Hello,

 I compiled the configtool on my amd64 system (freebsd). After changing some
 int* casts to intptr_t compiling the configtool worked. (Any interests in
 the diff?)
 However - starting the configtool out of a long directory lead to a
 segfault. I traced down the problem to the String::vFormat function

void String::vFormat(LPCTSTR  pszFormat, va_list marker)
{
  for(int nLength=100;nLength;) {
    TCHAR *buf=new TCHAR[1+nLength];
    int n=_vsntprintf(buf, nLength, pszFormat, marker );
    if(-1==n){
      nLength*=2;  // NT behavior
    } else if (n<nLength){
      string::operator=(buf);
      nLength=0;   // trigger exit from loop
    } else {
nLength=n+1; // UNIX behavior generally, or NT behavior when buffer size exactly matches required length
    }
    delete [] buf;
  }
}

When the for-loop runs the second time (which occurs when the output string is longer that 100 chars) the _vsntprintf function is called a second time. This is not allowed because the va_list argument marker has already consumed during the first call.

Anyway - the coding style of this function seems to be somewhat strange. Why using the "nLength=0; // trigger exit from loop" instead of calling exit? However - I'm not very familiar with c++ so it might be the better way to exit that loop.

Greetings,
 Martin Laabs

Reply via email to