Merge branch 'master' into 4.next

[users/heiko/exim.git] / src / src / string.c

diff --git a/src/src/string.c b/src/src/string.c
index 6b7d9a0674750a001240e5efa67d3fbd0eaad0ec..2e919e6d9761451b7665c7f4643aa929df41a184 100644 (file)
--- a/src/src/string.c
+++ b/src/src/string.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2016 */
+/* Copyright (c) University of Cambridge 1995 - 2017 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Miscellaneous string-handling functions. Some are not required for
@@ -1372,10 +1372,20 @@ while (*fp != 0)
     break;
 
     case 'p':
-    if (p >= last - 24) { yield = FALSE; goto END_FORMAT; }
-    strncpy(newformat, item_start, fp - item_start);
-    newformat[fp - item_start] = 0;
-    p += sprintf(CS p, newformat, va_arg(ap, void *));
+      {
+      void * ptr;
+      if (p >= last - 24) { yield = FALSE; goto END_FORMAT; }
+      /* sprintf() saying "(nil)" for a null pointer seems unreliable.
+      Handle it explicitly. */
+      if ((ptr = va_arg(ap, void *)))
+       {
+       strncpy(newformat, item_start, fp - item_start);
+       newformat[fp - item_start] = 0;
+       p += sprintf(CS p, newformat, ptr);
+       }
+      else
+       p += sprintf(CS p, "(nil)");
+      }
     break;
 
     /* %f format is inherently insecure if the numbers that it may be