BMessage::PrintToStream() can crash

[jackburton]

This can be reproduced by adding a string, an int32 and an int8 (in that order) to a BMessage and then calling PrintToStream().

[stippi]

I think I've fixed a similar bug recently. It should probably use the field data length instead of letting vprintf figure out the length, if something is not terminated.

[jackburton]

The culprit seems to be the following code in BMessage::_PrintToStream()

case B_STRING_TYPE:
  printf("string(\"%.*s\", %ld bytes)\n", (int)size,
     (char *)pointer, (long)size);
  break;

Which is already correct, though: it uses the passed size to print the string. Maybe something becomes corrupt.

[jackburton]

Replying to jackburton:

Which is already correct, though: it uses the passed size to print the string. Maybe something becomes corrupt.

Reproducible with the following test case:

Add a string, an int32 and an int8 (in that order) to a BMessage and call PrintToStream().