for the stream on EILSEQ,
potentially allowing output to continue after the error.
---

diff --git a/src/stdio/vswprintf.c b/src/stdio/vswprintf.c
index 7d237bae..6eb2f6ac 100644
--- a/src/stdio/vswprintf.c
+++ b/src/stdio/vswprintf.c
@@ -24,7 +24,14 @@ static size_t sw_write(FILE *f, const unsigned char *s, size_t l)
 		c->ws++;
 	}
 	*c->ws = 0;
-	return i<0 ? i : l0;
+	if (i < 0) {
+		f->wpos = f->wbase = f->wend = 0;
+		f->flags |= F_ERR;
+		return i;
+	}
+	f->wend = f->buf + f->buf_size;
+	f->wpos = f->wbase = f->buf;
+	return l0;
 }
 
 int vswprintf(wchar_t *restrict s, size_t n, const wchar_t *restrict fmt, va_list ap)