commit d20f7b514c649c94f9679f66792a95037466b7c1
from: Omar Polo <op@omarpolo.com>
date: Fri Sep 08 15:24:58 2023 UTC

amused-web: avoid an (im)possible write out-of-bounds in buf_write

spotted while bringing syncparty' bufio.[ch] in sync; if the requested
len could be bigger than buf->len plus the buf_grow() increment,
so we have to iterate.  This is currently impossible since we're
usign buf_write() only to add one byte.

commit - 7f271cbcec370a1b367005ad2700cd161d183802
commit + d20f7b514c649c94f9679f66792a95037466b7c1
blob - d2b0020075d21db9c6ff1705fce193294e43735c
blob + da7bde52d49d841a387fa5a9526fe9bb66410503
--- web/bufio.c
+++ web/bufio.c
@@ -67,7 +67,7 @@ buf_grow(struct buffer *buf)
 int
 buf_write(struct buffer *buf, const void *d, size_t len)
 {
-	if (buf->len + len > buf->cap) {
+	while (buf->len + len > buf->cap) {
 		if (buf_grow(buf) == -1)
 			return (-1);
 	}