From 2b8bab2f343c7709d26d253250ac611ff665acf5 Mon Sep 17 00:00:00 2001
From: Mike Barcroft <mike@FreeBSD.org>
Date: Wed, 29 Aug 2001 23:51:14 +0000
Subject: [PATCH] o Fix some checks on snprintf(3) to prevent miscalculations.
 o This fixes a memory leak that can occur on some URL's.

Pointy hat to:	brian
---
 usr.bin/ftp/util.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/usr.bin/ftp/util.c b/usr.bin/ftp/util.c
index 60481910c342..3c1d49a6dfc0 100644
--- a/usr.bin/ftp/util.c
+++ b/usr.bin/ftp/util.c
@@ -670,16 +670,22 @@ progressmeter(flag)
 	if (bytes <= 0 || elapsed <= 0.0 || cursize > filesize) {
 		n = snprintf(buf + len, sizeof(buf) - len,
 		    "   --:-- ETA");
+		if (n > 0 && n < sizeof(buf) - len)
+			len += n;
 	} else if (wait.tv_sec >= STALLTIME) {
 		n = snprintf(buf + len, sizeof(buf) - len,
 		    " - stalled -");
+		if (n > 0 && n < sizeof(buf) - len)
+			len += n;
 	} else {
 		remaining = 
 		    ((filesize - restart_point) / (bytes / elapsed) - elapsed);
-		if (remaining >= 100 * SECSPERHOUR)
+		if (remaining >= 100 * SECSPERHOUR) {
 			n = snprintf(buf + len, sizeof(buf) - len,
 			    "   --:-- ETA");
-		else {
+			if (n > 0 && n < sizeof(buf) - len)
+				len += n;
+		} else {
 			i = remaining / SECSPERHOUR;
 			if (i)
 				n = snprintf(buf + len, sizeof(buf) - len,
@@ -694,8 +700,6 @@ progressmeter(flag)
 			    "%02d:%02d ETA", i / 60, i % 60);
 		}
 	}
-	if (n > 0 && n < sizeof(buf) - len)
-		len += n;
 	(void)write(STDOUT_FILENO, buf, len);
 
 	if (flag == -1) {