Fix --logfile and message truncation issue.

Regression in 6.4.20's security fix (Git commit c546c829).

We doubly incremented partial_message_size_used on modern systems
(stdard.h/vsnprintf), once in report_vbuild() and then again in
report_build(), so the 2nd and subsequent report_build() fragments
landed too late in the buffer.  This will not cause overruns due to the
reallocation prior to the vsnprintf/sprintf, but it write starts behind
the '\0' byte, instead of right over it, so the string also gets
truncated to the first fragment written with report_vbuild().

Fix by moving the increment back into the #else...#endif part that does
not use report_vbuild().

Reported by: Jürgen Edner, Erik Christiansen

1 files changed, 2 insertions, 1 deletions

diff --git a/report.c b/report.c
index aea6b3ea..2db7d0a9 100644
--- a/report.c
+++ b/report.c
@@ -286,10 +286,11 @@ report_build (FILE *errfp, message, va_alist)
     n = snprintf (partial_message + partial_message_size_used,
 		    partial_message_size - partial_message_size_used,
 		    message, a1, a2, a3, a4, a5, a6, a7, a8);
-#endif
 
     if (n > 0) partial_message_size_used += n;
 
+#endif
+
     if (unbuffered && partial_message_size_used != 0)
     {
 	partial_message_size_used = 0;