[7799] use text_buffer functions in replace_in_documentation

[gavinsmith0123]

Revision: 7799
          http://svn.sv.gnu.org/viewvc/?view=rev&root=texinfo&revision=7799
Author:   gavin
Date:     2017-05-20 09:00:32 -0400 (Sat, 20 May 2017)
Log Message:
-----------
use text_buffer functions in replace_in_documentation

Modified Paths:
--------------
    trunk/ChangeLog
    trunk/info/infodoc.c

Modified: trunk/ChangeLog
===================================================================
--- trunk/ChangeLog     2017-05-20 11:41:27 UTC (rev 7798)
+++ trunk/ChangeLog     2017-05-20 13:00:32 UTC (rev 7799)
@@ -1,5 +1,14 @@
 2017-05-20  Gavin Smith  <address@hidden>
 
+       * info/infodoc.c (replace_in_documentation): Use functions 
+       operating on a struct text_buffer object to keep track of
+       whether there is enough space in the output buffer.
+       Benno Schulenberg reported that there would be an out-of-bounds
+       write when a message reporting an index match was output if the
+       binding of ',' had been changed away from 'next-index-match'.
+
+2017-05-20  Gavin Smith  <address@hidden>
+
        * info/infodoc.c (replace_in_documentation): Explicitly compare 
        a pointed-to character to the only character value it can be 
        equal to other than null, for clarity.  Move code near other 

Modified: trunk/info/infodoc.c
===================================================================
--- trunk/info/infodoc.c        2017-05-20 11:41:27 UTC (rev 7798)
+++ trunk/info/infodoc.c        2017-05-20 13:00:32 UTC (rev 7799)
@@ -635,18 +635,19 @@
   return text_buffer_base (&rep);
 }
 
-/* Replace the names of functions with the key that invokes them. */
+/* Replace the names of functions with the key that invokes them.
+   Return value should not be freed by caller. */
 char *
 replace_in_documentation (const char *string, int help_is_only_window_p)
 {
-  unsigned reslen = strlen (string);
-  register int i, start, next;
-  static char *result = NULL;
+  register int i, start;
+  static struct text_buffer txtresult = {0};
 
-  free (result);
-  result = xmalloc (1 + reslen);
+  text_buffer_free (&txtresult);
+  text_buffer_init (&txtresult);
+  text_buffer_alloc (&txtresult, strlen (string));
 
-  next = start = 0;
+  start = 0;
 
   /* Skip to the beginning of a replaceable function. */
   for (i = start; string[i]; i++)
@@ -691,8 +692,7 @@
               unsigned replen;
 
               /* Copy in the old text. */
-              strncpy (result + next, string + start, i - start);
-              next += (i - start);
+              text_buffer_add_string (&txtresult, string + start, i - start);
               start = j + 1;
 
               /* Move to the end of the function name. */
@@ -731,34 +731,20 @@
               rep = where_is (info_keymap, command);
               if (!rep)
                 rep = "N/A";
-              replen = strlen (rep) + 1;
+              replen = strlen (rep);
 
               if (fmt)
-                {
-                  if (replen > max)
-                    replen = max;
-                  if (replen < min)
-                    replen = min;
-                }
-              if (next + replen > reslen)
-                {
-                  reslen = next + replen + 1;
-                  result = xrealloc (result, reslen + 1);
-                }
-
-              if (fmt)
-                  sprintf (result + next, fmt, rep);
+                text_buffer_printf (&txtresult, fmt, rep);
               else
-                  strcpy (result + next, rep);
-
-              next = strlen (result);
+                text_buffer_add_string (&txtresult, rep, replen);
             }
 
           free (fmt);
         }
     }
-  strcpy (result + next, string + start);
-  return result;
+  text_buffer_add_string (&txtresult,
+                          string + start, strlen (string + start) + 1);
+  return text_buffer_base (&txtresult);
 }
 
 /* Return a string of characters which could be typed from the keymap