Fix vsnprintf(3) memory leak for size == 0.

PR:             bin/36175
Obtained from:  OpenBSD
Reviewed by:    silence on -audit
MFC after:      5 days

1 files changed, 6 insertions, 0 deletions

diff --git a/lib/libc/stdio/vsnprintf.c b/lib/libc/stdio/vsnprintf.c
index ecbce5a..6479807 100644
--- a/lib/libc/stdio/vsnprintf.c
+++ b/lib/libc/stdio/vsnprintf.c
@@ -50,6 +50,7 @@ vsnprintf(char * __restrict str, size_t n, const char * __restrict fmt,
 {
 	size_t on;
 	int ret;
+	char dummy;
 	FILE f;
 	struct __sFILEX ext;
 
@@ -58,6 +59,11 @@ vsnprintf(char * __restrict str, size_t n, const char * __restrict fmt,
 		n--;
 	if (n > INT_MAX)
 		n = INT_MAX;
+	/* Stdio internals do not deal correctly with zero length buffer */
+	if (n == 0) {
+                str = &dummy;
+                n = 1;
+	}
 	f._file = -1;
 	f._flags = __SWR | __SSTR;
 	f._bf._base = f._p = (unsigned char *)str;