From 79a4a198fe1a201be8d84186717964c26763e1ac Mon Sep 17 00:00:00 2001
From: Danny Robson <danny@blubinc.net>
Date: Sun, 19 Jul 2009 21:35:40 +1000
Subject: [PATCH] Change sprintf() to babl_strcat() in model create_name()

babl/babl-model.c create_name uses an unsafe incantation of sprintf
to build names from concatenated components which should ideally use a
"%s" format specifier preceding the instance name.

Instead of fixing this, we replace it with a babl_strcat() based
alternative which allows us to remove the thread-unsafe static character
buffer at the cost of a few mallocs and a free.

Also do some cleanups, mainly to avoid two exit points from the
function, that increases readability and warns if a model with the
same name is registered twice.

This is bug #589021.
---
 babl/babl-model.c | 58 +++++++++++++++++++++++------------------------
 1 file changed, 28 insertions(+), 30 deletions(-)

diff --git a/babl/babl-model.c b/babl/babl-model.c
index c78f1d8..2b26e91 100644
--- a/babl/babl-model.c
+++ b/babl/babl-model.c
@@ -34,24 +34,19 @@ each_babl_model_destroy (Babl *babl,
   return 0;  /* continue iterating */
 }
 
-static char buf[512] = "";
-
-static const char *
-create_name (const char     *name,
-             int             components,
-             BablComponent **component)
+static char *
+babl_model_create_name (int             components,
+                        BablComponent **component)
 {
-  char *p = buf;
+  char *p = NULL;
 
-  if (name)
-    return name;
   while (components--)
     {
-      sprintf (p, (*component)->instance.name);
-      p += strlen ((*component)->instance.name);
+      p = babl_strcat(p, (*component)->instance.name);
       component++;
     }
-  return buf;
+
+  return p;
 }
 
 static Babl *
@@ -84,10 +79,11 @@ babl_model_new (void *first_argument,
 {
   va_list        varg;
   Babl          *babl;
-  int            id         = 0;
-  int            components = 0;
-  const char    *arg        = first_argument;
-  const char    *name       = NULL;
+  int            id            = 0;
+  int            components    = 0;
+  const char    *arg           = first_argument;
+  const char    *assigned_name = NULL;
+  char          *name          = NULL;
   BablComponent *component [BABL_MAX_COMPONENTS];
 
   va_start (varg, first_argument);
@@ -107,7 +103,7 @@ babl_model_new (void *first_argument,
                 if (components >= BABL_MAX_COMPONENTS)
                   {
                     babl_log ("maximum number of components (%i) exceeded for %s",
-                              BABL_MAX_COMPONENTS, name);
+                              BABL_MAX_COMPONENTS, assigned_name);
                   }
                 break;
 
@@ -148,12 +144,12 @@ babl_model_new (void *first_argument,
 
       else if (!strcmp (arg, "name"))
         {
-          name = va_arg (varg, char *);
+          assigned_name = va_arg (varg, char *);
         }
 
       else
         {
-          babl_fatal ("unhandled argument '%s' for babl_model '%s'", arg, name);
+          babl_fatal ("unhandled argument '%s' for babl_model '%s'", arg, assigned_name);
         }
 
       arg = va_arg (varg, char *);
@@ -163,23 +159,25 @@ babl_model_new (void *first_argument,
 
   va_end (varg);
 
-  name = create_name (name, components, component);
+  if (assigned_name)
+    name = babl_strdup(assigned_name);
+  else
+    name = babl_model_create_name (components, component);
 
   babl = babl_db_exist (db, id, name);
-  if (babl)
+
+  if (! babl)
+    {
+      babl = model_new (name, id, components, component);
+      babl_db_insert (db, babl);
+    }
+  else
     {
-      /* There is an instance already registered by the required id/name,
-       * returning the preexistent one instead.
-       */
-      return babl;
+      babl_log ("Warning: BablModel '%s' already registered!", name);
     }
 
-  babl = model_new (name, id, components, component);
+  babl_free (name);
 
-  /* Since there is not an already registered instance by the required
-   * id/name, inserting newly created class into database.
-   */
-  babl_db_insert (db, babl);
   return babl;
 }
 
-- 
2.30.2