From 6903c6832ee29ae469b74e9d046b1cd07d6f1181 Mon Sep 17 00:00:00 2001
From: Jilles Tjoelker <jilles@FreeBSD.org>
Date: Sat, 11 Dec 2010 17:47:27 +0000
Subject: [PATCH] sh: Use vsnprintf() rather than crafting our own in fmtstr().
 Add INTOFF/INTON as longjmp out of vsnprintf may cause memory leaks or
 undefined behaviour.

---
 bin/sh/output.c | 23 +++++------------------
 1 file changed, 5 insertions(+), 18 deletions(-)

diff --git a/bin/sh/output.c b/bin/sh/output.c
index 8442a22ec62a..b4dab51e5d65 100644
--- a/bin/sh/output.c
+++ b/bin/sh/output.c
@@ -64,8 +64,7 @@ __FBSDID("$FreeBSD$");
 
 
 #define OUTBUFSIZ BUFSIZ
-#define BLOCK_OUT -2		/* output to a fixed block of memory */
-#define MEM_OUT -3		/* output to dynamically allocated memory */
+#define MEM_OUT -2		/* output to dynamically allocated memory */
 #define OUTPUT_ERR 01		/* error occurred on output */
 
 static int doformat_wr(void *, const char *, int);
@@ -180,18 +179,12 @@ outbin(const void *data, size_t len, struct output *file)
 		outc(*p++, file);
 }
 
-static char out_junk[16];
-
 void
 emptyoutbuf(struct output *dest)
 {
 	int offset;
 
-	if (dest->fd == BLOCK_OUT) {
-		dest->nextc = out_junk;
-		dest->nleft = sizeof out_junk;
-		dest->flags |= OUTPUT_ERR;
-	} else if (dest->buf == NULL) {
+	if (dest->buf == NULL) {
 		INTOFF;
 		dest->buf = ckmalloc(dest->bufsize);
 		dest->nextc = dest->buf;
@@ -282,18 +275,12 @@ void
 fmtstr(char *outbuf, int length, const char *fmt, ...)
 {
 	va_list ap;
-	struct output strout;
 
-	strout.nextc = outbuf;
-	strout.nleft = length;
-	strout.fd = BLOCK_OUT;
-	strout.flags = 0;
+	INTOFF;
 	va_start(ap, fmt);
-	doformat(&strout, fmt, ap);
+	vsnprintf(outbuf, length, fmt, ap);
 	va_end(ap);
-	outc('\0', &strout);
-	if (strout.flags & OUTPUT_ERR)
-		outbuf[length - 1] = '\0';
+	INTON;
 }
 
 static int