From b2ac85adac85f95af999df96367872d38068b028 Mon Sep 17 00:00:00 2001
From: Pauli <paul.dale@oracle.com>
Date: Thu, 6 Jul 2017 08:03:58 +1000
Subject: [PATCH] Rework the append_buf function

It won't overflow the buffer and will allocate new buffers sufficiently large to
hold new strings longer than the expansion factor.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3847)
---
 apps/engine.c | 46 ++++++++++++++++++++++++++++------------------
 1 file changed, 28 insertions(+), 18 deletions(-)

diff --git a/apps/engine.c b/apps/engine.c
index 61fb758b40..5d4708207e 100644
--- a/apps/engine.c
+++ b/apps/engine.c
@@ -48,28 +48,38 @@ const OPTIONS engine_options[] = {
 
 static int append_buf(char **buf, int *size, const char *s)
 {
-    if (*buf == NULL) {
-        *size = 256;
-        *buf = app_malloc(*size, "engine buffer");
-        **buf = '\0';
-    }
+    const int expand = 256;
+    int len = strlen(s) + 1;
+    char *p = *buf;
+
+    if (p == NULL) {
+        *size = ((len + expand - 1) / expand) * expand;
+        p = *buf = app_malloc(*size, "engine buffer");
+    } else {
+        const int blen = strlen(p);
+
+        if (blen > 0)
+            len += 2 + blen;
+
+        if (len > *size) {
+            *size = ((len + expand - 1) / expand) * expand;
+            p = OPENSSL_realloc(p, *size);
+            if (p == NULL) {
+                OPENSSL_free(*buf);
+                *buf = NULL;
+                return 0;
+            }
+            *buf = p;
+        }
 
-    if (strlen(*buf) + strlen(s) >= (unsigned int)*size) {
-        char *tmp;
-        *size += 256;
-        tmp = OPENSSL_realloc(*buf, *size);
-        if (tmp == NULL) {
-            OPENSSL_free(*buf);
-            *buf = NULL;
-            return 0;
+        if (blen > 0) {
+            p += blen;
+            *p++ = ',';
+            *p++ = ' ';
         }
-        *buf = tmp;
     }
 
-    if (**buf != '\0')
-        strcat(*buf, ", ");
-    strcat(*buf, s);
-
+    strcpy(p, s);
     return 1;
 }
 
-- 
2.34.1